Privacy Policy

• Account data: your email address and authentication details, used to create and secure your account.
• Health reports: the lab/pathology reports you upload (PDFs or images) and the biomarker readings extracted from them.
• Health profile: details you enter such as age, sex, diet, exercise level, known conditions, and family history, used to contextualise your results.
• Consent records: a timestamped record that you agreed to this policy and our terms.

We use your information only to provide the service, specifically to:

• extract and normalise biomarker readings from your uploaded reports;
• generate longitudinal trends, risk indicators, and recommendations;
• maintain your account, history, and preferences; and
• secure the service and meet legal obligations.

We do not sell your data, and we do not use your identifiable health data to train machine-learning models without your explicit consent.

To read your reports, the document is sent to a third-party AI model (Google Gemini, accessed via the Vercel AI Gateway) solely to transcribe its contents into structured data. We also rely on the following processors to operate the service:

• Supabase — authentication, database, and encrypted file storage for your reports and readings.
• Vercel — application hosting and the AI Gateway used for report extraction.
• Amazon Web Services (SES) — delivery of transactional emails such as sign-in codes.

Each processor handles data under its own agreements; we share only what is necessary for the function described.

Your data is encrypted in transit and at rest. Access is scoped to you as the data owner through row-level security, and access to health records is logged for auditability. We retain your data for as long as your account is active or as needed to provide the service; you can delete it at any time (see your rights below).

You can access, export, correct, and permanently delete your data on request — the app includes export and delete-all-data controls. Depending on your jurisdiction (for example under the EU GDPR or India’s DPDP Act), you may have additional rights, including withdrawing consent and lodging a complaint with a supervisory authority. To exercise any right, contact us at the address below.

Healthytica is not intended for use by children, and we do not knowingly collect data from anyone under the age required by your local law.

Healthytica provides preventive, non-diagnostic insights only. It is not a medical device and does not replace a licensed healthcare professional. Always confirm findings with a qualified clinician before acting on them.

We may update this policy and will revise the date above when we do. For questions or to exercise your rights, contact privacy@gnanalytica.com.