This Privacy Policy applies to the Helthy mobile application and the website thehelthy.com ("Platform") operated by Helthy ("we", "us", or "our").
1. Introduction
At Helthy, we take the privacy and security of your personal and health data extremely seriously. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you use our Platform. By accessing or using Helthy, you agree to the practices described in this policy.
If you do not agree with any part of this Privacy Policy, please discontinue use of the Platform immediately.
2. Information We Collect
We collect the following categories of information to provide you with our services:
2.1 Personal Information
- Full name, email address, and phone number (for account creation)
- Date of birth and gender (for personalized health insights)
- Profile photograph (optional)
- Device identifiers and operating system information
2.2 Health Information
- Medical reports, prescriptions, and diagnostic documents you upload (PDF or image formats)
- Vitals you enter manually (blood pressure, blood sugar, weight, etc.)
- Medication schedules and adherence logs
- Health score and AI-generated insights derived from your data
2.3 Usage Information
- Log data including IP address, browser type, pages viewed, and time spent
- App usage patterns and feature interactions (aggregated and anonymized)
- Crash reports and performance diagnostics
2.4 Data from Third Parties
- If you connect a wearable device or integrate with a lab partner, we receive data from those services subject to their privacy policies
- Social login data (if you sign in via Google or Apple)
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Helthy Platform and its features
- Analyze your uploaded health reports using AI and generate summaries and insights
- Send medication reminders, health alerts, and follow-up notifications
- Personalize your health dashboard and recommendations
- Enable you to share health data with authorized doctors or family members
- Communicate with you about service updates, new features, and promotional offers (with your consent)
- Ensure the security of your account and detect fraudulent activity
- Comply with applicable legal obligations
- Conduct research and analytics using anonymized, aggregated data to improve health outcomes
We do not use your identifiable health information for advertising purposes, and we do not sell your personal data to third parties.
4. Legal Basis for Processing (GDPR Compliance)
For users in the European Economic Area (EEA), we process your data on the following legal bases:
- Consent: You have explicitly provided consent to process your health data.
- Contract: Processing is necessary to provide you with our services.
- Legitimate Interests: For analytics, security, and service improvements where these interests are not overridden by your rights.
- Legal Obligation: To comply with applicable laws and regulations.
5. Data Storage and Security
Your health data is stored on secure, encrypted cloud servers. We implement industry-standard security measures including:
- AES-256 encryption for data at rest
- TLS 1.2+ encryption for data in transit
- Multi-factor authentication for account access
- Regular security audits and penetration testing
- Role-based access controls restricting internal data access
While we strive to protect your data, no security system is impenetrable. In the event of a data breach affecting your rights and freedoms, we will notify you and the relevant authorities as required by law within 72 hours.
6. Data Sharing and Disclosure
We do not sell, rent, or trade your personal or health information. We may share your data in the following limited circumstances:
- With your consent: When you explicitly choose to share reports or vitals with a doctor or family member through the Platform.
- Service providers: With trusted third-party vendors who assist us in operating the Platform (e.g., cloud hosting, AI processing, push notifications), bound by strict data processing agreements.
- Legal compliance: When required by law, court order, or governmental authority.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your data will be transferred to the successor entity, and you will be notified in advance.
- Anonymized research: Aggregated, de-identified health data may be used for public health research and product improvement, where you cannot be personally identified.
7. Your Rights and Choices
You have the following rights regarding your personal data:
- Access: Request a copy of all personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your account and associated data (see Section 8).
- Portability: Request your data in a machine-readable format.
- Restriction: Request that we restrict processing of your data in certain circumstances.
- Objection: Object to processing based on legitimate interests.
- Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact us at privacy@thehelthy.com. We will respond within 30 days.
8. Data Deletion
You may request deletion of your account and all associated data at any time by:
- Going to Settings → Account → Delete Account in the Helthy app, or
- Emailing us at privacy@thehelthy.com with subject line "Data Deletion Request"
Upon receiving your request, we will permanently delete your data within 30 days, except where we are required to retain certain records for legal or regulatory compliance. Backup copies may persist for up to 90 days before being fully purged.
9. Cookies and Tracking
Our website (thehelthy.com) uses cookies and similar tracking technologies to:
- Remember your preferences and login session
- Analyze website traffic and usage patterns (via analytics tools)
- Improve performance and user experience
You can control cookies through your browser settings. Disabling cookies may limit some website functionality. We do not use cookies for cross-site advertising tracking.
Types of cookies used:
- Essential cookies: Required for the website to function properly.
- Analytics cookies: Help us understand how visitors use our website (anonymized).
- Preference cookies: Remember your settings and language preferences.
10. Children's Privacy
The Helthy Platform is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete such information immediately. If you believe we have inadvertently collected information from a child, please contact us at privacy@thehelthy.com.
11. International Data Transfers
Your data is primarily stored on servers located in India. If we transfer your data internationally, we will ensure appropriate safeguards are in place in accordance with applicable data protection laws, including standard contractual clauses where necessary.
12. Third-Party Links
Our Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing any personal information.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of significant changes via email or an in-app notification at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the revised policy.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer:
- Email: support@thehelthy.com
- General: support@thehelthy.com
- Website: thehelthy.com
Note: This Privacy Policy was last reviewed and updated on 1st May 2026. Helthy is committed to maintaining your trust through responsible data stewardship and transparent practices.