Version 1.3

Lifexam — Privacy Policy

Billing and regional accounts

Stripe processes subscriptions, payments, taxes, invoices, refunds, disputes, and fraud prevention. It receives account contact details, opaque account identifiers, and payment information you enter in its hosted forms—not Documents, Profile information, or health records. We retain subscription identifiers, status, paid-through dates, and delivery/recovery records to operate your contract. Required billing records may remain with Stripe after account deletion under applicable financial and legal retention requirements. See Stripe’s Privacy Policy for its roles, retention, and international processing. These billing purposes rely on the contract and applicable legal obligations, not your health-data consent.

EU and US instances have isolated accounts, databases, subscriptions, and billing configurations. There is no automatic account or subscription transfer. When Profiles access ends, the announced consolidation moves Documents and linked medical records to the default Profile. It permanently deletes extra Profiles, their Concerns, and their Concern notes. Concerns in the default Profile remain unchanged. Records from different people can mix, and completed moves and deletions cannot be restored. Temporary recovery records are erased when consolidation completes.

Updated: 10 October 2026

This Privacy Policy explains what personal data Lifexam collects, why, on what legal basis, how long we keep it, who receives it, and the rights you have. It covers the processing described in the Terms & Conditions and in-app consent screens.

1. Who is responsible for your data

Lifexam Ltd (Irish company number 822610, registered office Venture Hub, 136 Capel Street, Dublin, D01 T2C9, IE) is the sole data controller for Lifexam’s own processing described here. We decide what data is processed and why, and we are accountable for it. The connected provider’s role and responsibilities for its own processing are described in its privacy policy.

Lifexam provides personal health-record storage and organisation directly to individuals. You choose which records to upload and whether to share them. We do not provide this record service on behalf of healthcare providers, health plans or other organisations.

Contact privacy@lifexam.com for any question about your data or this Policy.

Our lead supervisory authority is the Irish Data Protection Commission (DPC).

2. Our promise about your health data

Most of what you store in Lifexam is health data, which the law treats as a special category needing the highest protection. We treat it that way.

EU-instance health records are stored and processed in the EEA; US-instance health records are stored and processed in the United States. The instance’s region is shown before registration and during onboarding. We never sell health data or share it for advertising.

These regional commitments apply to Lifexam’s storage and internal processing. If you enable sharing with connected apps, eligible data is sent to the connected provider, which may process it outside your Lifexam region. See sections 5–8.

3. What we collect, and from where

Account data — your name, email, and the credentials used to secure your account; or, if you sign in through a third-party provider (Google, where available), the basic profile information they return to confirm your identity.
Your declared country — which you tell us at sign-up. This determines which country's rules apply to you; it is not guessed from your IP address.
Documents you upload — your medical documents (health data).
Extracted Data — the structured information our systems read from your Documents: test names, values, units, reference ranges, dates, practitioner references (health data).
Managed-profile data — where you keep a profile for someone else (a dependent adult or your child), the documents and data you upload for them (health data), and your confirmation that you are authorised to manage it. See section 13.
Corrections — changes you make to Extracted Data using the correction tool.
Reviews and feedback — reviews of facilities or professionals, survey responses, and suggestions.
Technical data — connection and usage information, including IP address, needed to run and secure the Service.
App connection and consent records — the app identifier and permissions (authorized scopes), your account identifier, the sharing notice version, approval and withdrawal times, and your IP address and browser details (User-Agent) recorded with consent actions. These records do not contain copies of your health records.

4. How and why we use your data

Each purpose below has its own legal basis and retention period. This table is the detailed core of this Policy.

