Privacy Policy

Account information: your name, email address, professional role, and organisation when you register or request early access.

Health information: screening responses, assessment scores, care plans, and clinical notes entered by you or your care team within the platform.

Technical information: log data required to operate the service securely, such as authentication events and audit records. Logs are sanitised to remove personally identifiable information wherever it is not required for accountability.

To deliver the service: to run screenings, compute scores, generate care plans, and share results with the care team you authorise.

To keep the service secure: to authenticate you, detect misuse, and maintain audit trails.

To contact you: if you request early access or support, we use your details only to respond to that request.

We do not sell personal or health information, and we do not use patient health data for advertising.

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Every login requires email-based two-factor authentication, and devices may be trusted for up to 30 days.

Access is enforced by role-based permissions at every API endpoint. Short-lived access tokens (30 minutes) and rotating refresh tokens (7 days) are delivered as httpOnly cookies.

OAuth tokens for connected wearable devices are encrypted at the application layer with AES-256-GCM.

Health information is visible only to you, your care team, and anyone you explicitly grant family access to.

We use trusted infrastructure providers to host the service. They process data on our instructions and under contractual confidentiality and security obligations.

We disclose information where required by law, or to protect the safety of a person.

You may request access to the personal information we hold about you, ask for corrections, request export of your data, or request deletion.

Patients and families always retain access to their own portal at no cost, and may export their records at any time.

To exercise any of these rights, contact us and we will respond within a reasonable period.

Health records are retained for as long as your care relationship requires and as long as applicable clinical record-keeping law requires. Administrators can configure retention policies and handle deletion requests.