Privacy Policy

This policy explains what personal and health information HealthLens collects, why we collect it, how it is processed and protected, who else may process it on our behalf, and the rights you have over your data.

Effective date: 9 May 2026 · Last updated: 9 May 2026 · Version 1.0

1. Who we are & how to contact us

HealthLens ("the app", "we", "us", "our") is a mobile application operated by an independent developer based in India. For all privacy questions, deletion requests, or data-rights enquiries, contact:

Email

contact@fcappstudio.tech

Subject line

Use [Privacy] for general requests, [Delete Account] for deletion, [Security] for security reports.

Postal address

Available on written request to the email above.

Grievance Officer (India)

See the Grievance Officer page for the named officer, escalation timelines, and the formal complaint route under the DPDP Act 2023 and the IT Rules 2021.

2. Scope of this policy

This policy applies to the HealthLens mobile application (Android and iOS) and to this website. It does not apply to third-party services that you may reach through the app (for example, when you tap a link to an external website, or when you choose to share a report through WhatsApp, email, or another messenger). Those services are governed by their own privacy policies.

By installing or using the app you confirm that you have read this policy. If you do not agree with it, you must stop using the app and may delete it from your device. You can additionally delete your account and all server-side data from Settings → Account → Delete account.

3. What information we collect

We deliberately keep the data we collect to the minimum needed to deliver the features you use. Below is the complete list grouped by category.

3.1 Account information

• Email address from your Google or Apple sign-in.
• Display name (first name or full name, if provided by Google/Apple).
• Authentication identifier issued by our identity provider (Supabase Auth) — an opaque user ID used to link your data to your account.
• Sign-in metadata — provider used (Google/Apple), timestamp, refresh-token expiry. We do not receive or store your Google or Apple password.

3.2 Health and medical information

• Report images and PDFs you scan or upload (lab reports, prescriptions, radiology, pathology, discharge summaries).
• Extracted text and structured fields recognised from those reports (for example: test name, value, unit, reference range, report date, lab name).
• AI-generated summaries and explanations produced from the above.
• Health profile fields you choose to enter (date of birth, sex assigned at birth, height, weight, allergies, conditions, medications). All of these are optional.
• Medication reminder entries (medicine name, dose, schedule, dose-taken history).
• Conversations with the AI Health Hub (messages you send, AI replies, the report context the assistant was given).
• Symptom-checker inputs and the structured assessment returned.
• Pill / medicine identifier images and the identification result.
• Family / caregiver profiles you create, the relationship label, and which reports you have chosen to share with each profile.

3.3 Device and technical information

• Device model, OS version, app version, locale, time-zone — used for compatibility and bug triage.
• Crash logs and error stack traces — used to diagnose and fix bugs. These do not contain the contents of your reports.
• Network metadata that any HTTPS server sees, such as the IP address used for the request, processed only transiently for routing and abuse prevention by our hosting providers.

3.4 Information we do not collect

• We do not collect contacts, call logs, SMS, browsing history, or precise location.
• We do not use advertising identifiers (IDFA / GAID) and do not embed advertising SDKs.
• We do not collect financial information; the app does not currently process in-app payments. If that changes, billing data will be handled by the platform store (Google Play Billing or Apple In-App Purchase) — not by us directly.

4. How we collect it

• Directly from you when you sign in, scan or upload a report, type into a form, or chat with the AI Health Hub.
• From your device through OS-level APIs that you have granted permission to (camera, photo library, file picker, notifications). See section 17.
• From your identity provider (Google or Apple) when you choose to sign in — limited to the fields described in section 3.1.
• Generated automatically by the app or our servers — for example AI summaries derived from text you uploaded, or audit-log entries when a caregiver views a shared record.

5. How we use it (purposes & legal bases)

We do not use your personal data for behavioural advertising, profiling for marketing purposes, or sale to data brokers.