Purpose	Data used	Legal basis	How long we keep it
Create and manage your account	Name, email, account credentials, declared country	Contract (Art. 6(1)(b))	Until you close your account
Store your original Documents	Uploaded Documents (health data)	Your explicit consent (Art. 9(2)(a))	Until you delete them or close your account
Extract structured data from your Documents	Health data within Documents	Your explicit consent (Art. 9(2)(a))	As above; deletion cascades to Extracted Data
Let you correct extraction errors	Corrections you submit	Your explicit consent (Art. 9(2)(a)) — for service quality, not model training	Kept with your record
Diagnose systematic processing failures	Document type and issuing organisation (not your identity or results)	Legitimate interest in improving the Service (data-minimised)	Short, fixed operational window
Investigate a specific processing problem, on request or escalation	Document content (health data); an access log	Your request / explicit consent (Art. 9(2)(a)); escalation is data-minimised quality assurance, not training	Access ends when resolved; the access log is kept and is available to you
Improve extraction from your corrections — optional, off by default	Values you edited, the original Document, and its processing data	Your explicit consent (Art. 9(2)(a)) — to investigate and correct extraction only; not training, aggregation, or any other use	Until you withdraw consent; withdrawal applies going forward
Account sign-in via Google, where available	Profile data the provider returns	Contract (Art. 6(1)(b))	With your account; used for authentication only — never linked to your health data
Reviews of facilities and professionals	Review text, rating, your identity	Contract / legitimate interest (Art. 6(1)(b)/(f)); special-category rules apply only if a review reveals health data	Until you delete the review, or we remove it under the Content Guidelines
Product analytics	Usage events and page views (no health data)	Legitimate interest / consent — light, because analytics is self-hosted and privacy-respecting	Short, fixed window
Feedback and surveys	Responses, ratings, free text	Consent or legitimate interest	Anonymised after a short window
Security and fraud prevention	Connection and usage logs, IP address	Legitimate interest	Short, fixed periods
Support	Your contact details and request	Contract / legitimate interest	A fixed period after your request
Establishing or defending legal claims	Relevant data	Legal obligation / legitimate interest	The applicable limitation period
Research and AI-model training	—	Not active. Would require your separate, explicit, future opt-in (Art. 9(2)(a))	Not applicable until and unless activated
Share eligible records with connected apps — optional, off by default	Eligible Profile details, reports, observations, marker history and health concerns requested by a connected app	Separate explicit consent (Art. 6(1)(a) and, for health data, Art. 9(2)(a)); you must have authority to disclose another person’s data	Future access stops when sharing consent is withdrawn or the app connection becomes invalid; copies held by a provider follow that provider’s retention rules
Record and enforce sharing choices	Account and app identifiers, authorized scopes, notice version, approval/withdrawal times, IP address and User-Agent	Legitimate interest in enforcing your choices and demonstrating consent (Art. 6(1)(f)); these records contain no clinical content	Consent history stays with your account, including after withdrawal; account deletion removes it from active systems, subject to the backup cycle below

5. The legal bases, in plain terms

Your account runs on the basis of our contract with you (the Terms).
Storing your Documents and extracting data from them runs on your explicit consent, which we ask for before your first upload. Explicit consent is the right and most protective basis for health data, and you can withdraw it at any time.
Optionally, if you turn it on, we rely on your separate explicit consent to use your corrections — the values you edited, the original Document, and its processing data — to investigate and improve our extraction. This is off by default and withdrawable at any time. It is for correcting our processes only; it is not model training, aggregation, or any other use.
Some supporting activities (security, basic analytics, support) run on our legitimate interests, balanced against your rights.

Research and AI-model training are switched off. Your consent does not include them — and helping us correct extraction (above) is not the same as training. We will ask you separately and explicitly if we ever offer research or training, and you will be free to say no. Nothing happens to your data for those purposes unless you actively opt in.

Sharing with connected apps is a separate, optional choice. Connecting an app does not by itself give sharing consent. We ask you to accept the current sharing notice when you approve health-data access or enable sharing in Account → Consent. This one consent applies to all your valid connected apps, including apps already connected. Consent to store Documents or use corrections does not enable sharing. You can use Lifexam without enabling sharing with connected apps.

In Account → Consent, turning sharing off blocks future access for every connected app, without removing its connection. An already authorized request may finish. Turning sharing on again requires fresh, explicit consent. Only valid connections can resume access; revoked or expired apps stay blocked. You can also revoke one app independently. Refreshing an access token or reusing an earlier app approval cannot enable sharing consent.

Lifexam’s commitments about research and model training apply to its own processing. Once you choose to share with an external app provider, that provider’s use of the received data, including possible model improvement, is governed by its terms and your account settings.

6. Automated processing and AI

The extraction of structured data from your Documents is performed by an automated AI system (OCR and machine-learning models). We tell you this here, and again in the app where your Extracted Data appears.

This processing organises and displays your information. It does not make any decision about you that produces legal or similarly significant effects — there is no automated decision-making of that kind in Lifexam.

Sharing with connected apps is separate from Lifexam’s document extraction. With your sharing consent, a connected app can request eligible Profile information and health records. The provider receives this data to use in its service, for example in a conversation. This access does not allow the app to upload, edit or delete Lifexam records.

7. Who receives your data

Hosting providers — host Lifexam and its internal AI processing in the EEA for EU accounts and in the United States for US accounts. During this internal processing, health data is not sent to model vendors or used to train their models. Sharing with connected apps is separate, as described below.
Self-operated components — the systems that read documents, look up reference codes, store data, and manage encryption keys run on our own infrastructure. They are not separate recipients of your data.
Google — where available and only if you choose to sign in with it, and only for authentication. They confirm your identity to us and learn that a sign-in to Lifexam occurred; we do not share your health data with them.
Analytics — our analytics is self-hosted, so usage data is not sent to an external analytics company.
App providers you connect — can request only eligible data while both the connection and your current sharing consent are valid. An already authorized request may finish. Each provider handles received data under its own terms, privacy policy and your account settings. Review these before enabling sharing.

We do not sell your data or share it for advertising. A full, current list of any sub-processors is available on request at privacy@lifexam.com.

8. International transfers

EU and US health-data stores are separate; we do not automatically move health records between them. Choosing the US instance means health-data storage and processing in the United States, not the EEA. Stripe billing data may be processed internationally as described in its Privacy Policy. Applicable transfer safeguards must be in place for any transfers that require them.

