1.Who We Are (Data Controller)

The data controller responsible for your personal data is health.systems, a brand operated by Enterprise.Systems, a company organized under the laws of the State of Israel ("we", "us", or the "Company").

For any privacy matter, including to exercise your rights, you can contact our Data Protection Officer (DPO):

2.Data We Collect

We collect only what we need to run the Service. The table below summarises the categories of personal data we process.

Scanning before you verify

You can take your first check-in before verifying your phone number. The data from that scan — your wellness metrics, its timestamp, and any eye image — is stored against the account and device you used and stays associated with them. Verifying your phone afterwards simply confirms the account that already holds that data; it is not re-collected or moved. To continue past your first check-in, phone verification is required.

3.What We Do Not Collect

• We do not perform biometric identification.
• We do not perform facial recognition.
• We do not collect or produce health diagnosis data — checkup.report is a wellness product, not a diagnostic one.
• Blood-oxygen saturation (SpO₂) is measured only for internal research and validation; it is never displayed to you and never included in your reports.

4.Legal Basis for Processing (GDPR Art. 6)

We rely on the following legal bases:

• Consent (Art. 6(1)(a)) — for processing your wellness data and, separately and optionally, for research use. You may withdraw consent at any time.
• Performance of a contract (Art. 6(1)(b)) — to deliver the Service you sign up for, including accounts, scans, and billing.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud and abuse, and maintain service quality, balanced against your rights.

Where we process data revealing health information, we do so on the basis of your explicit consent or as otherwise permitted under Article 9 GDPR.

5.How We Use Your Data

• To provide wellness insights from your check-ins;
• To detect trends over time across your own readings;
• To improve the quality and reliability of the Service;
• To generate anonymised, aggregate statistics — only where you have given explicit, separate consent;
• To secure the Service, verify accounts, prevent fraud, and comply with law;
• To communicate with you about your account, billing, and important changes.

We do not use your data for advertising and we do not sell it.

AI-generated Personal Insight (premium)

Personal Insight is an optional premium feature that turns your wellness history into a short, plain-language narrative. To generate it, we send a de-identified, qualitative summary of your check-ins to Anthropic (the maker of the Claude AI models), acting as our subprocessor. This summary contains no name, email, phone number, or account identifier, and no raw measurements — only qualitative descriptions (for example, "your resting pulse has been easing down across recent check-ins"). Anthropic processes this input solely to return the generated text to us under contract; the result is shown only to you.

6.Data Retention

• Account data is retained while your account is active and for up to 30 days after deletion, after which it is erased.
• Scan data is retained for longitudinal (over-time) tracking while your account is active.
• Following an account-deletion request, all of your data is deleted within 30 days, except where we are legally required to retain limited records (e.g. for tax or fraud-prevention obligations), which are kept only as long as the law requires.

7.Data Sharing, Disclosure & Subprocessors

We do not sell your personal data. We share it only with the service providers ("subprocessors") that make the Service work, and only as needed, in the limited cases below:

All subprocessors are bound by data-protection agreements that restrict their use of your data to providing services to us.

7A.Integrations You Connect

This is different from the subprocessors above, and the difference matters. Every recipient in Section 7 is a supplier we chose and we bound by a data-protection agreement, working on our instructions. An integration you connect is the opposite: you choose it, you start the data flow, and we have no contract with it and no control over what it does next.

You can create an API key from your account and give it to software you choose — your own, or an external platform. While that key is active, the platform holding it can read from your account the categories of data you allowed, which may include:

• check-in results (heart rate, breathing rate and the other wellness signals derived from a scan, and the written reflection that accompanies them);
• voice check-in results (the vocal qualities we measure — never a recording, which is deleted as described in Section 2);
• guided breathing and recovery session results;
• activities and daily journal entries you have logged, and the self-relative patterns derived from them;
• your trends, timeline and readiness score.

What you control. When you create a key you choose which of those capability groups it may use, and a request outside them is refused. You can see your keys and revoke any of them at any time from your account; revocation takes effect immediately, on the next request. A key only ever reaches your own account — it cannot read anyone else's data.

What we record. For each API request we log the endpoint, method, response status and timing, so you can see your own usage and so we can investigate abuse. We do not log request or response bodies. This log is deleted with your account like the rest of your data.

What you are responsible for. Please review a platform's own privacy policy and security practices before connecting it — once data reaches it, that platform decides what happens next, and it becomes the controller of the copy it holds. Revoking a key, or deleting your checkup.report account, stops future access but cannot retrieve data an integration already received: our erasure obligations under Section 10 cover our systems, not copies elsewhere. To have those copies deleted, contact the platform directly.

8.Research Data & Consent

We use data for research only with your explicit, separate consent, which is off by default. If you opt in:

• Your data is de-identified in line with the HIPAA Safe Harbor standard, removing the 18 categories of identifiers (such as name, contact details, dates, and device identifiers);
• Research data is used to better understand wellness patterns and improve our methods;
• You may withdraw your research consent at any time from your account settings or by emailing [email protected]. Withdrawal stops future research use; data already irreversibly de-identified may not be retrievable, but no further identifiable data will be used.

9.International Transfers

Your account and wellness data are hosted in the European Union (Czech Republic). Some of our subprocessors — including Anthropic, Twilio, PayPal, and Cloudflare — are based in the United States, so certain limited data is transferred there to provide those functions. For any transfer outside the EU/EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), to ensure your data continues to be protected to EU standards. You may request a copy of the relevant safeguards by contacting our DPO.

10.Your GDPR Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict processing in certain circumstances;
• Portability — receive your data in a structured, machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent at any time, without affecting prior lawful processing.

You can exercise these rights from your account settings or by emailing [email protected]. You also have the right to lodge a complaint with your local supervisory authority (in the EU) or the Israeli Privacy Protection Authority.

11.Israeli Privacy Protection Law

Under the Israeli Privacy Protection Law, 5741-1981, our database is operated and, where required, registered in accordance with the Law. You have the right to access the information held about you and to request its correction or deletion. To exercise these rights, contact [email protected].

12.Children

The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact [email protected] and we will delete it promptly.

13.Cookies

We use minimal cookies, limited to session management needed to keep you signed in and to operate the Service securely. We do not use tracking cookies, and we do not use advertising cookies or third-party ad networks.

14.Security Measures

• Encryption in transit — all traffic is encrypted using TLS 1.2+ (TLS 1.3 preferred); access to stored data, including any eye images, is restricted to a strict need-to-know basis;
• Access controls limiting who can access personal data on a need-to-know basis;
• Regular security reviews and hardening of our systems.

No method of transmission or storage is perfectly secure, but we work to protect your data using appropriate technical and organisational measures.

15.Breach Notification

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, in line with GDPR, and will inform affected users without undue delay where required.

16.Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will provide at least 30 days' notice by email and/or within the Service. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

17.Contact & DPO

For any question about this Policy or your data, contact our Data Protection Officer: