Privacy policy
Last updated: 21 August 2026.
A. Introduction
Elixi Ltd provides users access to a mobile application on iOS and Google Android devices (the “Application”) that: (i) collects, aggregates, and analyzes user-provided data, including Health Data, together with data you authorize us to receive from connected third-party sources such as wearable devices; and (ii) on the basis of that Health Data, generates personalized wellness recommendations and educational content across key health domains.
This Data Privacy Policy explains how Elixi Ltd (“Elixi”, “we”, or “us”) collects, processes, and stores your Personal Data in connection with your use of the Application, the Services and our Site. Please note that the definitions of the capitalized terms used throughout this Data Privacy Policy are provided in the Section N.
Which law protects you depends on where you are. We apply the standard of the EU General Data Protection Regulation as our baseline for every user, wherever they are, and the Annexes at the end of this Data Privacy Policy set out what is specific to your region, set out the additional rights and disclosures that apply if you are in the United Kingdom (Annex A) or in the United States (Annex B). Where the law of your country or state gives you more than this baseline, that law applies to you.
Following individuals and organisations oversee our processing:
Role
Identity and contact details
Controller
Elixi Ltd, a company registered in Cyprus under company number HE 491665, with its registered office at Spyrou Kyprianou 50, IRIDA 3, 6th floor, 6057, Larnaca, Cyprus
Privacy contact
support@elixi.com
DPO
Nikita Kondrashov, privacy@elixi.com, Postal: Spyrou Kyprianou 50, IRIDA 3, 6th floor, 6057, Larnaca, Cyprus
UK representative
Nikita Adatia, nikita.adatia@elixi.com
Lead Supervisory Authority
Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, 15 Kypranoros Street, 1061 Nicosia, Cyprus, commissioner@dataprotection.gov.cy, +357 22 818 456
Supervisory Authority for UK
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, +44 303 123 1113
Supervisory Authority for US
Federal Trade Commission, the Attorney General of your State and for California: the California Privacy Protection Agency
Please note that the above contacts do not deal with general inquiries, technical assistance, or questions related to exercise of other rights. Those can be relayed to support@elixi.com.
B. Our commitments and principles
When handling your Personal Data we rely on the following principles:
We do not use your Health Data to advertise to you. Your medical history, results and any health related information is never used for marketing, ours or anyone else’s.
You can export your Health Data or delete it, at any time, from inside the Application, subject only to the limited retention exceptions set out in Section D.
You stay in control of your Personal Data processing. Health features only use your data with your Explicit Consent, and you can withdraw that consent just as easily at any time.
Everyone who can see your Health Data has appropriate training and owes a duty of confidentiality. Access to your Health Data is limited to a narrow circle of individuals who are only allowed to access it if and when their specific employment duties require.
C. Who may use the application
The Services are designed strictly for personal use by individuals who are at least 18 years of age.
Because our Services are not intended for minors, we do not knowingly collect, process, or solicit Personal Data from anyone under the age of 18. Consequently, we do not engage in the processing of Personal Data that would require the consent or authorisation of a parent or legal guardian.
If we have reason to believe or obtain actual knowledge that an individual under the age of 18 has registered an Account or provided us with Personal Data, we will suspend or terminate such Account without undue delay and delete the associated Personal Data in accordance with Section D.
If you are a parent or guardian and believe that a minor has provided us with Personal Data, please contact us immediately at support@elixi.com so we can take appropriate action.
D. Storage of collected personal data
We keep your Personal Data only for as long as it is strictly necessary to fulfil the purposes for which it was collected in accordance with Section G. Considering that the exact retention periods may vary depending on the specific data category, also technical and legal requirements, we determine the storage limits based on the following criteria:
Active Account and Consents: Your Account details are retained for as long as your Account remains active. Your Health Data is retained until you withdraw your Explicit Consent or your Account is closed, after which we initiate the deletion process unless further retention is necessary for compliance with a legal obligation to which we are subject. If you request early access to the Application via our Site, we process your name and email address to provide you with download instructions and relevant updates regarding our official launch.
Statutory and Legal Obligations: Certain data, such as billing and accounting records, are retained for the minimum periods required by applicable tax, accounting, or corporate laws to which we are subject.
Dispute Resolution and Defence of Claims: We may retain support communications and proof of your Consent until the expiration of relevant statutory limitation periods, strictly to establish, exercise, or defend legal claims.