Connected app providers may process received data in the United States or other countries outside your Lifexam region. Choosing the EU instance does not limit a provider to EEA processing. The provider’s privacy policy and service terms describe its processing locations and transfer safeguards. sharing consent does not replace any safeguards required for international transfers. Contact privacy@lifexam.com for information about a proposed recipient and the safeguards applicable to the connection.

9. How long we keep your data, and what happens when you delete it

Retention is set per purpose in the table in section 4. For your Documents and Extracted Data, the rule is the product promise: we keep them until you delete them or close your account.

When you delete a Document or close your account:

it is removed from active systems immediately and put beyond use;
our backups are stored as secure, immutable bundles that rotate on a fixed cycle. Backup copies are scheduled to expire after 14 days; older versions are retained for a further 14 days, and final deletion may take longer;
during that period, backups are used only for recovery, never for anything else.

The practical "how" of all this is explained in plain language in the Storage Policy.

We keep sharing consent history, including records of withdrawn consent, with your account to enforce your choices and record which notice you accepted. Withdrawing consent does not erase that history. Deleting your account removes these records from active systems; backup copies expire under the cycle above. App-connection records follow a separate deletion process and are not removed when sharing is turned off.

Turning sharing off, revoking an app, or deleting a Document or your Lifexam account does not retrieve or erase data already received by an external app provider. Its retention, deletion, conversation history and model-improvement rules depend on its own terms and your settings. Use that provider’s controls or contact it to exercise rights over its copies.

10. Your rights

You have the right to:

access the data we hold about you;
correct inaccurate data (your Documents stay authoritative — see the correction tool);
erase your data held by Lifexam ("right to be forgotten") — this includes Lifexam backups within the period above; external provider copies are addressed separately in section 9;
restrict or object to certain processing;
port your data — receive it in a structured, commonly used, machine-readable format;
withdraw consent at any time, as easily as you gave it;
complain to a supervisory authority (the Irish DPC, or the authority in your own country).

The easiest way to exercise most of these is directly in the app, through your Vault and consent settings — the Storage Policy shows you where. You can also contact us at privacy@lifexam.com. For a managed profile, these rights are exercised by the account holder who manages it; the managed person (or anyone entitled to act for them) can also write to privacy@lifexam.com directly. Withdrawing consent or deleting data does not undo processing we already, lawfully carried out before you did so.

11. Security

We protect your data with appropriate technical and organisational measures, including encryption and strict access controls. Encryption is central to how we keep your documents confidential. Access to document content by our staff is restricted to the limited cases described in section 4 and the Storage Policy, and is logged.

12. If something goes wrong (data breach)

If a data breach affects your rights, we will notify the relevant supervisory authority within 72 hours where the law requires, and we will tell you directly when the law requires that too.

13. Children and managed profiles

Account holders must be 18 or older. A child does not hold a Lifexam account and does not log in.

Lifexam does let an adult account holder keep a managed profile for another person they are responsible for — including a child (with parental responsibility or guardianship) or an adult they care for (with authority). For these profiles:

the adult account holder is the person who manages the data and provides the explicit consent for processing the managed person's health data, on that person's behalf;
because the relevant age of valid data-consent differs between countries, and because the managed person does not log in, we rely on the managing adult's authority rather than the managed person's own consent;
the managing adult confirms their authority when creating the profile (we do not collect proof documents — see the Terms);
the managed person's rights are exercised through the managing adult. A managed person, or anyone entitled to act for them, can contact privacy@lifexam.com directly;
if someone with authority disputes a managed profile, we will review and may suspend, restrict, or remove it (Terms section 6a).

We do not knowingly allow anyone under 18 to create their own account.

Sharing with connected apps has stricter scope than managing records in Lifexam. Human Profiles need a valid birth date showing age 16 or older. We block sharing if the birth date is missing, invalid or in the future. We apply the age check using the birth date you provide. This is a Lifexam sharing rule; age 16 does not establish authority to consent under every country’s law. Parental authority to manage a child’s records in Lifexam does not permit external sharing of an under-16 Profile.

You must have lawful authority to disclose every person’s information in eligible records. Do not enable sharing for records that contain information about an under-16 child, including family, pregnancy or genetic information. The age check does not scan or remove information inside records.

14. Changes to this Policy

If we make a material change — for example, a new purpose, a new recipient, or longer retention — we will show you an in-app notice directing you to the updated documents before the change affects you. For changes that affect health-data processing, we will ask for fresh consent where the law requires it.

Acknowledging an in-app policy update does not enable sharing or change any existing consent. A material change to the sharing notice requires a new notice version and fresh explicit consent. An existing app connection or earlier consent to store Documents or use corrections cannot replace that consent.

15. Contact

Privacy: privacy@lifexam.com
Support: support@lifexam.com
Lead supervisory authority: Irish Data Protection Commission — www.dataprotection.ie

End of Privacy Policy.