Privacy Policy

1. Introduction

Welcome to Health3 (“we,” “us,” or “our”). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile application (the “App”), our web application and website (the “Website”), and related services. By using these services, you acknowledge the practices described in this policy.

Note on HIPAA applicability: Health3 is a consumer wellness application and is not a “Covered Entity” or “Business Associate” under U.S. HIPAA, because we do not provide medical services, bill health plans, or engage with insurers. We instead protect your health information under GDPR, UK GDPR, CCPA/CPRA, and relevant state privacy laws.

2. Data Controller Information

• Company Name: Health3 AG
• Address: Wiesenstrasse 10A, 8952 Schlieren, Switzerland
• Email: privacy@health3.app

EU and UK Representatives (Article 27)

Health3 AG is based in Switzerland, outside the EU/EEA and the UK. Under Article 27 of the EU GDPR and the UK GDPR we have appointed representatives that you and data protection authorities can contact about how your personal data is handled:

• EU representative: iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Vienna, Austria.
• UK representative: Prighter Ltd, United Kingdom.

You can contact the relevant representative about any data protection matter concerning your personal data.

3. Types of Data Collected

Within the app, we collect the following types of personal data:

• Health Biomarker Data: Common biomarkers measured with a blood test, as shared by you by using upload functionality within the App.
• Personal Identification Information: Email address, year of birth, gender, as shared by you by specifying profile details within the App.
• App and Website Analytics (only if you opt in): Analytics is off by default. Only when you enable analytics under Settings → Analytics do we use PostHog to collect pseudonymous product events from the App and Website, such as screens or pages opened, buttons or product flows used, app or website version, platform, browser category, locale, approximate location derived from the network request, subscription platform and coarse subscription state. Operational events may contain coarse, non-health counts or categories needed to understand whether a feature worked. Error events contain normalized error categories only; they do not contain raw exception messages, stack traces, user-entered text, or file contents. You can withdraw consent at any time from the same setting, which stops future collection and clears the analytics identifier on that device.
  
  For an authenticated account, events use the Health3 account UUID as a pseudonymous identifier so activity can be grouped across sessions and platforms. Consented sessions that are not associated with an authenticated account use a generated analytics identifier. We do not send your name or email as an analytics property and we do not use advertising identifiers or cross-site advertising tracking.
  
  We never record your screen, and our PostHog analytics allowlist excludes biomarker names or keys, lab values, result classifications, health scores, reference ranges, journal entries, health-topic identifiers, OCR text, support messages, and other health or free-text content. As described in Section 20, sanitized unsupported biomarker names and units may be counted separately in a privacy-minimized aggregate after analytics consent; exact unsupported names and units are not sent to PostHog. PostHog processes this data on EU infrastructure in Frankfurt. Analytics events remain available only for the event-retention period included in our PostHog service plan and are then removed; we delete them earlier when you delete your account or request erasure. If you delete your Health3 account, we request deletion of the corresponding PostHog person and historical events before deleting the authentication record.

On our website, we collect the following types of data:

• Personal Data: When you interact with our website, we may collect personal information such as your name, email address, phone number, and any other information you provide voluntarily.
• Web Subscription and Order Data: If you start or manage a web subscription, we process the Health3 account identifier, email address, selected plan, price and currency, checkout and subscription identifiers, subscription status, billing dates, and order events needed to provide and reconcile Premium access. Payment and billing details are entered directly into Stripe / Link checkout. Health3 does not receive or store your full card number or card security code.
• Essential Website Logs: Our hosting and security providers process request metadata such as IP address, browser and operating-system category, requested path, timestamp, and security signals as necessary to deliver and protect the Website. These operational logs are separate from optional PostHog product analytics.
• Cookies and Local Storage: We use strictly necessary browser storage for authentication, security, consent choices, and service operation. Optional PostHog analytics storage is used only after you opt in. You can withdraw analytics consent at any time under Settings → Analytics.
• Analytics Data (with your consent): The Website uses the same consent-controlled PostHog analytics described above. We do not use Google Analytics 4. Optional analytics remains disabled until you opt in and can be disabled again under Settings → Analytics.

