Privacy Policy
[Legal entity and postal address: to be completed by U.S. counsel.]
1. Scope
This Privacy Policy explains what personal data the Doc24hrs app collects in the United States, how we use it and who receives it. Your health data and the data derived from your face scan are also covered by the Health Data Consent.
2. What we collect
- Account: first name, last name, email and password. We store the password only in hashed form. When you create your account we record the version of these documents you accepted, the date, your IP address and your device’s user agent.
- Health profile: date of birth, sex, height, weight, smoking, blood pressure medication, diabetes, other conditions and allergies you choose to enter, and optional data such as cholesterol, activity level, waist size and phone number.
- Scan results: the estimates of each scan (for example heart rate, breathing rate, blood pressure and wellness risk scores) and its date, saved in your account.
- Family members: what you enter about your spouse or partner and children (name, date of birth, sex, height, weight and health answers) and, for teens 13 to 17, a record of your consent as their parent or legal guardian: the date, the version of the text, and the IP address and user agent of the device.
- Scan consents: before each person’s first scan, the app asks that person to agree to the scan of their face. We keep a record of each scan consent: the date, the version of the text, and the IP address and user agent of the device.
- Membership: your plan, its status and period, the store and the scans used. Payments are processed by Apple or Google; we do not receive your card details.
- Organization benefit: if you link a benefit from your employer or organization with an access code, we record the code, the organization that provides it, the plan, the date you linked it and until when it lasts. If your organization registered your email for a personal code, we compare it with the email of your account. We do not share your scan results or your health profile with your organization.
- Naia: if you turn on the AI assistant, what you say and type to Naia and the context she receives (section 4), and a record of your permission: the date, the version of the text, and the IP address and user agent of the device. If you turn Naia off, a record of that withdrawal: the date, and the IP address and user agent of the device. If you report one of Naia’s responses, the report (section 4).
- Technical data: the events of each scan attempt (for example its steps, errors and connection type), together with your device’s IP address and characteristics such as its user agent, system, screen size, language and time zone, to find and fix failures, and a record of each scan session with your device’s IP address, to limit abuse of the scanner.
- Security records: to limit abuse, we record the IP address and the time of some requests, such as starting Naia, sending verification emails or reporting a response, and, for some account actions such as accepting a consent or linking a benefit, your account identifier.
[What usage information, if any, we share with an organization about its access codes: to be confirmed by U.S. counsel.]
3. The camera and the scan
The scan runs with DeepAffex, a technology of NuraLogix. The video from your camera is processed on your phone and the video is not uploaded. What is sent to NuraLogix are signals derived from the video, plus your age, sex, height, weight, smoking, blood pressure medication and diabetes, which the computation needs. They are sent with a generic identifier, not with your name or email. The results come back to the app and are saved in your Doc24hrs account.
4. Naia, the AI assistant
Naia only starts if you accept the AI assistant permission in the app, which is separate from these documents. When she is active, what you say through the microphone, the text of the conversation and the context Naia receives are processed by the providers in section 6. The context includes the reason and symptoms you enter when you prepare a consultation and, on the results screen after each scan (including a “Scan only” scan), your scan results.
Your permission also covers the family members you scan, including your children 13 to 17, for whom you authorize it as their parent or legal guardian. You can turn Naia off in Account: that withdraws your permission for your whole account. She turns off right away on the phone where you turn her off, and on your other phones she no longer starts from the next time the app checks your account (a conversation with her that is already open on another phone goes on until you leave it or it times out); after that, she does not start until you accept the permission again.
If you report one of Naia’s responses, the report includes the reason, your comment, what Naia said if you choose to include it, the screen, the language, the app version and, if you are signed in, your account identifier (not your email or name). It reaches our support team by email. See AI Assistant (Naia).
5. How we use your data
- To run the scan and show your results and history.
- To manage your membership, your included and extra scans and your Family plan.
- To let Naia answer you.
- To send account emails, such as verification codes.
