Privacy Policy
Helsa
Last updated: December 15, 2025 | Version 1.2
1. Data Controller
The Data Controller for personal data processing is:
Marino Panariello
Email: marinopanariello@gmail.com
Address: Via Alcide De Gasperi 49, Torre del Greco (NA), Italy
2. Categories of Data Collected
2.1 Account Data
| Data | Purpose | Legal Basis | Requirement |
|---|---|---|---|
| Email address | Registration, login, service communications | Contract | Required |
| Password (bcrypt hash) | Secure authentication | Contract | Required |
| First/Last name | Personalization, document headers | Contract | Optional |
| Apple ID / Google ID | Social authentication (if used) | Contract | Optional |
2.2 Health Data (Special Categories under Art. 9 GDPR)
| Category | Examples | Retention |
|---|---|---|
| Medical documents | Reports, prescriptions, medical records, tests | Until user deletion |
| Attachments | PDFs, images of medical documents | Until user deletion |
| Medical appointments | Date, location, doctor, specialty, notes | Until user deletion |
| Medications and therapies | Drug name, dosage, frequency, reminders | Until user deletion |
| Family profiles | Name, date of birth, family relationship | Until user deletion |
2.3 Technical Data (Automatically Collected)
| Data | Purpose | Retention |
|---|---|---|
| Device type, model, OS | Compatibility, debugging | 90 days |
| App version | Support, updates | 90 days |
| IP address | Security, server geolocation | 30 days |
| Error logs (crash reports) | Debugging, stability improvement | 90 days |
| Access timestamps | Security, audit | 1 year |
| Anonymous identifiers | Aggregate analytics | 2 years |
2.4 Payment Data
Helsa does not store credit card or payment method data directly. Payments are handled by:
- Apple App Store - for iOS users
- Google Play Store - for Android users
- RevenueCat - for cross-platform subscription management
We only receive confirmation of payment and subscription status (active/expired).
3. Purposes and Legal Bases for Processing
| Purpose | Legal Basis (GDPR) | Data Involved |
|---|---|---|
| Service delivery (storage, sync, reminders) | Art. 6.1.b - Contract performance | Account, documents, appointments, medications |
| Health data processing | Art. 9.2.a - Explicit consent | All health data |
| Subscription and billing management | Art. 6.1.b - Contract performance | Email, subscription status |
| Service communications (security, critical updates) | Art. 6.1.b - Contract performance | |
| Error monitoring and app stability | Art. 6.1.f - Legitimate interest | Technical data, crash reports |
| Analytics and service improvement | Art. 6.1.a - Consent | Anonymized usage data |
| Legal and tax compliance | Art. 6.1.c - Legal obligation | Transaction data |
4. Third-Party Services (Sub-processors)
To provide the service, we use the following technology providers:
4.1 Supabase Inc.
| Role | Cloud database, authentication, file storage |
|---|---|
| Data processed | All user data (encrypted) |
| Location | USA (with EU server option - Frankfurt) |
| Safeguards | SOC 2 Type II, GDPR DPA, Standard Contractual Clauses |
| Privacy Policy | supabase.com/privacy |
4.2 PostHog Inc.
| Role | Product analytics and user behavior analysis |
|---|---|
| Data processed | App usage events, anonymized user ID, device info, in-app actions |
| Location | USA with EU server (eu.i.posthog.com) |
| Safeguards | SOC 2 Type II, GDPR compliant, Data Processing Addendum |
| Privacy Policy | posthog.com/privacy |
Details on PostHog usage:
- We use EU servers to ensure data remains within the European Union
- We collect app lifecycle events (open, close, background)
- Events are aggregated and anonymized
- We do not collect document contents or health data through analytics
- You can request deletion of your analytics data by contacting us
4.3 Sentry (Functional Software Inc.)
| Role | Error monitoring and crash reporting |
|---|---|
| Data processed | Stack traces, device info, anonymized user ID |
| Location | USA (EU servers available) |
| Safeguards | SOC 2 Type II, GDPR DPA, Data Processing Addendum |
| Privacy Policy | sentry.io/privacy |
4.4 RevenueCat Inc.
| Role | In-app subscription management |
|---|---|
| Data processed | User ID, subscription status, purchase receipts |
| Location | USA |
| Safeguards | GDPR compliant, DPA available |
| Privacy Policy | revenuecat.com/privacy |
4.5 Apple Inc. / Google LLC
| Role | App distribution, in-app payments, social authentication |
|---|---|
| Data processed | Apple/Google account (if used for login), transactions |
| Privacy Policy | Apple Privacy | Google Privacy |
4.6 Expo / React Native (Meta)
| Role | Development framework, push notifications, OTA updates |
|---|---|
| Data processed | Push token, diagnostic data |
| Privacy Policy | expo.dev/privacy |
5. Data Transfers Outside the EU
Some of our providers are based in the United States. Data transfers comply with GDPR through:
- Standard Contractual Clauses (SCC) - Standard contractual clauses approved by the European Commission
- EU-US Data Privacy Framework - For certified providers
- Binding Corporate Rules - Where applicable
You can request a copy of the appropriate safeguards by contacting us at the email address provided.
