Privacy notice
Your data, minimised.
Last updated 2026-11-03.
| Controller | The Knowledge Formula - FZCO, Dubai Silicon Oasis, UAE |
|---|---|
| Health records stored | None |
| Account data | E-mail (encrypted), password hash, encrypted two-step secret |
| Cookies | 1 strictly necessary session cookie |
| Session lifetime | 15 minutes idle, 8 hours maximum |
| Security log retention | 400 days, pseudonymous |
| Trackers and ads | None |
| Price | 0 EUR during the pilot |
Who is responsible for my data?
The Knowledge Formula - FZCO (DSO-FZCO-36765), IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, contact me@karllillrud.com, is the controller for HealthIntelligence. Where the EU or UK GDPR applies, it applies to this service in full.
What do you process and why?
- Account: your e-mail address (encrypted), a password hash, an encrypted authenticator secret and hashed recovery codes. Purpose: running your account securely. Legal basis: contract (Art. 6(1)(b) GDPR).
- Optional profile: birth year, sex used in equations, country and optional answers such as smoking status, all encrypted. Purpose: calculations you ask for. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw by clearing the fields.
- Health records: read from HealthVault only when you run an analysis and only within the scope you set there. Processed in memory and not stored; dropped after at most 10 minutes or at sign-out. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), given by creating the connection code.
- Security events: sign-ins, failures and connection changes with a pseudonymous reference, kept for up to 400 days. Purpose: protecting accounts. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and security of processing (Art. 32).
What do you never do with my data?
No advertising, no analytics, no tracking cookies, no sale of data, no profiling, no automated decisions with legal or similar effects, and no use of your health content to train AI models. No health content is sent to any AI language model.
Which cookies are used?
One strictly necessary cookie, __Host-hi_session, keeps you signed in. It expires after 15 minutes of inactivity and at most after 8 hours. The appearance setting in the app is stored only in your browser.
Where is my data processed?
The service runs on a dedicated server in the European Union operated by our hosting provider under a data processing agreement. HealthVault, which holds your records, is a separate service you control. No other recipients.
How long is data kept?
Account data is kept until you delete the account. Deletion removes the account, profile, sessions and connection code immediately.
What are my rights?
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Use Account settings for export and deletion, or write to us. You can complain to your data protection authority, for example IMY in Sweden, AEPD in Spain or your local authority.
How is my data protected?
See the security architecture of HealthIntelligence and how the HealthVault connection limits what can be read.