Privacy Policy

Data Ownership and Ethical Practices

You exclusively own your health data. Through our ethical data practices, we empower individuals globally to take control of their health, especially in underserved regions. By using Carthalis, you consent to share your data internally within our platform to enhance your experience, provide personalized insights, and recommend potentially useful resources. We're committed to protecting your privacy and won't sell or share your personal health data with third parties without your explicit consent for each specific use.

Information We Collect

We collect several types of information to provide and improve our services:

• Account Information: When you create an account, we collect your email address, name, and password.
• Profile Information: Information you provide, including preferences and location.
• Usage Data: Information about how you interact with our platform, including features used and time spent.
• Health Data: Health information you provide when filling your health profile, when using our tools, such as symptoms, images, or test results. This information is separated from all other data/identifiers and encrypted for protection

Google Health Data Integrations

If you choose to connect Google Health, Carthalis requests read-only scopes for activity and fitness, health metrics and measurements, sleep, and profile identity. We use this data to import and display your own wellness metrics inside your account and to power analytics features you explicitly use.

• Scope category: Read-only access for activity, health metrics, sleep, and profile identity.
• Use limitation: Data is used to provide product features you request and to maintain integration sync reliability.
• Retention: Imported health records follow this policy's retention and deletion controls, including account deletion workflows.
• Disconnect and revoke: When you disconnect Google Health in-app, Carthalis revokes provider tokens and removes the local integration link.

We do not sell your identifiable Google Health data. We only process it under the same privacy and security commitments described in this policy.

Face Data and Camera Use

When you choose to use features that analyze your face, such as facial age estimation or rPPG-based measurements, we process images and/or video from your device's camera solely to provide those features.

Important: Our rPPG (remote photoplethysmography) feature is a research tool only and is not a medical device. It is not intended for medical diagnosis, treatment, or monitoring of any medical condition. The measurements provided are for research and informational purposes only and should not be used to make medical decisions.

By default, this face data is processed in real time and is immediately destroyed once the analysis is complete. We do not retain this face data or use it for any other purpose without your explicit consent.

If in the future we offer optional features that store face age or other face-derived data (for example, to create a profile picture, or personalized visuals), we will only do so with your explicit consent. In that case, you will be able to withdraw your consent and delete your stored face data at any time, and we will retain such face data for no longer than two years from the date of collection unless you request deletion earlier. The data will be stored in a secure, encrypted database, separate from your other data, and will not be shared with third parties without your explicit consent.

How We Use Your Information

We use your information for the following purposes:

• To provide you with health insights and resources
• To provide and maintain our services
• To personalize your experience with our AI health tools
• To improve our platform and develop new features
• To communicate with you about updates or changes to our services
• To provide customer support
• To detect and prevent fraudulent or unauthorized activity
• To advance responsible innovation in health AI technologies

Data Security

We lock your data down with strong security tools like encryption and strict access checks. Your name and contact details live in a different place from your health information.

When we store your encrypted health details, we also replace your identity with a random code. The list that matches this code to you is kept in a separate, well-protected spot. That way, even if in some extreme scenario someone saw the health data, they wouldn't know it belongs to you, and vice versa if someone saw your identity, they wouldn't see your health data.

Data Sharing

We will never sell your health data. We may share your information in the following limited circumstances:

• With Your Consent: We will only share your personal health data with third parties when you have explicitly consented to such sharing.
• Service Providers: We may share information with trusted service providers who help us operate our platform, but only as necessary to provide our services.
• Legal Requirements: We may disclose information if required by law, regulation, or legal process.

Your Privacy Rights

You have several rights regarding your personal information:

• Access: You can request access to the personal information we hold about you.
• Correction: You can request that we correct inaccurate or incomplete information.
• Deletion: You can request that we delete your personal information.
• Restriction: You can request that we restrict the processing of your information.
• Data Portability: You can request a copy of your data in a structured, commonly used format.
• Objection: You can object to our processing of your personal information.

Data Deletion and Account Management

You are in full control of your data. You can delete individual health entries or profile fields at any time directly from your account dashboard. If you prefer to remove everything, you may permanently delete your account under your profile → Preference Settings. Deleting your account will initiate a cascading deletion of all personal data associated with that account across our systems within 30 days.

Once an item—or your entire account—is deleted, it is removed from our active databases and will no longer be used for any purpose. Back-ups are systematically purged in accordance with our retention schedule to ensure complete erasure.

Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our platform. These technologies help us understand how you use our services, remember your preferences, and improve our offerings. You can control cookie settings through your browser preferences.

Children's Privacy

Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

Mission and Ethics

Our mission is to democratize access to state-of-the-art AI health tools by creating a unified platform that hosts a variety of health, wellness, and mental health models. We empower individuals globally to take control of their health, especially in underserved regions, through ethical data practices and transparent policies. Our ethical approach to data is foundational to everything we do.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated policy on our website or by email.

Governing Law

This Privacy Policy is governed by the laws of Canada. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts located within Canada.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us.

For more detailed information about our platform, please visit our documentation.