Saluso - One Health, One Place

Introduction

At Saluso, which is operated by Your Health One Place, Lda., a company registered in Portugal under registration number 518839702 ("Company", "we", "us", or "our"), your privacy and the protection of your personal and health information are extremely important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you access or use our platform, website, mobile applications (our iOS app distributed through the Apple App Store and our Android app distributed through Google Play), and related services (collectively, the "Services").

This Privacy Policy is intended to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws, with Apple's App Store Review Guidelines (including Guidelines 5.1.1, 5.1.2 and 5.1.3), and with the Google Play Developer Program Policies, including the Health Connect Permissions policy.

Please read this Privacy Policy carefully. By downloading, installing, or using our app or Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please do not use our Services.

1. Information We Collect

We collect information that you provide directly to us when you register on our platform, create or modify your profile, set up preferences, add health information, or make purchases. We adhere to the principle of data minimization and only collect data that is necessary for the functioning of our Services.

1.1 Information You Provide Directly

Contact Information: Name, email address, date of birth, location, and phone number.
Account Information: Username, password, profile preferences, two-factor authentication settings, and the permissions you give other people to access your account.
Health and Wellness Information: Health data and measurements, conditions, surgeries, allergies, family history, symptoms, pregnancy status if you choose to enter it, medication records and reminders, appointments, and health plans.
Documents and Images: Lab reports, medical documents, exam images, and photos you upload.
Emergency Contacts: The names and contact details of the people you add as emergency contacts.
Messages: Messages you exchange in the app with your care team or with Saluso support.
Payment Information: Purchases in the iOS app are processed by Apple (App Store), purchases in the Android app by Google (Google Play), and purchases on our website by our subscription-management provider and its payment processor. We receive a record of the purchase (plan, dates, and status) but never your card details.

1.2 Information Collected Automatically

Usage Data: Information about how you interact with our Services, including pages visited, features used, time spent in the app, and interaction patterns.
Device Information: Device type, operating system version, unique device identifiers, general diagnostic data, and a push-notification token so that we can send you the reminders you set.
Log Data: IP address, access times, app crashes, and system activity logs used for troubleshooting and improving our Services.

Face ID, Touch ID, and fingerprint unlock are handled entirely by your device. Saluso never receives your biometric data.

1.3 Information from Third Parties

If you choose to connect them, we receive data from health apps and devices such as Apple Health, Health Connect, and Samsung Health, through a health-data integration provider (see Sections 3.5 and 3.6). We may also receive information from healthcare providers you authorize to share data with us.

2. How We Use Your Information

Provide, maintain, and improve our Services
Process transactions and send related information
Connect you with the healthcare providers and people you choose
Provide the optional AI features described in Section 3.2, only if you allow them
Send reminders, administrative messages, and service communications
Respond to your comments, questions, and support requests
Comply with legal obligations
Monitor and analyze usage trends to improve user experience

We do not sell or rent your personal information to third parties. We do not use your data for targeted advertising.

2.1 Legal Bases for Processing

For users in the European Economic Area, United Kingdom, and other jurisdictions with similar requirements, we process personal data under one or more of the following legal bases:

Contract: To create and manage your account, provide the Services, process subscriptions and purchases, and respond to service-related requests.
Legitimate Interests: To secure the Services, prevent fraud and abuse, improve functionality, perform analytics, troubleshoot issues, and enforce our Terms.
Legal Obligation: To comply with applicable laws, regulations, lawful requests, tax and accounting obligations, and recordkeeping requirements.
Consent: For optional features, including the AI features, which stay off until you allow them.
Health Data: We process your health data on the basis of your explicit consent (GDPR Article 9(2)(a)), which you give when you create your account. You can withdraw it at any time by deleting your account; this does not affect processing carried out before the withdrawal.

3. Health Information, AI Features, and Connected Health Apps

3.1 Health Data Handling

Health information is special-category data under the GDPR and is treated with heightened care. We use it only to provide the Services you use, and we protect it with encryption in transit and at rest and with strict access controls.

3.2 Optional AI Features

The values in the documents you upload are read on Saluso's own servers, without artificial intelligence. Some optional features use an artificial intelligence provider: summaries of your results, Saluso Coach, translation of your records into your language, and categorisation of imaging-exam reports.

These features are off until you allow them in the app, and you can turn them off at any time in Profile > Security > AI features. When they are off, no data is sent to the AI provider.

3.3 AI-Generated Content

You acknowledge and agree that:

AI-generated content is for informational purposes only and does not constitute medical advice, diagnosis, or treatment.
AI outputs may be limited or inaccurate, and should not be interpreted as clinical recommendations.
You should always consult a licensed healthcare professional for medical advice, diagnoses, treatment plans, prescriptions, and decisions regarding your health.
AI content is provided "as is", and we expressly disclaim any warranty or liability arising from your use of AI-generated content.

3.4 Data Sent to the AI Provider

Data sent to the AI provider is always anonymised. Saluso never sends your name, email address, phone number, address, date of birth, or identification numbers, and removes them from document text and messages before anything is sent. What is sent is your age, sex, and the health information the feature needs.

