Prevox is a personal and family preventive health app. Protecting your data, and especially your health data, is at the heart of how we build it (privacy by design). This policy explains what data we process, why, how it is protected, and what your rights are.
Prevox is a prevention and organization tool. The app does not provide any diagnosis and does not replace the advice of a healthcare professional.
1. Data controller
Prevox, a company being incorporated. Its legal name, legal form, registration number and registered office address will be published here as soon as it is registered.
Contact: contact@prevox.health. Data protection: dpo@prevox.health (Data Protection Officer being appointed).
2. Data we process
Account and identity
- Email address, login identifier, authentication data.
Family profiles
- First name or profile label, year of birth, sex assigned at birth (optional), relationship, country of residence (optional).
Health data (special category under the GDPR, Art. 9)
- Medical record: prescriptions, lab results, imaging, vaccines, observations, allergies, imported documents.
- Prevention reminders (vaccines, screenings, check-ups) and appointments.
- MindWatch: results of short cognitive mini-games (memory, attention, motor skills) and their evolution over time.
- Souffle: guided breathing exercise sessions.
- Prevox emergency card: vital emergency information (allergies, treatments, contacts).
Technical data
- Device model, app version, language, technical logs needed for operation and security. Notification tokens if you enable them.
Microphone and speech recognition
- Only if you use a voice exercise (coming soon). Speech is processed to measure verbal fluency; no recording is kept without an explicit action from you. The microphone is never activated in the background.
Motion sensors
- Only during a balance exercise (coming soon), to measure stability. No location is derived from them.
We do not collect your data for advertising purposes. We never sell your data.
3. Purposes and legal bases (GDPR)
- Providing the service (record, reminders, modules): performance of the contract (Art. 6.1.b).
- Processing your health data: your explicit consent (Art. 9.2.a), withdrawable at any time.
- Security, fraud prevention, proper operation: legitimate interest (Art. 6.1.f).
- Prevention notifications: your consent (in-app settings).
4. Security and encryption
Security is a design principle, not an option.
- Your sensitive data is encrypted at rest and in transit.
- Medical record documents are end-to-end encrypted: encrypted on your device before any upload, so their content is not readable on the server side.
- Storage is segmented by data type (defense in depth).
- Recovery escrow, on by default and optional: your record is not lost after a reset, and no one at Prevox can open it alone.
5. Hosting and location
Your data is hosted in your region: in Dublin (Ireland) for people in Europe, in Canada for people in Canada. Each new country gets its own database and its own backup, which we announce when it opens. During the test phase, all data is hosted in Dublin. Our technical providers, Supabase (database) and Vercel (website), are not certified as Health Data Hosts (HDS). No transfer outside the hosting region is carried out without appropriate safeguards; where applicable, such transfers will be governed in accordance with the GDPR and documented here.
6. Sharing and recipients
You stay in control of who accesses your record.
- Sharing with a healthcare professional: only at your initiative. You choose the scope (sections or documents) and the duration. You revoke access in one tap. Every access is logged in a record you can review.
- Technical sub-processors: providers strictly necessary to the service (hosting, database, notifications), bound by contract and to confidentiality. The current list is available on request at dpo@prevox.health.
- Authorities: only where required by law.
7. Retention periods
- Account and health data: kept as long as your account is active, then erased within 30 days of account deletion.
- Health data access logs: 10 years (French decree no. 2016-994).
You can request deletion of your account and your data at any time.
8. Your rights
Under the GDPR: access, rectification, erasure, restriction, objection, portability, and withdrawal of consent at any time. The app lets you export your record and manage access directly.
To exercise your rights: dpo@prevox.health. You may lodge a complaint with your supervisory authority (in France, the CNIL, www.cnil.fr).
9. Family profiles and minors
The account holder can create and manage profiles for relatives, including minor children, under their responsibility and with the required parental authority. This data benefits from the same protections. The age at which a minor can consent alone depends on the law of their country of residence.
10. Cookies and trackers
The app does not use advertising trackers. Only technologies strictly necessary for operation and security are used.
11. Non-diagnostic nature
Prevox features (reminders, MindWatch, signals, Souffle) are prevention and tracking tools. They do not constitute a medical diagnosis and do not replace a consultation. If in doubt or in case of symptoms, consult a healthcare professional.
12. Changes
This policy may change. Any significant change will be notified in the app. The last updated date appears at the top of this document.
13. Contact
For any question about your data: contact@prevox.health. DPO: dpo@prevox.health.