Privacy Policy

1. Introduction

Xevox Health Ltd (“Xevox”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Xevox mobile application (“App”) and related services (collectively, the “Service”).

Xevox processes special category data under Article 9 of the UK/EU General Data Protection Regulation (GDPR), including health and genetic data. We take additional safeguards to protect this sensitive information.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

2. Data controller

Xevox Health Ltd is the data controller for the personal data processed through the Service.

Contact: privacy@xevoxhealth.com

3. Information we collect

3.1 Information you provide

• Account information: name, email address, date of birth, gender
• Health profile: height, weight, medical history, allergies, family health history, lifestyle information
• Self-reported data: mood, symptoms, activity, meals, hydration, lifestyle logs
• Medication data: current medications, dosing schedules, adherence logs
• Payment information: processed securely by Stripe; we do not store card details

3.2 Health data from connected devices

With your explicit consent, we collect data from:

• Apple Health / Google Health Connect: heart rate, blood pressure, steps, sleep, SpO2, HRV, body temperature, exercise data, and other available metrics
• Wearable devices: Fitbit, Garmin, and other supported devices via their respective APIs

3.3 Genetic data (GenomiteX)

If you subscribe to GenomiteX and upload genetic data:

• Raw genetic files from 23andMe, AncestryDNA, or VCF format
• Processed polygenic risk scores
• Pharmacogenomic markers
• Genetic health risk assessments

3.4 Automatically collected data

• Device information: device type, operating system, app version
• Usage data: features accessed, interaction patterns (anonymised)
• Log data: error reports, performance metrics

4. Legal basis for processing

We process your personal data under the following legal bases:

• Consent (Article 6(1)(a) & Article 9(2)(a) GDPR): For processing health data, genetic data, and wearable device data. You provide explicit consent during registration and can withdraw it at any time.
• Contract performance (Article 6(1)(b)): To provide the Service, manage your account, and process subscriptions.
• Legitimate interests (Article 6(1)(f)): For service improvement, security, and fraud prevention.
• Legal obligation (Article 6(1)(c)): To comply with applicable laws and regulations.

5. How we use your data

We use your personal data to:

• Provide personalised health insights, trends, and risk assessments
• Generate biomarker analyses and health summaries
• Deliver genetic risk reports and pharmacogenomic insights (GenomiteX subscribers)
• Track medications and adherence
• Sync health data across connected devices
• Process payments and manage subscriptions
• Send service-related notifications
• Improve and develop the Service
• Ensure security and prevent fraud

We do not:

• Sell your personal data to third parties
• Use your health or genetic data for advertising
• Share your data with insurers or employers
• Make automated decisions with legal effects without your knowledge

6. Data sharing

6.1 Service providers (sub-processors)

• MongoDB Atlas (database hosting — EU/UK region)
• Microsoft Azure (application hosting, genetic file storage — UK South)
• Stripe (payment processing)
• Apple / Google (authentication services)
• Together AI (LLM inference for insight generation — US, SCCs applied)

All sub-processors are bound by data processing agreements with security obligations at least as protective as this policy.

6.2 Legal requirements

We may disclose data if required by law, regulation, legal process, or governmental request.

6.3 Business transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

7. Data retention

• Account data: retained while your account is active, then deleted within 30 days of account deletion.
• Health and genetic data: deleted upon account deletion or withdrawal of consent, whichever comes first.
• Payment records: retained for 7 years as required by financial regulations.
• Anonymised analytics: may be retained indefinitely as they cannot identify you.

8. Your rights (GDPR)

You have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure (“right to be forgotten”): request deletion of your data
• Restrict processing: limit how we use your data
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent: at any time, without affecting the lawfulness of prior processing
• Object: to processing based on legitimate interests
• Lodge a complaint: with your local data protection authority (e.g., the ICO in the UK)

To exercise these rights, contact us at privacy@xevoxhealth.com or use the in-app settings.

9. Data security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Application-layer encryption for genetic files (AES-256-GCM) before cloud storage
• Access controls and authentication
• Regular security assessments and penetration testing
• Secure development practices
• Incident response procedures; breaches reported to the ICO within 72 hours where required

10. International transfers

Your data is primarily stored in the EU/UK. If data is transferred outside the EU/UK (e.g., to Stripe or Together AI in the US), we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the ICO, or equivalent safeguards.

11. Children's privacy

The Service is not intended for children under 16. We do not knowingly collect data from children under 16. If we become aware that we have collected such data, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact us

For privacy-related enquiries, contact us at privacy@xevoxhealth.com.

For data protection complaints in the UK:

Information Commissioner's Office (ICO)
ico.org.uk