Privacy policy

Who is responsible

make.health, LDA (in founding), Funchal, Madeira, Portugal. TODO: full company name, address, register number and representatives

Email: [email protected]

Data protection officer: TODO: name and contact details

In short

• This website sets no cookies, uses no analytics or advertising tools and loads nothing from other companies. Fonts and images come from our own server.
• If you request beta access, we use your email address only for the beta and the topics you ticked, and only after you confirm it.
• We never ask about your health on this website.
• The Zyva app processes health data only with your explicit consent. Details are below.

Visiting this website

When you open a page, your browser sends technical data to our hosting provider: IP address, date and time, the page requested, the page you came from, and the type of browser and operating system. We need this to deliver the site and to keep it secure (Art. 6 (1) (f) GDPR). TODO: name and location of the hosting provider and how long server logs are kept

We do not use analytics tools. TODO: if visits are counted from server logs as daily totals later, describe it here

This website stores nothing on your device and reads nothing from it.

Requesting beta access

• What we collect: your email address, your type of phone if you choose it (iPhone or Android), the language of the page, the topics you ticked, and the time and version of your consent.
• Why: to invite you to the beta and to tell you about the topics you ticked.
• Legal basis: your consent (Art. 6 (1) (a) GDPR). We use double opt-in: we add you only after you confirm your address with the link in our email.
• How long: until you withdraw your consent or the beta ends. TODO: confirm; and how long the proof of consent is kept
• Withdrawal: at any time, with the link in every email or by writing to us.
• Recipients: TODO: the email service we use, its location and the transfer mechanism if outside the EU

We never ask about your health in this form. Please do not send us health information by email.

Writing to us

If you email us, we use your message and your address to answer you (Art. 6 (1) (b) or (f) GDPR) and delete them when the matter is settled, unless the law requires us to keep them.

The Zyva app

The app has its own detailed privacy policy, which you see in the app before you create an account. TODO: link it here once published In short:

• You can look around with example data without an account; the example data is stored in the app. If you scan a barcode without an account, only the barcode number reaches us, with your IP address as part of the connection.
• To keep your own reports and supplements you need an account. We process your health data only with your explicit consent (Art. 9 (2) (a) GDPR). AI features need a separate explicit consent.
• To read a report and answer your questions, our servers process its contents. Report files, the values read from them and your questions are processed in readable form. They are not encrypted with your vault key.
• Your vault key is created on your phone. If you turn on Cloud Backup, we store only an encrypted copy, which we cannot open.
• Your account and records are stored in the EU. TODO: hosting provider and data centre
• Service providers help us with hosting, sending sign-in emails, AI summaries and answers, and reading photos and scanned PDFs. TODO: names, locations and transfer mechanisms, including the AI provider
• On Android, Google ML Kit reads barcodes on your phone and sends usage statistics to Google.
• No ads, no tracking, no selling of data.
• You can delete your account in the app. After a waiting period of 72 hours, in which you can change your mind, we erase your data.

Your rights

You have the right to access, correction, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw any consent at any time, with effect for the future.

You can also complain to a data protection authority, in particular in the country where you live or work. TODO: competent lead authority, likely the CNPD in Portugal; counsel to confirm

Changes

We update this policy when the website, the app or the law changes. The date at the top shows the current version.