Privacy Policy

1. Introduction

Welcome to iHeal. This Privacy Policy explains how SUA Labs OÜ ("we," "us," or "our") collects, uses, discloses, and safeguards your personal information when you use the iHeal platform (the "Service").

Data Controller:
SUA Labs OÜ
Tornimäe tn 5, 10145
Tallinn, Harju maakond
Estonia
Email: legal@iheal.app

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

• Full name
• Email address
• Password (encrypted)

2.2 Health Information

When you use our Service, we collect:

• Symptom descriptions and health-related information you provide
• AI-generated diagnoses and healing plans
• Journal entries and notes

2.3 Usage Information

• IP address (for anonymous user limits)
• Browser type and device information
• Usage patterns and interactions with the Service
• Analytics data (via Google Analytics, with your consent)

2.4 Payment Information

Payment processing is handled by Stripe. We do not store your full credit card details. Stripe collects payment information in accordance with their privacy policy.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Delivery: To provide AI-generated diagnoses and healing plans
• Account Management: To manage your account and subscriptions
• Communication: To send you service updates, password resets, and payment confirmations
• Improvement: To analyze usage patterns and improve our Service
• Legal Compliance: To comply with legal obligations and enforce our Terms of Service

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• Consent: You consent to us processing your health information when using our Service
• Contract Performance: Processing necessary to provide the Service you've requested
• Legitimate Interests: To improve our Service and prevent fraud
• Legal Obligation: To comply with applicable laws

5. Data Sharing and Third Parties

We do not sell your personal data. We share data only with:

5.1 Service Providers

• Anthropic/Claude AI: For generating diagnoses and healing plans (anonymized processing)
• SendGrid: For transactional emails
• Stripe: For payment processing
• Google Analytics: For usage analytics (with your consent)
• MongoDB Atlas: For secure data storage

5.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

6. Data Retention

• Account Data: Retained until you delete your account or request deletion
• Health Information: Retained until you delete specific entries or your account
• Anonymous User Data: Retained for 90 days
• Backup Data: Retained for 30 days for disaster recovery

7. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request restriction of processing
• Data Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at legal@iheal.app

8. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Required for the Service to function (authentication, session management)
• Analytics Cookies: Google Analytics cookies to understand usage patterns (requires your consent)

You can manage cookie preferences via our cookie consent banner or your browser settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Encrypted password storage
• Secure cloud infrastructure
• Regular security audits
• Access controls and authentication

10. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

11. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Mobile Applications

When we launch iOS and Android applications, this Privacy Policy will apply to those platforms as well. Additional platform-specific permissions and data collection practices will be disclosed in the app stores and within the applications.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a notice on our Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us at:

Email: legal@iheal.app
Address: SUA Labs OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia

15. Supervisory Authority

You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local data protection authority.

Estonian Data Protection Inspectorate:
Website: www.aki.ee