Privacy Policy

Effective Date: 24 March 2026

1. Introduction and Who We Are

This Privacy Policy applies to the Punto Health Platform, which includes mobile apps, iPad apps, and web apps (collectively, "we," "us," or "our"). This policy outlines how we collect, use, process, and safeguard personal information. By using the platform, you agree to the practices described herein.

Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller for user data on this platform is PUNTO HEALTH LTD, a company registered in England and Wales (Company Number: 15174291), with a registered address at Health Foundry, 1 Royal Street, London, England, SE1 7LL.

EU Representative

Because we offer services and process the data of individuals located within the European Economic Area (EEA), we have appointed our Spanish subsidiary, Puntoclinic SL, with a registered address at Carrer Laureà Miró 371-373, 08980 Sant Feliu de Llobregat, Barcelona, Spain, to act as our designated EU Representative under Article 27 of the EU GDPR.

Please note: Some sections of this policy apply only to users with access to specific features. These are clearly marked. In instances where we provide services directly to healthcare clinics, we act as a Data Processor on their behalf.

2. Information We Collect

We collect, store, and process different types of information when you interact with the Punto Health Platform. In some cases, we may only process information on behalf of the clinic or health study, rather than collect it ourselves.

a. User Data

We may collect and process the following user data:

• Name, email address & contact details.
• Login information (e.g., username, password, phone number, or authentication tokens).
• Usage data and preferences.
• (Subscription users only) Billing information (e.g., name and billing address). Subscription management is handled by RevenueCat, and payment card details are processed by Stripe. Neither RevenueCat nor Stripe card data is stored by us.
• (PuntoChat users only) Conversation inputs submitted via the PuntoChat feature, including any queries you type during a session.

b. Patient Data

Patient data is processed on behalf of clinics using our platform:

• Personal identifiers (e.g., name, date of birth)
• Medical records, health information, and treatment details

Patient data is owned by the clinic that provides it. We process this data on their behalf in accordance with their instructions and privacy policies.

c. Health Research Study Participants

If you are using the PuntoTest Clinic or PuntoTest apps, you are participating in a health study. As part of this study:

• You have provided informed consent for data collection and storage.
• The study has been reviewed and approved by an ethics committee.
• The data collection complies with App Store health research disclosure rules.

3. How We Use Your Information & Lawful Basis

Our Purposes for Processing

We use your data for the following purposes:

• User Data: To manage accounts, provide access to services, and communicate with you.
• Patient Data: To provide clinics with patient information for management purposes.
• Health Research Data: To support health studies, in compliance with ethical standards and the informed consent process.

Our Lawful Basis (UK and EU GDPR)

To carry out the purposes above, we process your data under the following lawful bases:

• Contractual Necessity (Article 6(1)(b)): To manage accounts, provide access to services, and communicate with you regarding subscriptions and support.
• Legitimate Interests (Article 6(1)(f)): To analyse app performance, improve our platform, and ensure security.
• Consent (Article 6(1)(a)): Where you have opted into specific analytics tracking or marketing. You may withdraw consent at any time.

Processing Health Data (Special Category Data)

Because health and medical information is classified as "Special Category Data" under Article 9 of the GDPR, we only process this data under an additional lawful basis:

• Explicit Consent (Article 9(2)(a)) for direct users of our app.
• Provision of Healthcare or Treatment (Article 9(2)(h)) when acting on behalf of clinics.
• Scientific Research (Article 9(2)(j)) for approved health studies.

Feature Specific Usage

(Subscription users only) We may contact you by email, phone number, or push notification regarding your free trial, subscription status, billing, and service updates.

(PuntoChat users only) Conversation inputs are used solely to generate responses within PuntoChat. Your conversation inputs are strictly confidential and are not used to train our AI models or Google's base AI models. The assistant draws only from content curated and reviewed by our clinical team and is designed to provide information only. It does not provide medical advice and is not a medical device.

4. Data Storage

Your data is stored securely using industry-standard cloud infrastructure providers. We implement robust technical and organisational measures, including encryption at rest and in transit, to protect your personal and health information. Our primary servers are located in the EU.

Data may be passed securely across the Punto Health Platform to ensure seamless care (for example, data entered on a patient's mobile app may be accessible from a clinician's web dashboard). However, health data is strictly segregated and access-controlled by role. This ensures that only explicitly authorised users (such as specifically linked caregivers or assigned clinicians) can view patient information.

