Privacy Policy

This Privacy Policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Detectives Health is committed to protecting your privacy and handling your personal information responsibly.

At Detectives Health, privacy comes first.

We collect only the information needed to provide our educational health service and keep your account secure.

What We Collect

• Your email address, and authentication details, if you create an account. You may sign in with a password or with Google.
• Laboratory reports you upload as PDFs or images, and the laboratory values contained in them
• Laboratory values, health notes and tracker entries you enter yourself
• Clinical context you choose to provide with a submission, such as medication or previous results
• Educational reports and interpretations generated for you, including professional review records
• Subscription and payment status. Card details are handled by our payment processor and never reach our servers.
• Beta programme participation and any feedback you submit
• Technical and security information needed to operate the service, such as request and error logs
• Anonymous usage analytics, only if you choose to opt in. None are in use today.

Some preferences (region, age band, onboarding state, analytics choice) are stored only in your browser and are not sent to us.

How Your Laboratory Reports Are Processed

Detectives Health is not a browser-only tool. When you submit a laboratory report it is stored on our servers in a private, access-controlled store and processed as follows:

1. Your file is uploaded and stored privately, linked to your account.
2. AI-assisted extraction. To read the results out of the document, the content of your uploaded report (the PDF or image itself, or information derived from it) is transmitted to an external AI processing service. We use the Lovable AI Gateway, which routes the request to Google's Gemini models. This transfer happens only when extraction or AI-assisted educational drafting is performed for your submission.
3. Extracted values are checked by our own deterministic safety and classification engine, which runs on our servers — not by an AI model.
4. A laboratory professional reviews and verifies the transcription and the draft educational report before it can be approved and released to you.

AI is used to read documents and to help draft educational wording. It does not decide your safety status, your urgency level or whether a report is released to you — those are deterministic checks plus human professional review.

We do not use your laboratory information to train our own models, and we do not make it available to anyone for advertising. We have not independently verified, and therefore do not claim, what any individual AI infrastructure provider does with data beyond fulfilling our request; we rely on their published terms and our contractual arrangements as processors.

What We Do Not Do

• We do not sell personal or health information
• We do not share personal information for advertising purposes
• We do not use laboratory information submitted by users to train our own machine learning models
• We do not make automated medical decisions or diagnoses about your health
• We do not contact your GP, NHS organisation, hospital or laboratory without your explicit consent
• We do not access any NHS or hospital records unless you explicitly provide information yourself
• We do not store unnecessary personal information
• We do not share your saved health information with other users

To be clear about what we do do: when you submit a report for professional review, an authorised laboratory professional at Detectives Health reads your report and the extracted values in order to verify and approve them, and the document is processed by the AI extraction service described above.

Your Data

Any health information, notes or laboratory results you save remain linked to your account and are available only to you.

You can edit, export or permanently delete your saved information at any time through your account settings.

Data Retention and Deletion

We keep your account information, uploaded laboratory reports, extracted values and generated educational reports for as long as your account remains open, so that you can return to them. We do not currently apply an automatic expiry to uploaded reports.

When you delete your account from Settings, deletion runs immediately: your uploaded laboratory files are removed from storage, your account and its linked records are deleted from our database, and any active subscription is cancelled.

Payment and invoice records held by Stripe are retained where UK accounting and tax law requires it. Minimised security and audit records of privileged system actions are retained to protect the platform. Encrypted infrastructure backups are overwritten on our hosting provider's routine cycle.

Full instructions, including how to request deletion if you cannot sign in, are on our account and data deletion page.

Security

We use a layered approach to protect your information, applying industry-standard controls throughout the platform.

• Industry-standard encryption for data in transit and at rest
• Secure authentication for account access
• Access control restricted to authorised system operations and approved service providers
• Audit logging of privileged and security-relevant activity
• Routine security monitoring of the platform and supporting infrastructure
• Data minimisation — we collect only the information necessary to provide the services you choose to use
• Secure cloud infrastructure provided by established, reputable providers
• Protection against unauthorised access, alteration or disclosure
• Regular security reviews of our controls, configuration and processes
• Ongoing cyber security improvements as threats and best practice evolve

Third-Party Services

We use the following service providers to operate the platform. They act as processors on our behalf under data protection terms, and are not permitted to use your information for their own marketing purposes.

• Lovable — application hosting and build infrastructure.
• Supabase — database, authentication and private file storage for uploaded laboratory reports.
• Cloudflare — edge hosting, content delivery and network protection.
• Lovable AI Gateway and Google (Gemini models) — AI-assisted reading of uploaded laboratory documents and drafting of educational wording.
• Stripe — subscription payments. Stripe receives your email address and payment details directly; we never see your card number.
• Mailgun — delivery of transactional email such as review and account notifications.
• Google — optional Google sign-in, and delivery of the web fonts used by the site.

We do not use advertising networks, tracking SDKs, crash-reporting services or analytics providers.

International Data Transfers

Several of these providers operate infrastructure outside the United Kingdom, including in the United States and the European Union. Where personal information is transferred outside the UK, appropriate safeguards are applied in accordance with applicable data protection legislation.

Analytics

Detectives Health does not currently operate any usage analytics, advertising or tracking. The analytics preference in the app records only whether you would consent to anonymous usage analytics if we introduce them in future. It is off by default and you can change it at any time in Settings.

Your Rights

You may:

• Access your data
• Export your data
• Correct your information
• Delete your account and saved data
• Contact us with any privacy questions

Children's Privacy

Detectives Health is intended primarily for users aged 16 years and over.

Users under the age of 16 should only use the platform with the knowledge and consent of a parent or legal guardian where permitted by applicable law.

Educational Disclaimer

Detectives Health is an educational health information platform designed to help users better understand laboratory tests and health information.

The platform does not diagnose disease, estimate disease risk, recommend treatment, prescribe medication or replace professional medical judgement.

Educational explanations should always be considered alongside advice provided by an appropriately qualified healthcare professional.

Detectives Health does not provide emergency medical services. If you believe you have a medical emergency, contact your local emergency services immediately.

Important

Detectives Health does not access NHS, GP, hospital or laboratory records unless you choose to upload information yourself or provide it directly within your account. All educational explanations are generated solely from the information that you provide and should always be interpreted alongside advice from your healthcare professional.

Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be clearly communicated within the app.

Privacy Contact

For privacy-related questions, please contact us at:

• Email: privacy@detectiveshealth.org
• Website: www.detectiveshealth.org