- To keep the service secure and to fix failures.
The app has no advertising tools, and we do not use your data for advertising. Apart from the membership reports that RevenueCat gives us (for example, how many memberships are active), the app has no third-party analytics tools. The scan attempt events in section 2 are our own technical records.
6. Who receives your data
- NuraLogix (DeepAffex): computes the scan results from the derived signals and the data listed in section 3.
- Simli (Norway) and Daily: Naia’s video avatar and the live audio connection.
- Deepgram: turns what you say to Naia into text.
- DeepSeek (China): the language model that writes Naia’s replies.
- ElevenLabs: Naia’s voice.
- RevenueCat: manages memberships bought in the App Store or Google Play; it receives your Doc24hrs account identifier, your purchase records and the technical data its software sends from your phone, for example the IP address of the connection, the app and system versions and the store country.
- Apple and Google: process membership payments.
- Resend: sends account emails, such as verification codes.
- Netlify and Neon: host Doc24hrs’ servers and database.
- Google Fonts: the app loads its fonts from Google, so Google receives your device’s IP address.
- Doc24hrs’ team: authorized staff can see your account, profile and membership data in our administrative tools, to give support and to manage organization benefits.
[Whether the staff who operate those tools work for another company and under what contract, and the contractual protections of each provider: to be completed by U.S. counsel.]
[The exact device data the RevenueCat software collects (for example, device identifiers): to be confirmed against RevenueCat’s documentation by U.S. counsel.]
7. Where your data is stored
Doc24hrs stores your data and processes it outside the United States, including in Mexico, as well as in the countries where the providers above operate.
8. How long we keep it and how to delete it
We keep your data while your account exists. You can delete your account in the app; it asks for your password to confirm. This erases from Doc24hrs’ database your account, profile, saved scan results, family members, membership status, consent records, AI assistant permission and the link to your organization benefit (the access code keeps only its count of uses).
- Kept without being linked to your account: the scan attempt events, with your device’s IP address and characteristics, which we delete after about 92 days, and the scan session records with your IP address, which we delete after about a day.
- Security records (section 2) stay after you delete your account, and today they are not deleted automatically.
- RevenueCat keeps your Doc24hrs account identifier and your purchase records: deleting your account does not delete them there. Your purchase history also stays with Apple or Google, under their own policies.
- Reports about Naia stay in our support mailbox.
- Our providers keep what they already processed under their own retention.
- If your organization registered your email for a personal access code, we remove your email and the label your organization gave the code; if you had not linked that code yet, it is also canceled.
Removing a family member from your plan erases their health profile and last name, but their first name, the record of their consent and their scan results stay in your history while your account exists. To erase them, write to us or delete your account.
[Retention periods of RevenueCat, the providers, Naia reports, access codes and security records, and how a family member can ask for their own data to be deleted: to be completed by U.S. counsel.]
9. Your choices
- See and correct your profile in the app.
- Allow or deny the microphone in your phone settings; without it, Naia cannot hear you.
- Turn the AI assistant (Naia) on or off in Account.
- Delete your account at any time.
- Write to us with any request about your data.
[Rights under U.S. state privacy and consumer health data laws, and how to exercise them: to be completed by U.S. counsel.]
10. Children
Doc24hrs is not directed to children. A Family plan holder can add children to the plan. Children under 13 cannot be scanned. Teens 13 to 17 can be scanned only with the consent of the plan holder as their parent or legal guardian; we keep a record of that consent: the date, the version of the text, and the IP address and user agent of the device. If the holder turns on the AI assistant, that permission also covers the teens 13 to 17 the holder scans (section 4).
11. Data stored on your phone
The app keeps on your phone your session, your language and the data needed for your next scan. It uses no advertising cookies.
12. Security
Connections between the app and our servers are encrypted (HTTPS), and passwords are stored only in hashed form. No system is completely secure.
13. Contact
Questions or requests about your data: contacto@previacare.org