Privacy Policy

1. Who We Are (the Data Controller)

Zaynix Health is a personal health-record platform operated by Zaynix Limited (referred to as “Zaynix Health”, “we”, “us”, “our”), a company registered in England and Wales with company number 16446245.

Registered office: 17 Pennine Parade, Pennine Drive, London, United Kingdom, NW2 1NT.

ICO Registration: ZC117578 — registered with the UK Information Commissioner's Office as a data controller.

Data Protection Contact: Contact us via our contact page (mark your message “Data protection” and it will be routed to the founders directly)

For the personal data described in this policy, we act as the data controller in respect of your consumer account. Where you connect your account to a clinic (a healthcare organisation using the platform), the position changes for that clinical relationship — see Section 12 (Clinics and healthcare professionals).

This policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It also covers our website, zaynix.health, and its contact form (Section 14).

Zaynix Health is a health record-keeping and information tool. It is not a medical device, does not diagnose, and does not provide medical advice. Always consult a qualified healthcare professional for medical decisions.

2. The Personal Data We Collect

We do not intentionally collect data from advertising networks, and we do not buy personal data from third parties.

3. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR Article 6, and — for health and genetic data — additionally on a special-category condition under Article 9.

Explicit consent for special category data: Because health and genetic data are “special category” data, we ask for your explicit consent under Article 9(2)(a) when you start using the platform. This is recorded (type, version, timestamp, IP, user-agent) and can be withdrawn at any time in Privacy & Data. Because processing your health data is fundamental to the service, if you withdraw this consent we can no longer provide the core service and your account will be closed (your data remains subject to your erasure and export rights). Withdrawal does not affect the lawfulness of processing before withdrawal. Reading the documents you upload with AI needs a further, separate explicit consent. You can refuse it, or withdraw it later, without closing your account; while it is off you cannot upload documents.

4. How We Use Your Data

1. Document reading: When you upload a document, our own parsers and AI services from Anthropic (Claude) and Google (Gemini) read it to find the results in it (see Section 5). We do this only with your permission for document reading, which we ask for before your first upload, separately from your other agreements. Without it you can still use your record and add entries by hand, but you cannot upload documents.
2. Patient Confirmation Layer: Nothing extracted from a document is written to your health record until you review and confirm it. You are shown exactly what was extracted and must accept it. This is a core trust control.
3. Storage and display: Confirmed and manually entered health data is stored securely and shown through dashboards, charts, and timelines.
4. AI analysis (optional, separate consent): If you opt in, relevant subsets of your health data are sent to our AI providers for informational interpretation, trend summaries, medication information, and similar. AI output is informational only and is never used to make an automated decision about you (see Sections 5 and 6).
5. Voice entry (optional): If you use voice capture, the audio is sent to Deepgram for transcription and the transcript is returned to the same field you would otherwise type into.
6. Clinic sharing: If you connect to a clinic, designated healthcare professionals in that organisation can view your data (see Section 12). All such access is audit-logged and visible to you.
7. Billing: Email and payment details are shared with Stripe to manage your subscription.
8. Authentication: Email and identity data are processed by Auth0 for secure sign-in.
9. Transactional email: Your email address is shared with Resend to send password resets, invitations, and billing/service notices.
10. Audit and compliance: User and system actions are logged for security, dispute resolution, and legal accountability (UK GDPR Art. 5(2)).

5. AI and Automated Processing — Transparency

Our AI and processing providers:

• What we store locally: AI-generated responses may be cached (tied to your user ID) to reduce repeat calls. Every AI-generated record is flagged ai_generated in your data export. Every AI call is recorded in an internal AI audit log (model, feature, token counts, content hashes). You may request a copy of your AI audit-log entries.
• Human oversight; no solely-automated decisions: What AI produces is shown to a person — you, or a clinician you are connected to — who decides what, if anything, to do with it. Values AI reads from your documents, and entries it prepares from what you type or say, are proposals: they enter your record only when you confirm them (the Patient Confirmation Layer). We do not make decisions producing legal or similarly significant effects about you by solely automated means within the meaning of UK GDPR Article 22.
• Your AI controls: switch AI processing, and document reading, on or off at any time (Privacy & Data on the web; document reading also in More in the iPhone app); export your data with AI provenance flags intact; request your AI audit log; delete your account and cached AI responses.

For a full description of every AI feature, which model handles it, and what data it sees, see the dedicated How We Use AI page.

6. Who We Share Data With (Processors and Recipients)

We use the following processors and sub-processors. We do not sell your data and do not share it with advertisers.