4. Purpose of Data Processing

We process your data for the following purposes:

• Providing Services: To deliver the App’s functionalities, including tracking and analyzing health metrics, we process the biomarker data you share with us.
• Personalization: To customize your experience and provide tailored content. To provide the most accurate and relevant information in the area of reference ranges, we use your personal identifying information about year of birth and gender in order to show you the reference range relevant to you.
• Communication: To send you updates (including in-app or push notifications about new features or health insights, with your consent), newsletters, and to respond to inquiries.
• Compliance: To comply with legal obligations and protect our legal rights.
• Subscription Administration: To create and manage subscriptions, synchronize Premium access across web and mobile, reconcile payment status, prevent duplicate subscriptions, provide billing support, prevent fraud, and maintain transaction records required by law.
• App Maintenance: To help us address any technical issues with the App and its operations, we process pseudonymized usage data.
• Website Management:
  • To provide, operate, and maintain our website and services.
  • To improve, personalize, and expand our website.
  • To understand and analyze how you use our website.

Lawful Bases for Processing (GDPR / UK GDPR Art. 6 & 9):

• Consent: Explicit consent for all health data processing and for analytics.
• Contractual Necessity: To perform our services under the Terms and Conditions (e.g., login, data display).
• Legal Obligation: Where retention or disclosure is required by law (e.g., tax, record-keeping).
• Legitimate Interests: For security, fraud prevention, and service improvement (with safeguards and right to object).

5. Consent Management

• Obtaining Consent: We obtain your explicit consent before collecting or processing your health data and before enabling any analytics.
• Withdrawing Consent:
  • For analytics: open the App, go to Settings → Analytics, and switch the toggle off. Capture stops immediately and the analytics SDK's local cache (pseudonymous identifier and queued events) is cleared.
  • For all other processing: you may withdraw consent by deleting your account from within the App's profile screen, or by contacting us at privacy@health3.app.
  Withdrawal does not affect the lawfulness of processing prior to withdrawal.

6. Data Sharing and Disclosure

We may share your personal data with:

• Service Providers: Third-party companies that assist us in operating the App and providing services to you. These service providers act on our behalf under a Data Processing Agreement, are bound by confidentiality, and only use your data for the purposes we have described. The service providers we currently use for the App (processors, unless stated otherwise):
  • Supabase (Supabase Inc.): primary database, authentication, file storage. Hosts: account data, biomarkers, lab values, journal entries, profile fields. Region: EU for EU accounts; Switzerland for Swiss accounts.
  • Amazon Web Services (AWS): lab-parsing AI pipeline, file processing. Hosts: uploaded lab files during processing only. Region: same region as your account.
  • RevenueCat (RevenueCat Inc.): subscription state management. Hosts: subscription tier, entitlement state, pseudonymized purchase events. Region: United States.
  • PostHog (PostHog Inc.): consent-controlled pseudonymous product analytics for the App and Website. Hosts only allowlisted navigation, product-interaction, coarse subscription, platform, locale, and normalized operational-error properties plus the pseudonymous analytics identifier. Health data, health identifiers, free text, raw errors, and session recordings are excluded. Region: EU (Frankfurt).
  • Firebase Cloud Messaging (Google LLC): push notifications. Hosts: device push token, notification payloads. Region: Google global infrastructure.
  • Crisp Chat (Crisp IM SAS): in-App customer support chat. Hosts: messages you send in the support chat. Region: EU (France).
  • Apple App Store / Google Play Store: app distribution, in-app purchase processing, crash reporting. Apple and Google act as independent controllers for app distribution and purchases under their own privacy policies. Hosts: crash logs, in-app purchase receipts. Region: Apple / Google global infrastructure.
  Where a processor is located outside the EU/EEA or Switzerland, transfers are protected by Standard Contractual Clauses or an equivalent safeguard.
• Stripe Managed Payments / Sold through Link: For web subscription orders, Sold through Link, LLC acts as merchant of record and Stripe group companies provide checkout, payment processing, fraud prevention, indirect-tax handling where supported, receipts and invoices, transaction support, refunds and disputes, and subscription management. Stripe / Link processes order and transaction data under the Link Privacy Policy and applicable Link Consumer Terms. Health3 receives the order data needed to associate the purchase with your account and administer access, but does not receive your full payment credentials.
• Legal Requirements: Government authorities or law enforcement if required by law.

The data is never sold to third-parties or shared for any commercial purpose. The data is not provided to third parties in any other fashion and for any other purpose than is detailed within the scope of this privacy policy.

We do not use third-party advertising networks and we do not sell your personal or health data to anyone.