6. Data Retention
| Category | Retention Period | After Account Deletion |
|---|---|---|
| Account data | Duration of contractual relationship | Deleted within 30 days |
| Documents and attachments | Until deleted by user | Deleted within 30 days |
| Backups | 30 days (rolling backup) | Purged within 60 days |
| Technical logs | 90 days | N/A (anonymized) |
| Analytics data (PostHog) | 2 years | Anonymized/deleted upon request |
| Billing data | 10 years (tax requirement) | Retained for legal obligation |
| Consent and audit trail | 5 years from last interaction | Retained for legal protection |
7. Data Security
We implement appropriate technical and organizational measures:
Encryption
- TLS 1.3 for all communications in transit
- AES-256 for data at rest in the database
- Bcrypt hashing for passwords
- Expo SecureStore for device tokens
Access Control
- Row Level Security (RLS) on database
- JWT authentication with refresh tokens
- Optional biometric authentication (Face ID/Touch ID)
- Automatic session timeout
Infrastructure
- Servers in certified data centers (SOC 2, ISO 27001)
- Automatic daily backups
- 24/7 monitoring with alerting
- Disaster recovery plan
Access to Your Files
We have implemented technical and organizational measures to protect your health files:
- Row Level Security (RLS): Each file is accessible exclusively by the owner through their own JWT authentication
- Access restrictions: Administrative access to user content is strictly limited and controlled
- Audit trail: Every data access is tracked and verifiable
We may access your data only for:
- Providing technical support at your request
- Account recovery assistance
- Investigating security incidents or abuse
- Complying with legal obligations (e.g., court orders)
For routine technical support, we typically only view:
- File metadata (name, creation date, size)
- Synchronization status
- Application error logs (without file content)
- Aggregate counts and statistics
This architecture ensures that your health data remains private during normal operations and technical support requests.
8. Your Rights (Art. 15-22 GDPR)
As a data subject, you have the right to:
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain confirmation of processing and a copy of your data | Email or in-app function |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Directly in-app or email |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") | Settings → Delete account |
| Restriction (Art. 18) | Restrict processing in certain circumstances | |
| Portability (Art. 20) | Receive your data in a structured format (JSON/CSV) | Settings → Export data |
| Objection (Art. 21) | Object to processing based on legitimate interest | |
| Withdraw consent (Art. 7) | Withdraw consent at any time | Settings or email |
We will respond within 30 days of the request. For complex requests, the deadline may be extended by an additional 60 days with prior notice.
9. Account and Data Deletion
You can request complete deletion in two ways:
- In-app: Settings → Account → Delete account
- Email: Write to marinopanariello@gmail.com
Deletion involves:
- Irreversible deletion of all documents and attachments
- Removal of data from servers within 30 days
- Purging of backups within 60 days
- Retention only of data required for legal obligations
10. Minors
Helsa is not intended for minors under 16 years of age. We do not knowingly collect data from minors under 16 without verifiable consent from a parent or guardian.
If you are a parent and believe your child has provided personal data, please contact us immediately for removal.
11. Cookies and Tracking Technologies
The mobile application does not use cookies in the traditional sense. We use:
- SecureStore: To securely store authentication tokens on the device
- AsyncStorage: For user preferences and local cache
- SQLite: For offline document storage
- PostHog SDK: For product analytics (with EU servers)
For more details, see our Cookie Policy.
12. Changes to the Privacy Policy
We reserve the right to update this policy. In case of substantial changes:
- We will send you an in-app notification
- We will send you an email (if you have an account)
- We will update the "Last updated" date
- For changes requiring new consent, we will explicitly request it
13. Complaints
If you believe the processing of your data violates the GDPR, you have the right to file a complaint with:
Italian Data Protection Authority (Garante per la Protezione dei Dati Personali)
Piazza Venezia 11 - 00187 Rome, Italy
Email: protocollo@gpdp.it
PEC: protocollo@pec.gpdp.it
Website: www.garanteprivacy.it
14. Contact
For privacy-related questions:
Email: marinopanariello@gmail.com
Data Controller:
Marino Panariello
Via Alcide De Gasperi 49, Torre del Greco (NA), Italy
Email: marinopanariello@gmail.com