Data exported by You: Any files or data you choose to download or export from the Application are retained by you and are outside of our storage control.
Please note that the indicative periods above apply unless a longer period is required by any law that may be applicable to your Personal Data. At the end of the applicable retention period determined by these criteria, your Personal Data is securely deleted or irreversibly anonymised beyond recovery across all our systems and backups. Where data cannot be deleted immediately for technical reasons, we securely isolate it from any further processing until deletion is technically feasible and in any event we complete deletion within the periods required by applicable consumer health data law.
E. Methods of personal data collection
We collect Personal Data in a variety of ways via the Application and the Site, including:
Function
How we collect the data
What we collect and retain
Application automated data collection
Automatically, while you use the Application
User device model, operating system and version, language, time zone, IP address, which features and screens you open, what you tap, how long sessions last, and errors you hit, camera or photo library (only when you upload something), notifications, biometric unlock, and connected health platforms
Chat within the Application
You type it in
The messages history you send, anything you attach and the responses generated for you in the chat
Connecting a wearable or health platform
Continuous sync
Continuous sync via Application Programming Interface from connected third-party platforms and wearable devices that you explicitly authorize. This data is not obtained directly from you, but from these connected third-party sources and includes only the categories you approve at connection
Medical history record
You type it in
Medical history, conditions and diagnoses, symptoms, medication, allergies, laboratory and test results, biomarker values, measurements you log such as weight, blood pressure, glucose, sleep and activity, lifestyle information such as diet, exercise, alcohol and smoking, documents or images you upload, and anything you write in free-text notes
Sign-up and account creation
You type it in
Name, email, phone number, date of birth, sex or gender where a health feature needs it, country, language, profile photo, and other general information you provide during the Application onboarding, as well as details submitted when requesting early access to the Application via our Site
Subscription purchase
Shared by payment provider
Billing name and address, and your subscription and transaction history
Support request
You type it in
Your message and anything you attach
Uploading a report or photo
Upload and extraction
The file, plus every value the Application reads from it
Most of the Personal Data above comes from you. We also obtain Personal Data about you from sources other than you: from the third-party health platforms and wearable devices you authorise us to connect to, from laboratories, clinics and health professionals where you have asked us to receive results on your behalf, and from our payment and app-marketplace providers in connection with your subscription.
The legal basis on which we process each of the categories above is set out in Section G.
F. Personal data you share with other parties
Some of the Personal Data processed by the Application leaves our secure environment when you explicitly choose to share or export it. While this is entirely your decision, it is important to understand where our legal responsibility as a Controller ends:
i.
Sending records to a doctor, clinic or family member: When you share data with a family member or friend, this is considered a purely personal activity and is not regulated by data protection laws. When you choose to send your data to a healthcare professional, clinic, or medical organisation, that receiving party becomes an independent Controller. Once the data arrives, they decide how it is processed and stored under their own rules and privacy policies. We cannot retrieve, delete, or protect this data for you once it has been transmitted
ii.
Exporting your data: Any file you choose to download or export from the Application is entirely your responsibility to secure. We strongly advise caution, as anyone who gains access to your device or that specific file will have direct access to your highly sensitive Health Data.
iii.
Connecting another app or device: Linking a third-party service or wearable device to the Application means you are authorizing Personal Data to move between that service and Elixi. That service acts as an independent entity and its own privacy policy governs its side of the processing. You maintain control and can disconnect these third-party integrations at any time within the Application settings.
G. Purpose of personal data collection
Every use of Personal Data from our side has a purpose and a legal basis under applicable legislation. Thus, we process your Personal Data only when we have a valid legal reason to do so. Please see below how we use your data:
Health Data: To store your medical history, analyze test results, and provide health-related insights, we rely on your Consent together with your Explicit Consent. You can withdraw this consent at any time within your account settings in the Application, which will stop the processing of this specific data.
Account and support data: We process your Account details (e.g. account data, name, e-mail and billing information) to create and administer your Account and to provide technical assistance. This processing is necessary for the performance of our contract with you in accordance with our Terms and Conditions.
Application improvement, analytics and security: We analyse how the Application is used, fix defects, improve performance and protect the Application against fraud and unauthorised access. This includes the device and usage data listed in the row “Application automated data collection” of the table in Section E. We rely on our legitimate interests in maintaining a secure and functional Service. You may object to this processing at any time, on grounds relating to your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, which will normally be the case for the limited data we need to keep the Application secure and to prevent fraud. Where this processing depends on technologies that are not strictly necessary, it also requires your Consent, as described in Section L.
