Data Processing
Last updated: 17 September 2026
1. Overview
This page describes how Xevox Health Ltd processes personal data as part of delivering the Xevox Service. It supplements our Privacy Policy with technical and operational detail about data processing activities, sub-processors, and safeguards.
2. Categories of data processed
| Category | Examples | Special category? |
|---|---|---|
| Account data | Name, email, date of birth, gender | No |
| Health & biometric data | Heart rate, HRV, sleep, SpO2, blood pressure, steps | Yes (Art. 9 GDPR) |
| Genetic data | Raw DNA files, polygenic risk scores, pharmacogenomic markers | Yes (Art. 9 GDPR) |
| Self-reported data | Mood, symptoms, medications, lifestyle logs | Yes (Art. 9 GDPR) |
| Payment data | Billing details (processed by Stripe; we hold no card data) | No |
| Usage & device data | App interactions, device type, OS version (anonymised) | No |
3. Processing purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Delivering personalised health insights | Consent; Contract |
| Processing health & wearable data | Explicit consent (Art. 9(2)(a)) |
| Genetic analysis (GenomiteX) | Explicit consent (Art. 9(2)(a)) |
| Account management & billing | Contract |
| Security & fraud prevention | Legitimate interests |
| Service improvement (anonymised analytics) | Legitimate interests |
| Legal compliance & record keeping | Legal obligation |
4. Sub-processors
We engage the following sub-processors to deliver the Service. All are bound by data processing agreements (DPAs) ensuring GDPR-equivalent protections.
| Sub-processor | Purpose | Location |
|---|---|---|
| MongoDB Atlas | Primary database (health & account data) | EU / UK |
| Microsoft Azure | Application hosting, genetic file storage, SQL database | UK South |
| Stripe | Payment processing | EU / US (SCCs applied) |
| Apple / Google | OAuth authentication, health data APIs | EU / US (SCCs applied) |
| Together AI | LLM inference for insight generation | US (SCCs applied) |
5. Data retention schedule
| Data type | Retention period |
|---|---|
| Account & profile data | Duration of account + 30 days |
| Health & biomarker data | Until account deletion or consent withdrawal |
| Genetic data | Until explicit deletion request or account closure |
| Payment records | 7 years (legal / financial obligation) |
| Anonymised analytics | Indefinite (cannot identify individuals) |
6. Technical safeguards
- All data in transit encrypted with TLS 1.2+
- Health and account data encrypted at rest with AES-256
- Genetic files encrypted at the application layer (AES-256-GCM) before storage, independent of Azure's server-side encryption
- Role-based access controls — staff access is restricted to the minimum necessary
- MongoDB Atlas IP access list restricted to known Azure App Service outbound IPs
- Regular penetration testing and security reviews
- Incident response plan in place; breaches reported to the ICO within 72 hours where required
7. International transfers
Data is primarily stored in the UK and EU. Where sub-processors are based outside the UK/EU (e.g., Stripe, Together AI), transfers are protected by Standard Contractual Clauses (SCCs) approved by the ICO, ensuring equivalent data protection standards.
8. Your rights
You can exercise your GDPR rights (access, rectification, erasure, restriction, portability, objection) at any time via the in-app settings or by contacting privacy@xevoxhealth.com. See our Privacy Policy for full details.
9. Contact
For questions about how your data is processed, contact us at privacy@xevoxhealth.com or via our contact page.