A copy from before our move: on 16 September 2026 we moved the platform to the hosting provider named above. A copy of the data taken before that move remains in a paused account with Microsoft, our previous cloud provider, in its UK and EEA regions, pending deletion. It is not in live use.

We may also disclose data where required by law, to establish or defend legal claims, or to protect the vital interests of you or another person.

Research: We believe de-identified health data can accelerate research into healthspan, disease prevention and longevity — but only when contributors choose to participate. Research participation at Zaynix is strictly opt-in, per study, per dataset. The default is off. Before any of your data is included in a research dataset, you will be shown exactly: which fields leave your record, who the recipient is, what they are studying, whether the data is de-identified or pseudonymised, the retention period, and how to withdraw. Each research consent is granular, time-limited where appropriate, and individually revocable from your Privacy page. Research partnerships are listed in the Data Processor Register. Research features are not enabled on the platform today; this section describes the commitment that governs them when they ship.

7. International Data Transfers

Your data is hosted in Germany (EEA), on a dedicated server operated for us by Hetzner Online GmbH. Because the UK recognises the EEA as providing an equivalent standard of protection, this transfer relies on the UK's adequacy regulations for the EEA and needs no additional safeguard. Some processors operate in the United States (Anthropic, Google, Deepgram, Resend, and parts of Stripe/Auth0). For those transfers we rely on:

• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with the provider's Data Processing Agreement; and
• where relevant, transfer risk assessments and supplementary measures (encryption in transit).

Where any processing occurs in the EEA, we rely on the UK's adequacy regulations recognising the EU/EEA as providing an equivalent standard of protection.

8. Data Retention

Audit logs are never deleted. On erasure we irreversibly pseudonymise the personally identifying fields but preserve the record of what happened, as accountability law requires.

9. Your Rights Under UK GDPR

You have the following rights. Most are self-service in Privacy & Data; for the rest, contact us and we will respond within one month (extendable by two months for complex requests, with notice).

1. Right to be informed: This policy and the in-app How We Use AI page.
2. Right of access (Art. 15): Download a full copy of your data via Privacy & Data > Export (JSON and PDF). Includes AI provenance flags and your audit log.
3. Right to rectification (Art. 16): Correct data by editing your profile and records directly.
4. Right to erasure (Art. 17): Request erasure via Privacy & Data > Request data erasure on the web, or More > Delete my account in the iPhone app. We act on it within one month. Clinical data is deleted; audit records are pseudonymised (not deleted) for legal compliance; some records (e.g. tax) are retained where the law requires.
5. Right to restrict processing (Art. 18): Ask us to limit processing while a dispute or accuracy question is resolved.
6. Right to data portability (Art. 20): Receive your data in a structured, machine-readable format (JSON).
7. Right to object (Art. 21): Object to processing based on legitimate interests. Contact us.
8. Right to withdraw consent: Withdraw any consent at any time, as easily as you gave it: in Privacy & Data → Your consents on the web, and for document reading also in More in the iPhone app. Withdrawal does not affect prior lawful processing.
9. Rights relating to automated decision-making (Art. 22): We do not carry out solely-automated decision-making with legal or similarly significant effects; if this ever changes we will update this policy and provide the associated rights.

There is no charge for exercising these rights (save for manifestly unfounded or excessive requests). We may ask you to verify your identity.

10. Children and Age Policy

• You must be 18 or over to hold an account independently.
• Certain features (including peptide protocol features) are gated behind an 18+ age check.
• The platform is for adults (18 and over). We do not knowingly process the personal data of anyone under 18; if we learn that we hold such data, we delete it and close the account.
• The platform is not intended for children under 13, and under-13s may not use it.

Given the sensitivity of health data, we apply extra caution to any account involving a minor. If we learn that a child has provided data without the required consent, we will delete it.

11. Security

We protect your data with encryption in transit (TLS), a database and cache reachable only from the server itself, role-based access controls, full audit logging of access (including a legal record of every HCP view of your data), and least-privilege processor arrangements. No system is perfectly secure; if a breach affects your rights we will notify the ICO within 72 hours where required and notify you where the law requires. See the in-app Security page.