5. Sharing of Information

We may share your information in the following circumstances:

• With clinics: Patient data is shared with the clinic that owns it for administrative purposes.
• With UK Healthcare Institutions: When sharing data with NHS Trusts or UK healthcare bodies, we strictly adhere to NHS data standards, including the Data Security and Protection Toolkit (DSPT).
• With third-party providers: We share data with trusted cloud infrastructure, hosting, and database providers that process data on our behalf for operational needs. These providers are bound by strict data processing agreements and security obligations.
• (Subscription users only) With subscription and payment processors: We share billing information with RevenueCat to manage your subscription, and with Stripe to process payments. Both act as independent data controllers for the data they handle. You can review their privacy policies at revenuecat.com/privacy and stripe.com/privacy.
• (PuntoChat users only) With AI infrastructure providers: Conversation inputs are processed by Google (Gemini) via a secure API to generate responses. Google acts as a data processor on our behalf and is bound by a Data Processing Agreement, and does not use your data to train their models.
• Legal compliance: We may disclose your information if required by law or to protect our rights, privacy, safety, or property.

6. Data Security

We implement strict technical and organisational security measures to safeguard your personal and health data against unauthorised access, loss, or alteration. This includes:

• Encryption: All data is encrypted both in transit (while moving across the platform) and at rest (while stored in our databases).
• Secure Infrastructure: We utilise industry-standard, secure cloud environments.
• Automated Monitoring & Audits: We use automated security processing to monitor our systems and conduct regular security audits to ensure ongoing compliance with healthcare data standards.

7. Data Retention

We retain personal data as long as necessary for the purposes outlined in this Privacy Policy.

• Standard User Account Data: Retained for the lifetime of your account. If you request account deletion, we will erase your data within 30 days, barring overriding legal obligations.
• Health studies: Data is retained for the duration of the study and in accordance with ethical guidelines and legal obligations.
• (Subscription users only) Subscription and billing data: We retain your account and billing data for the duration of your subscription and for six (6) years thereafter to comply with applicable financial and legal obligations.
• (PuntoChat users only) Conversation history: Chat history is retained for 12 months from the date of each session, after which it is securely deleted.

8. Analytics and Usage Data

We use analytics tools and software development kits (SDKs) to collect data about how you use our platform. This helps us understand usage trends, improve our services, and enhance product performance. The types of analytics data we collect may include:

• Device information (e.g., device type, operating system)
• App usage statistics (e.g., features used, session length)
• Performance metrics (e.g., crash reports)

This data is collected and processed in an aggregated and anonymised form, meaning it cannot be used to identify you personally. We use this information to:

• Analyse and improve the functionality and user experience of our platform
• Identify and fix technical issues
• Develop new features based on user behaviour and preferences
• Make data-driven decisions about product development

In accordance with the Privacy and Electronic Communications Regulations (PECR) and the ePrivacy Directive, we will ask for your consent before activating any non-essential analytics trackers or SDKs that access information on your device. This data is processed in an aggregated and anonymised form. You can opt out of analytics tracking at any time through your device or app settings.

9. Automated Decision-Making

Our platform utilises AI for cognitive screening (PuntoTest) and conversational support (PuntoChat). However, we do not engage in solely automated decision-making or profiling that produces legal or similarly significant effects on users. All AI outputs and test results are intended to provide clinical support and informational guidance to human clinicians and users, not to replace professional medical diagnosis.

10. Children's Policy

The Punto Health Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a minor, we will take steps to delete such information as quickly as possible.

11. User Rights

Under the UK and EU GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of your personal data.
• Correction: Request corrections to any inaccurate or incomplete data.
• Deletion (Right to be Forgotten): Request the deletion of your personal data.
• Data Portability: Request a copy of your data in a portable format.
• Object: Object to processing carried out on the basis of legitimate interests.
• Restrict: Request that we limit how we use your data in certain circumstances.
• Withdraw consent: Where processing is based on your consent, you may withdraw it at any time.

For Patient Data: Requests regarding access, correction, or deletion of clinical records should be directed to the clinic or NHS Trust that owns the data.

To exercise any of the above rights regarding user data, please contact our Data Protection Officer at dpo@puntohealth.com.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EEA, you may contact the Spanish Data Protection Agency (AEPD) or your local authority.

12. International Data Transfers

As we utilise global cloud infrastructure and AI partners (such as Google Gemini), your data may be transferred outside of the UK or the European Economic Area (EEA).

Whenever we transfer your personal data internationally, we ensure it receives a similar degree of protection by relying on recognised legal mechanisms. These include:

• Transferring data to countries that have been deemed to provide an adequate level of protection by the UK Government and the European Commission.
• Implementing strict contracts, such as the UK International Data Transfer Agreement (IDTA) and the EU Standard Contractual Clauses (SCCs), which legally bind our service providers to protect your data to UK and EU standards.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, and any updates will be reflected with a new "Effective Date" at the top of this page. Please review this policy regularly.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, or wish to exercise your data rights, please contact our Data Protection Officer at:
Email: dpo@puntohealth.com

UK Office (Data Controller):
PUNTO HEALTH LTD
Health Foundry, 1 Royal Street,
London, England, SE1 7LL

EU Representative:
Puntoclinic SL
Carrer Laureà Miró 371-373,
08980 Sant Feliu de Llobregat, Barcelona, Spain