Privacy Policy

Healio360 is operated by Seven Capital Markets Ltd, Oriel House, 26 The Quadrant, Richmond TW9 1DL, United Kingdom. We are the controller of your personal information and are registered with the UK Information Commissioner’s Office. For anything about your privacy, email support@healio360.com.

Healio360 helps you understand your own health information over time. It is educational. It does not diagnose, and it is not a medical device or a substitute for a clinician.

Accounts are for people aged 13 and over. If a child needs their symptoms checked, a parent, guardian or another adult over 18 should do it from their own account. See section 12.

Your account

Your name, email address, phone number (for sign-in codes), country and password, which is stored only as a secure hash. If you choose to add them in Settings: date of birth, sex at birth and time zone. Sex at birth is health information, so we store it only with your consent to keep your health record (section 6).

Health information you choose to give us

• Symptoms and your symptom log (what you felt, when it started and ended, and how bad it was), daily check-ins, water, medications and medical history you enter.
• Lab reports you upload. We keep the values we read from them (for example, the test name, result, unit and range), not the file.
• Medical images and skin photos you upload. We keep the written analysis, not the image.
• If you connect Apple Health on iPhone, the readings you allow: heart rate, heart-rate variability, resting heart rate, sleep, steps, activity and energy, workouts, blood oxygen, breathing rate, VO₂ max and body measurements. We only read; we never write to Apple Health.

How you use the service

Device type, browser, IP address, pages and features used, error logs and security events.

Payments

Handled by Stripe on the web and Apple in the iPhone app. We never see or store your full card details.

Location

Only if you switch Location on in Settings, and only to show doctors near you on a map or to look up local pollen and air quality. For pollen and air quality, your position is rounded to about a kilometre, sent only to the weather service, and never stored by us.

• To run your account and give you the features you ask for: your dashboard, trends, reports and summaries.
• If you agree to it, to produce AI-assisted educational analysis of the information you give us (section 5).
• To keep the service and your account secure: sign-in codes, fraud and abuse prevention, and access logs.
• To take payment for subscriptions and keep billing records.
• To send you service emails and texts, such as verification, sign-in codes and receipts.
• With your consent only: website analytics and advertising measurement (section 13).

We do not sell your information. We do not use your health information for advertising. We do not use it to train AI models.

Healio360 uses AI from OpenAI and Google (Gemini) to read lab reports, describe images and skin photos, write trend summaries and answer your questions. AI is optional. Before any AI feature runs, we ask for your separate explicit agreement. You can withdraw it at any time in Settings → Privacy & Data, and withdrawing it does not affect your health record.

• Every AI request goes through our server, which removes names, contact details, dates of birth and other identifiers it can detect before the information leaves us. It blocks the request if it still finds any.
• Images and skin photos are sent to the AI provider as they are, because a picture cannot be edited for identifiers. Please crop out names, faces you don’t need to show, and record numbers before uploading. We delete the image as soon as it has been analysed.
• Both providers process this information for us under contract. Under their business terms, they do not use it to train their models.
• AI output can be wrong or incomplete. It is educational and does not diagnose. Always speak to a qualified clinician about your health.

Under UK data protection law (UK GDPR):

We share information only with the service providers below, who process it on our behalf under written data-processing agreements and only on our instructions. We do not sell it, and we do not share health information with advertisers.

We may also disclose information where the law requires it, or to a buyer or investor if the business is sold or restructured, under the same protections.

Our service runs in the United States, so your information is transferred there from the UK. We protect each transfer with the UK–US Data Bridge, where the provider is certified under it, or otherwise with the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Ask us for a copy of the safeguard for any provider.

Encryption in transit and at rest, a one-time code sent to your phone or email every time you sign in, access limited to your own records, logging of every access to health records, and a written breach-response plan. If a breach puts you at risk, we will tell you and the ICO within the time the law requires (72 hours for the ICO). For US users, we also follow the FTC Health Breach Notification Rule. No system is perfectly secure, and we will be honest with you if something goes wrong.

You can ask us to:

• give you a copy of your information;
• correct it;
• delete it (you can delete your account yourself in Settings → Privacy & Data);
• restrict or object to how we use it;
• give it to you in a portable format;
• withdraw either of your consents — to keep your health record, or to AI analysis — at any time in Settings → Privacy & Data.

Email support@healio360.com with the subject “Privacy request”. We may need to confirm it is you. We reply within one month.

If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live.

Accounts are for people aged 13 and over. A child’s symptoms should be checked by a parent, guardian or another adult over 18, from their own account; the information is then held in that adult’s account. We do not knowingly create accounts for children under 13. If we learn one exists, we will delete it.

For members aged 13 to 17, the most private settings are the default: analytics and advertising cookies are off, and Location is off, unless they choose to switch them on.

When a member’s date of birth shows they are under 18, we ask them to give their consent to keep their health record together with a parent or an adult they trust.

We use essential cookies to keep you signed in and secure. Optional analytics and advertising measurement cookies are off until you switch them on, either in the cookie banner or in Settings → Privacy & Data, and you can switch them off at any time.

When they are on, Google Analytics receives the pages you visit and counts of actions, such as “a symptom check was completed”. It never receives your answers, results, severity, body area or any other health information. Optional analytics never run inside the Healio360 iPhone app.

Healio360 is not covered by HIPAA. We follow the FTC Health Breach Notification Rule. We do not sell or share personal information for cross-context behavioural advertising. California residents have the rights in section 11, plus the right to know what we collect and to non-discrimination for using their rights. Residents of states with consumer health data laws, such as Washington, Nevada and Connecticut, can use the same rights through support@healio360.com.

Healio360 calculates scores and summaries, such as readiness, stress and trends, from your data, and uses AI to describe it. These are educational. They do not make decisions with legal or similarly significant effects on you, and no one else sees them. You can ask us about how a score is worked out.

When you connect or visit another service, such as Apple Health, an app store or a doctor’s website, that service’s own privacy policy applies.

We will post any change here with a new date. If a change is significant, we will tell you by email or in the app before it takes effect. Where the law requires it, we will ask for your consent again.