6. AI processing of medical content

To produce plain-language explanations and answer your questions, the app sends extracted text from your report — and, where needed, the report image itself — to a Large Language Model (LLM) operated by Microsoft Azure OpenAI Service as our processor. Specifically:

• We use the enterprise tier of Azure OpenAI. Under our agreement with Microsoft, the data we send is not used to train, retrain, or improve any foundation model and is not shared with OpenAI, Inc.
• We send the minimum content required to answer your request — typically the structured text from a single report and a short instruction prompt. We do not send your email, your real name, or any account identifier the model could use to re-identify you across requests.
• The model's response is logged in our database (linked to your account) so you can re-open it later. Internal anonymised metadata about the call (model used, token counts, latency, success/failure) is stored in an ai_usage_logs table for cost control and abuse detection — this row does not contain your prompt content.
• For translation we use MyMemory as a translation provider for short strings, and Azure OpenAI for longer summaries. MyMemory is a public translation API; we therefore strip account identifiers and avoid sending obviously identifying text to it.
• OCR of report images runs on your device using Google ML Kit's on-device text-recognition model. The raw image does not leave your device for OCR. We only send the resulting text to the AI service.
• AI output can be wrong. The Medical Disclaimer applies to every AI-generated message. See Medical Disclaimer.

7. Who we share data with (sub-processors)

We use a small number of trusted vendors to run the app. Each one acts as our processor — they handle data only on our documented instructions. They do not get to use it for their own purposes.

We may also disclose data when required by law, by a binding court order from a court of competent jurisdiction, to protect the rights, property, or safety of users or the public, or in connection with the sale or restructuring of the service. In any such case, we will challenge over-broad requests and notify affected users where legally permitted.

We never sell your personal information, never trade it for value, and never disclose it to advertisers or data brokers.

8. International data transfers

Your data may be processed in countries other than the one you live in, including in the United States, the European Union, and other regions where our sub-processors operate data centres. Where data is transferred out of your home jurisdiction, we rely on:

• The European Commission's Standard Contractual Clauses (2021) for transfers of personal data out of the EEA;
• The UK ICO's International Data Transfer Addendum for transfers out of the UK;
• Equivalent contractual safeguards in the data-processing agreements we have signed with each sub-processor for transfers out of India under the DPDP Act 2023, once cross-border-transfer notification rules under that Act are formally notified.

You can request a copy of our transfer mechanisms by emailing the address in section 1.

9. How long we keep your data

10. How we protect your data

• Encryption in transit — every connection between the app, our servers, and our sub-processors uses TLS 1.2 or above with modern cipher suites.
• Encryption at rest — Supabase storage buckets and the Postgres database encrypt data at rest with AES-256-equivalent provider-managed keys.
• Authentication — sign-in is delegated to Google or Apple. We never see, store, or transmit your password.
• Row-Level Security — every table that holds user data has RLS policies enforced by Postgres. A signed-in user can only read or write rows they are authorised to access; a query for someone else's data simply returns zero rows.
• On-device protection — sensitive identifiers (auth tokens, the active profile pointer) are kept in iOS Keychain and Android EncryptedSharedPreferences via flutter_secure_storage. The app blocks screenshots and screen-recording on screens that show identifiable health information on Android. The local Hive database is namespaced per signed-in user and wiped on sign-out so that a second user on the same device never sees the previous user's records.
• Access control — administrative access to our backend is limited to the developer, gated by hardware-backed multi-factor authentication, and scoped to the minimum permissions needed.
• Threat modelling — the app uses content-security-policy headers on this website, integrity-checks shared Supabase functions, and reviews dependency vulnerabilities on every release.
• Independent auditors — Supabase and Microsoft Azure undergo SOC 2 Type II and ISO 27001 audits; certificates are available on their respective trust portals.

No security control is absolute. If you discover a vulnerability, please email [Security] in the subject line to contact@fcappstudio.tech and give us a reasonable time to fix it before any public disclosure.

11. Your rights & how to exercise them

Subject to the laws that apply to you, you have the right to:

• Access a copy of the personal data we hold about you, in a machine-readable format. Use Settings → Data export or email us.
• Rectify data that is inaccurate or incomplete. You can edit your profile and any individual report directly in the app.
• Delete any individual record, or your entire account. From Settings → Account → Delete account, we permanently remove your account, all reports, AI outputs, chat history, reminders, profiles, and shares within 30 days. Backups are purged within an additional 30-day window. See the data-deletion page for the step-by-step.
• Object to or restrict processing — for example, to ask us to pause AI processing of new reports. Doing so may make some features unusable.
• Withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing already carried out.
• Port your data to another service provider — the export is in JSON and PDF and can be reused by you.
• Lodge a complaint with the relevant supervisory authority — see sections 12, 13 and 14.

We respond to verified rights requests within 30 days (extendable to 90 days for complex requests, with notice). We may need to verify your identity before acting on a request to protect you against impersonation. Exercising your rights is free of charge unless the request is manifestly unfounded or excessive.