The AI provider processes this data under contract only to return the result to Saluso, and may not use it to train its models, for marketing, or for any other purpose.

3.5 Apple Health

If you connect Apple Health, Saluso reads only the data types you allow, to show them in your health record and health plans. Saluso does not write data to Apple Health. Apple Health data is not used for advertising or marketing, is not sold, is not shared with third parties except to provide the Saluso Services or with your consent (for example, with the people you choose to share your record with), and is not stored in iCloud.

3.6 Health Connect and Samsung Health

On Android, if you connect Health Connect or Samsung Health, Saluso reads activity, heart rate, blood pressure, blood glucose, oxygen saturation, respiratory rate, body temperature, body measurements, sleep, and VO2 max, only to show them in your health record and health plans and to keep them up to date. You choose which data types to allow, and you can revoke access at any time in Health Connect or Samsung Health.

Saluso's use and transfer of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

4. Data Security

We implement appropriate technical and organizational measures to protect the security of your personal information, including encryption in transit (TLS) and at rest, access controls, two-factor authentication, and regular security reviews.

4.1 GDPR Compliance

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR). You have the following rights regarding your personal data:

The right to access your personal data
The right to rectify inaccurate personal data
The right to erasure ("right to be forgotten")
The right to restrict processing of your personal data
The right to data portability
The right to object to processing of your personal data
The right to lodge a complaint with a supervisory authority

5. Sharing and Disclosure of Personal Information

We may share your information in the following circumstances:

Service Providers: We use service providers that process data on our behalf under contract: cloud hosting and storage in the European Union; a provider of artificial intelligence services for the optional AI features; a health-data integration provider that connects the apps and devices you choose; a subscription-management provider; and a product-analytics provider hosted in the European Union. Apple and Google process payments for purchases made in their stores.
AI Provider: Only anonymised data, as described in Section 3.4, and only for the optional AI features you allow.
People You Choose: Doctors, carers, or family members you give access to in the app see only the parts of your record you select, for the period you select. You can revoke access at any time.
Legal Obligations: To comply with applicable law, regulation, legal process, or enforceable governmental request.
Safety and Rights: To protect the rights, property, or safety of Saluso, our users, or others.
With Your Consent: In any other case where you have provided explicit consent.

We do not share personal health information with unaffiliated third parties for their direct marketing purposes.

6. Data Retention and Deletion

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected.

Account and Health Data: Kept while your account is active, and deleted or anonymised within 30 days of a deletion request, except where retention is required by law.
Backups: Copies in our encrypted backups are overwritten within 7 days.
Invoices and Payment Records: Kept for the period required by applicable tax and accounting law.
Third-Party Processors: When your account is deleted, we instruct our processors, including the health-data integration provider, to delete your data.

You can delete your account in the app (Profile > Security > Delete account) or by following the steps at saluso.com/delete-account.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete personal data.
Deletion: Delete your account in the app (Profile > Security > Delete account) or request deletion of your personal data ("right to be forgotten").
Restriction: Request restriction of processing of your personal data.
Portability: Request a portable copy of your data in a structured, commonly used, machine-readable format.
Objection: Object to certain processing activities, including profiling.
Withdraw Consent: Turn the optional AI features off at any time in Profile > Security > AI features, and withdraw consent to health-data processing by deleting your account.

To exercise any of these rights, contact us at info@saluso.com from the email address registered in your account. We will respond to verified requests within 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the supervisory authority of your country.

8. Consent and Permissions

In accordance with Apple's App Store Review Guidelines and Google Play's policies, we respect your permission settings and will never attempt to manipulate, trick, or force you into consenting to unnecessary data access.

We request only the permissions necessary for the features you choose to use.
We provide clear in-app explanations of why each permission is needed before requesting it.
You may change or revoke any permission at any time through your device's Settings or within the app.
The optional AI features ask for your consent in the app before they are used for the first time.

9. Tracking and Advertising

We do not track you across apps or websites owned by other companies for the purposes of advertising or ad measurement. We do not use the Apple Advertising Identifier (IDFA) or the Android advertising ID, and we do not participate in data broker activities.

If we ever introduce tracking in the future, we will ask for your explicit permission first, including through Apple's App Tracking Transparency framework on iOS.

10. Children's Privacy

Our Services are intended for individuals aged 18 years or older (or the age of majority in your jurisdiction). We do not knowingly collect or retain personal information from children under the applicable age limit. If you believe a child has provided us with personal data, please contact us at info@saluso.com.

11. International Data Transfers

We host and store your data in the European Union. Where a service provider processes data outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or other legally recognized transfer mechanisms.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy within the app and on our website, and by updating the "Last updated" date at the top of this document. Your continued use of our Services after any modification constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, including questions for our data protection contact, please contact us at:

Your Health One Place, Lda.
Company registration number: 518839702
Email: info@saluso.com
Data protection contact (DPO): info@saluso.com
Telephone: +351 928 497 707
Address: Rua Mário Azevedo Gomes 5 2D, 1500-467 Lisboa, Portugal
Website: https://saluso.com