12. Clinics and Healthcare Professionals

When you connect your account to a clinic using Zaynix Health:

• Designated healthcare professionals at that clinic can view your health data.
• Clinic AI tools respect your AI choice. Healthcare professionals at your clinic have access to AI tools that can summarise and answer questions about your record (using the same AI providers listed above). These tools work only if you have enabled AI processing yourself in Privacy & Data — if you have not consented, or you withdraw consent, no AI processing of your record happens for anyone, including your clinic. Every AI call is separately audit-logged.
• Every access is audit-logged with both the HCP's identity and the fact that you were the subject — you have a legal right to know who viewed your data, and you can see this in your audit log.
• The clinical relationship (your care) is a matter between you and the clinic. In that context the clinic is a controller of your clinical data and Zaynix Health acts as its processor under a Data Processing Agreement — or, depending on the arrangement, as a joint controller.

Disconnecting from a clinic stops future access; it does not delete data already held in your record.

13. Cookies

We use strictly necessary cookies and browser storage to keep you signed in and to operate the platform, and (with your consent) functional and analytics technologies. See the separate Cookie Policy for the full inventory and how to change your choices.

14. If You Visit zaynix.health

Our website, zaynix.health, is a set of static pages hosted on Cloudflare Pages. It has no sign-in, cannot see your health record, and runs no analytics or advertising trackers. We set no cookies of our own on it; Cloudflare may set a short-lived security cookie of its own when it checks that a visitor is not a bot. To deliver and protect the site, Cloudflare receives each visitor's IP address and browser details.

The contact form. The Support and Arrange-a-call pages carry one contact form, and the Contact page inside the app links to it. The waiting list (below) uses the same route. When you send the contact form we collect:

• your name and email address;
• the reason you choose (for example “Help using the app” or “My data and my rights”);
• your organisation, if you give one; and
• your message.

Before a message is accepted, Cloudflare Turnstile checks that it comes from a person rather than a bot. Turnstile runs for every visitor to the pages that carry a form (Support, Arrange a call and the waiting list) and uses your IP address and browser signals; we use only its pass-or-fail answer, to decide whether to accept the message, and we do not keep it. A small Cloudflare function then passes your message to HubSpot, our service desk, as a ticket. HubSpot holds it in its EU data region and records your name and email address as a contact, so that later messages from you are kept together. We reply by email from our Microsoft 365 mailbox. Nothing you send through the form is added to your health record. The form asks you not to include health details; if you do, we use them only to answer you. For a data-protection request we first confirm it is you by replying to the email address you gave.

The waiting list. Public sign-up is closed: accounts are created by a clinic or by Zaynix. If you join our waiting list — at zaynix.health/waitlist, which the app's sign-in screen also links to — we collect your name, your email address and, if you tell us, how you heard about Zaynix. It goes through the same Turnstile check and the same Cloudflare function to HubSpot, where it is kept as a ticket, with you as a contact. We use it only to invite you to open an account when we can, and to reply if you write to us. We do not use it to send newsletters or other marketing; if we ever want to, we will ask you separately first. We keep your details until we have invited you; if you have not opened an account three months after the invitation, or we have not been able to invite you within 12 months of your joining, we delete them. You can ask us to take you off the list at any time.

Lawful basis. Our legitimate interests in running and protecting the website, keeping spam out, and answering you (UK GDPR Article 6(1)(f)); for a data-protection request, our legal obligation to respond (Article 6(1)(c)); for the waiting list, taking the steps you asked us to take before you open an account (Article 6(1)(b)).

How long we keep it. A message and our replies are kept for as long as we need them to deal with your enquiry and any follow-up. We keep nothing from the Turnstile check.

Who receives it. Cloudflare and HubSpot act as our processors under their data processing agreements, which we accepted on 4 October 2026; both are listed in Section 6. Either may process this data outside the UK under those agreements. Your rights over this data are set out in Section 9, and how to complain in Section 15.

15. Complaints

If you are unhappy with how we handle your data, please contact us first via our contact page (mark your message “Data protection”). You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

16. Changes to This Policy

We may update this policy. Material changes will be notified by email and/or in-app, and where the change affects a consent you have given, we will ask you to re-consent. The “Last updated” date at the top shows the current version.

What changed on 18 October 2026: reading the documents you upload now needs your separate permission, which we ask for before your first upload, and you can turn it off at any time (Sections 3, 4, 5 and 9); Section 14 describes the waiting list on our website. This adds a choice and changes nothing you have already agreed to, so we are not asking you to accept the policy again.

What changed on 6 October 2026: a new Section 14 on our website and its contact form, with HubSpot and Cloudflare added to Section 6; Section 5 now says what each AI provider does with what we send, attributed to that provider's published terms, and that Gemini is the default model for AI chat; voice entry now opts out of Deepgram's model-improvement programme, and the allergy check and “What is this for?” follow your own AI processing setting; Section 9 gives the erasure route on the web and in the iPhone app.