International Data Transfers:

• Your sensitive health data is never transferred outside of the area associated with your account. For all of the user accounts the data is stored and processed in a data center based in one of the countries of the EU or Switzerland.
• Supplementary data is handled as follows:
  • App and Website analytics (only if you opt in): processed by PostHog on EU infrastructure in Frankfurt. We do not use Google Analytics 4. For EEA and Swiss accounts this means no extra-EU transfer occurs for product analytics.
  • Cross-platform messaging (push notifications, crash reporting, in-app purchase receipts) is processed by Apple, Google, and Firebase on their respective global infrastructure under their own privacy commitments.
  • Web billing and order data is processed by Stripe / Link and their financial partners on global infrastructure as necessary to complete and support your order, prevent fraud, comply with financial and tax obligations, and manage the subscription. Their applicable transfer safeguards and processing details are described in the Link and Stripe privacy materials.

7. Data Security Measures

We implement the following security measures:

• Encryption: Data encryption in transit and at rest using industry-standard protocols.
• Access Controls: Restricted access to personal data to authorized personnel only.
• Regular Audits: Periodic security assessments and vulnerability scans.

8. Data Retention Policy

• Retention Period: We retain your personal data as long as your account is active or as needed to provide services. Specific retention windows:
  • Account data and health content (biomarkers, journal entries, profile fields): for the lifetime of the account.
  • App and Website analytics events (only created if you opt in): retained for the event-retention period included in our PostHog service plan and then removed. You can request earlier deletion at any time.
  • Crash and error reports: up to 90 days.
  • In-App support chat history (Crisp): per Crisp's standard retention policy.
• Deletion: Upon your request or account deletion, we delete or anonymize personal data within 30 days unless retention is required by law. For self-service account deletion, Health3 first submits deletion of the identified PostHog person and historical analytics events; only after PostHog accepts that request do we delete the Health3 authentication record. The App and Website also reset the local analytics identity so future events cannot be linked to the deleted account.

9. User Rights

Under the GDPR, UK GDPR and FADP, you have the following rights:

• Right of Access: You may obtain confirmation of whether your data is being processed and obtain access to your personal data.
• Right to Rectification: You may request modification of any inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data. If you have created an account, you can delete it at any time using the App’s account settings. This will remove your personal data from our active systems (except for data we may need to retain to comply with legal obligations or for legitimate safety reasons). You may also request account deletion by contacting us at privacy@health3.app.
• Right to Restrict Processing: You may request limitation of the processing of your personal data.
• Right to Data Portability: You may ask to receive your personal data in a structured, commonly used format.
• Right to Object: You have the right to object to processing based on legitimate interests.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subjected to decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
• Right to complain to an authority: You have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA), United Kingdom, United States of America or in Switzerland (such an authority is, for example, the Information Commissioner’s Office in the UK).
• If you are located in the United States, please note there is no single privacy supervisory authority. You may consider reaching out to a relevant consumer protection agency, such as the Federal Trade Commission or your state’s Attorney General, for guidance or to lodge a complaint.

To exercise these rights, either use the functionalities offered through the App (e.g. account and data deletion), or contact us at privacy@health3.app.

10. Cookies and Similar Tracking Technologies

While our App does not use cookies in the traditional web browser sense, we employ similar technologies to collect information and improve your experience. These technologies support the App’s functionality and personalization and, only if you opt in, product analytics.

Types of Tracking Technologies Used:

• Local Storage: Data stored locally on your device to enhance App functionality, such as user preferences, settings, walkthrough completion state, and offline content. We do not use cookies inside the App.
• Pseudonymous identifier (only if you opt in to analytics): when you enable analytics in Settings → Analytics, we attach your Health3 user ID to analytics events so that your activity can be grouped across sessions and devices. The identifier is stored locally on your device and inside the analytics processor's data store. Disabling the analytics toggle clears the identifier locally and stops further capture. This identifier is not an advertising ID and is not used for cross-app or cross-website tracking.

Purpose of Using Tracking Technologies:

• App Functionality: To enable core features of the App, such as remembering your login status and preferences.

11. Children’s Privacy

• Age Limitation: The App is not intended for individuals under the age of 18.
• Data Deletion: If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information.

12. Automated Decision-Making

• No Automated Decisions: We do not engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you.

13. Third-Party Links

Our website may contain links to third-party websites that are not operated by us. We are not responsible for the privacy practices of these sites, and we encourage you to review their privacy policies.

14. Changes to the Privacy Policy

We may update this Privacy Policy periodically. Changes will be communicated via:

• In-App Notifications: Notices within the App.
• Email Notifications: Sent to the email address associated with your account.
• Updated Effective Date: Indicated at the top of this policy.