12. Notice for users in India (DPDP Act 2023)

If you are in India or your data is processed under the Digital Personal Data Protection Act, 2023 ("DPDP Act"):

• We act as a Data Fiduciary for your personal data.
• The legal basis for processing your sensitive health information is your specific, informed and unambiguous consent given when you sign up and again per feature (for example, the explicit consent screen shown before AI processing of a new report and before sharing a record with a family member).
• You may withdraw consent at any time from Settings → Account. Withdrawing consent will block further AI processing and, if you also delete your account, will remove your data subject to section 9.
• Children: we do not knowingly process personal data of a child (under 18 in India). See section 15.
• Grievance Officer: appointed in accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Contact details are on the Grievance Officer page. The officer will acknowledge a complaint within 24 hours and dispose of it within 15 days.
• Escalation: if you are not satisfied with the Grievance Officer's response, you may approach the Data Protection Board of India once it is operational, or any other competent forum.

13. Notice for users in the EU / UK (GDPR & UK GDPR)

• The Controller is the operator named in section 1.
• We rely primarily on your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) for processing health information, on contract (Art. 6(1)(b)) for delivering the app, and on legitimate interests (Art. 6(1)(f)) for security, fraud prevention and improving reliability.
• You have the rights of access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with your local supervisory authority. In Ireland this is the Data Protection Commission (dataprotection.ie); in the UK, the Information Commissioner's Office (ico.org.uk).
• We do not engage in automated decision-making with legal or similarly significant effects on you. AI explanations are presented as suggestions for you to discuss with a clinician — they do not, on their own, decide anything about you.

14. Notice for users in California (CCPA / CPRA)

• We treat all California residents' health information as sensitive personal information. We do not sell or share it for cross-context behavioural advertising, so the "Do Not Sell or Share" right does not change anything in our handling — but you may still exercise it by emailing us.
• You have the rights to know, access, correct, delete, and limit the use of sensitive personal information. We honour authorised-agent requests when the agent provides a written authorisation.
• We do not discriminate against you for exercising any CCPA right.

15. Children's privacy

The app is intended for users aged 18 or older. We do not knowingly collect personal data from children. A parent or legal guardian may, with full consent and at their own risk, create a family profile for a child and store reports relating to the child under the parent's account; in that case the parent is responsible for managing the child's data and may delete it at any time. If we learn that we have inadvertently collected data from a child without the required consent we will delete it without undue delay. See also COPPA in the United States and the DPDP Act 2023 rules on children's data in India.

16. Cookies, analytics & trackers

The mobile app does not use advertising cookies, advertising SDKs, or cross-app tracking. We do not place a tracking pixel inside the app. This website (the one you are reading) uses only first-party storage that is technically necessary to render the page; there is no analytics, no remarketing, and no third-party fonts that ping a server. See the Cookies & Trackers page for details.

17. Mobile permissions we request

We do not request location, contacts, microphone, SMS, call log, or accessibility-service access.

18. Data breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the timeframe required by the law that applies to you (72 hours under GDPR; without undue delay under the DPDP Act, in the format prescribed by the Data Protection Board) and notify you by email and in-app banner if the breach is likely to result in a high risk to you. Our incident-response runbook is summarised on the Security & Sub-processors page.

19. Changes to this policy

We may update this policy as the app evolves or as new laws come into force. When the change is material — for example a new sub-processor, a new data category, or a change in legal basis — we will notify you in-app at least 30 days before it takes effect, and ask you to acknowledge the new policy on the next launch. Non-material changes (typo fixes, link updates, restructuring) are announced via the version stamp at the top of this page. The previous version remains available on request.

20. Definitions

• Personal data — any information relating to an identified or identifiable individual.
• Health information — any personal data relating to the physical or mental health of an individual, including medical reports, lab values, prescriptions, and inferred conditions.
• Sub-processor — a third party that processes your personal data on our behalf, under our written instructions.
• OCR — Optical Character Recognition; software that converts an image of text into machine-readable text.
• LLM — Large Language Model; the AI model that produces explanations and chat replies.
• RLS — Row-Level Security; a Postgres mechanism that scopes every database read and write to the rows the calling user is permitted to see.

If anything in this policy is unclear, please email contact@fcappstudio.tech with the subject line [Privacy] and we will respond within 30 days.