Privacy & Security

Analysing a report takes two separate steps, and they are given different things.

Reading it. The document or photograph you upload is read once, to pull the results off the page. Text is redacted before it is sent. A photograph cannot be redacted — nothing can edit the words inside a picture — so an image is read as supplied. It is deleted from our servers once it has been read.

Explaining it. The written analysis is produced from the extracted results alone — the analyte names, values, units, reference ranges and flags, plus an age band and sex at birth. The document and the photograph are not sent to this step at all. If nothing could be read from your upload, no analysis is written; we tell you instead of guessing.

This is why a clear photograph matters, and why a report that shows only your results — rather than a page carrying your name and NHS number — is always the safer thing to upload.

Before every AI call, text passes through our PHI Scrubber — a server-side pre-processing layer that automatically redacts identifying information.

A text scrubber cannot reach inside a picture, so a photograph is handled differently from a PDF.

Crop first. When you choose a photograph of a report or a scan, we ask you to crop it to the results. Only what is inside the box is uploaded; anything outside it — your name, date of birth, NHS number, address, the clinic — never leaves your phone and never reaches us. A lab photo opens with the header already outside the box, so this happens even if you tap straight through.

Saved as a plain JPEG. Whichever you choose — the crop or the full photo — it is re-drawn on your device and saved as a fresh JPEG before anything is sent. The details a camera writes into a photo file, such as where it was taken and on which device, are not carried across. This is also what lets an iPhone's HEIC photo be read at all.

If you skip the crop. The reading step is instructed to transcribe results only, never patient details. Everything it writes down is then passed through the same scrubber our text path uses, and any line that still contains an identifier is discarded before it is stored or analysed.

Always. The photo itself is deleted from our servers once it has been read. It is not kept.

You can connect the health app on your phone so your own day-to-day readings sit alongside your reports. Apple Health is supported today; Google Health Connect is built and will follow on Android. What is written here applies to any source we add.

We read, we never write. Healio360 asks for read access only. It cannot add, change or delete anything in your health app — the write permission list in our app is empty, and iOS shows you this when it asks.

What is read. Resting heart rate, walking heart rate average, heart rate variability, sleep, blood oxygen, respiratory rate, steps, exercise time, active and resting energy, workouts and mindfulness sessions (used only to exclude those minutes from your HRV baseline; they are not stored), VO₂ max, and body measurements (weight, BMI, body fat, lean mass). Nothing else — not your location, not your medical ID, not anything you have logged in other apps unless it appears in one of those categories.

Sleep includes the times, not only the total. As well as how long you slept, we read when your main sleep period began and ended, so we can show whether your schedule holds steady from night to night. That is a genuinely different thing from how long you sleep, and it cannot be worked out from a total. Only the longest sleep of each day is used, so an afternoon nap is not mistaken for a bedtime. We store these as a clock time on your own local clock, never a location.

Where it goes. Readings sync to your encrypted record on our servers. Your trends, your usual ranges, and the Health Intelligence signals are all calculated there, by our own code — no AI provider is involved in producing them.

The one exception. The short written sleep-and-recovery note is produced by an AI provider. It receives that day’s figures only — hours slept, sleep efficiency, your seven-night average, heart rate variability, resting heart rate, stress and recovery scores — as numbers, with no name, date of birth or account attached. It is the only place any wearable reading leaves our servers.

Turning it off. On iPhone, Settings → Privacy & Security → Health → Healio360, and switch off whatever you choose; syncing stops immediately. Readings already synced stay in your record until you remove them, which you can do at any time from Settings → Privacy, along with everything else.

Healio360 is operated from the United Kingdom and is designed with privacy, security, and data protection principles aligned with UK GDPR and the Data Protection Act 2018. As a UK-operated platform, our primary data protection framework is UK GDPR and ICO expectations.

Healio360 may serve users internationally, including in the United States, and is designed with privacy and security principles suitable for an international health information platform. For users in the United States, Healio360 aims to follow privacy and security practices aligned with relevant US healthcare privacy expectations where applicable.

Healio360 is currently positioned as an educational health information and health intelligence platform — not a diagnostic medical device. It is not currently FDA-cleared or FDA-approved and is not intended to diagnose, treat, cure, or prevent disease. If functionality evolves toward regulated medical-device software, MHRA requirements will be reviewed.