15. Contact Information

For questions or concerns regarding this Privacy Policy, please contact us:

• Email: privacy@health3.app
• Address: Health3 AG, Wiesenstrasse 10A, 8952 Schlieren, Switzerland

16. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to file a complaint with:

• In the EEA: Your local data protection supervisory authority.
• In Switzerland: The Federal Data Protection and Information Commissioner (FDPIC).
• In the United Kingdom: The Information Commissioner’s Office (ICO).
• In the United States of America: If you are located in the United States, please note there is no single privacy supervisory authority. You may consider reaching out to a relevant consumer protection agency, such as the Federal Trade Commission or your state’s Attorney General, for guidance or to lodge a complaint.

17. Additional Notices for U.S. Residents (State-Specific Privacy Rights)

Under CCPA/CPRA and laws in Colorado, Virginia, Connecticut, Utah, Washington, Nevada:

• We do not sell or share your personal or health data for advertising.
• You have rights to access, delete, correct, and port your data; to opt-out of any sale/sharing (none exist); and to non-discrimination.
• Section 17.1 lists the categories of personal information we collect. We do not sell or share your personal information, so there is nothing to opt out of.
• Washington’s My Health My Data Act & Nevada SB 370: express consent required for health data (obtained in-app), plus notice and deletion rights.

17.1 CCPA Category Disclosure

18. Stripe Managed Payments and Sold through Link

When you purchase a web subscription labelled Sold through Link, Sold through Link, LLC is the merchant of record for that transaction and processes personal data for its own payment, fraud-prevention, tax, legal-compliance, customer-support, and order-management responsibilities. Health3 AG remains the controller for your Health3 account, health data, product access, and the order information we receive to operate the App and the Website. Depending on the activity, Stripe / Link and Health3 may each act independently for their respective purposes. Requests concerning a Link account or Link transaction data can be made through Link; requests concerning Health3 account or product data can be made to Health3 using the contact details in section 15.

19. Web Measurement Before and After Analytics Consent

19.1 Identifier-free aggregate measurement

Before you choose whether to enable product analytics, the Health3 web application may increment a limited set of aggregate funnel counters needed to understand whether core web journeys, such as onboarding, sign-in, report scanning, and subscription checkout, are functioning. These counters contain only an approved event name, the deployment environment, a two-letter country code supplied by our edge provider, a coarse device class (desktop, tablet, mobile, or unknown), and the number one. For the app-opened counter only, Health3 may also include fixed-category fields for source (direct, Health3 website, other, or unknown), referral medium, campaign class, broad originating content group, website locale, and app landing-screen category. The app and edge worker reduce these values to predefined categories before storage. The counters do not contain an IP address, raw user-agent string, raw URL or referrer, cookie value, account, device or session identifier, free text, health information, laboratory data, or report content. They cannot be associated with a later account or PostHog person.

These aggregate counters are processed by Cloudflare, Inc. through Cloudflare Analytics Engine and are retained for up to three months. Health3 uses them only in grouped form to operate, secure, and improve the web service. They are kept technically and logically separate from consented PostHog analytics.

19.2 Consented product analytics

If you explicitly enable analytics, Health3 initializes PostHog and sends the pseudonymous product events described elsewhere in this Policy from that point forward. Pre-consent aggregate counters are not imported into PostHog or linked to your account.

19.3 First-party consent preference

Your current analytics choice may be stored in a versioned first-party preference shared between health3.app and app.health3.app so the same choice can be respected across the Health3 website and web application. The preference contains only granted or denied and the applicable policy version; it contains no user or device identifier. A missing or older preference is not treated as consent. You can withdraw consent at any time in Health3 Settings.

20. Privacy-Minimized Biomarker Coverage Analytics

If you enable optional product analytics and the parser cannot match a biomarker or unit, Health3 may submit only the sanitized biomarker name and unit to a separate aggregate counter so we can add missing compatibility. This counter does not receive a laboratory value, reference range, test or report date, report identifier, provider, account identifier, device identifier, session identifier, advertising identifier, or PostHog identifier. Exact unsupported names and units are not sent to PostHog.

The authenticated request is used only to prevent unauthenticated abuse; the account identifier is not stored in or returned by the aggregate. Each installation locally avoids resubmitting the same name and unit, the database retains only the combined name-and-unit total and first/last calendar month, and inactive combinations are removed after 24 months. Turning analytics off stops these submissions immediately.