AI-assisted features: To generate AI-Generated Content we transmit the input the feature needs to our third-party AI providers. Depending on the feature this may include what you type, the documents and images you upload, and data synchronised to your Account from a health platform or wearable device you have connected. Our AI providers may retain limited information where necessary for security, abuse prevention, legal or regulatory requirements. Where the information we send contains Health Data, we rely on your Explicit Consent.
Marketing and communications: We want to keep you informed about our news, new features, and special offers. Based on your Consent, we may send you newsletters or other marketing content. If you ask us for early access of the Application through our Site, we use your name and e-mail address to send you the link to download the Application and a limited number of related messages about the launch. We rely on your Consent, including your consent to receive electronic communications where this is required by applicable law. Providing this data is optional and you may use our Site without it and if you do not provide it, we cannot send you the early access link. Please note that we never use your Health Data for targeted advertising. We use advertising cookies on our Site where you have consented to them. That is described in our Cookie Policy.
Legal obligations and legitimate interests: We process data to maintain a safe environment and comply with the law, including our obligations to detect unauthorized access, prevent fraud, enforce our Terms and Conditions, and establish, exercise, or defend legal claims. Also we process financial and transaction data to keep proper accounting and tax records as required by law.
Please note that processing Health Data is prohibited unless the Explicit Consent is provided by the user. Please note that considering that the core functionality of Application relies entirely on this Health Data, the Application cannot function, and Services cannot be provided to you, without your Explicit Consent.
If we ever want to use your Personal Data for a purpose not listed above, we will first assess whether the new purpose is compatible with the one you originally agreed to. Before that processing begins we will tell you about it and give you the same kind of information you are reading now. Where the new purpose depends on your Consent, we will ask for it separately.
H. Who sees your personal data
Your Personal Data is stored securely on servers located in the territory of the EEA. We protect it with technical and organisational measures appropriate to the risks of processing Health Data, and those measures apply to all of our processing, not only to transfers outside the EEA. In this regard, we may share your Personal Data with:
i.
Our affiliated technology providers and software development hubs, being other companies in our corporate group, which act strictly as our Processors. They build, host, maintain, and support the Application, and process Personal Data solely on the documented instructions of the Controller.
ii.
Hosting and infrastructure providers, which store your data and run the Application environment in the EEA territory, together with providers of related technology, communications, email delivery and backup services that support our operations.
iii.
Our AI providers: We use third-party technology providers to power AI features. Where your data is processed by a third-party AI provider, such processing is carried out strictly under contractual obligations ensuring appropriate security and confidentiality safeguards. These providers are contractually prohibited from using your data to train their own models, and are configured to minimise retention. As described in Section G, they may retain limited information where this is necessary for security, abuse prevention, or to meet a legal or regulatory requirement.
iv.
Specialists and contractors we engage, such as engineering, security, clinical, quality and other personnel working under service agreements, are subject to appropriate confidentiality and data protection obligations before any access is granted. Personnel working with us on an ongoing basis also complete data protection training. External specialists engaged for a specific, limited assignment are bound by equivalent contractual and confidentiality obligations and are given access only to the personal data necessary for that engagement.
v.
Analytics and crash-reporting providers, which tell us what is failing and send us the diagnostic information we need to fix the defect. We rely on our legitimate interests in keeping the Application stable and secure for this, and these providers are configured so that they do not receive the content of your Health Data.
vi.
Payment, billing and app-marketplace providers, (App Store and Google Play), which may process payments, subscriptions, billing, refunds and chargebacks in connection with our Services. These providers do not receive your Health Data. Furthermore, we do not receive your full payment card details as payments are processed directly by these providers.
vii.
Marketing and communications providers, which deliver the messages you have agreed to receive and record whether they were opened. They receive your contact details and engagement data only.
viii.
Advertising partners, which place cookies on our Site where you have consented to them and show you advertisements for us elsewhere. They act as independent controllers in respect of that processing, they operate on the Site only, and they never receive Health Data.
ix.
Laboratories, clinics and health professionals, where you have asked us to make an appointment, send your records to them or to receive results from them, and only for the specific exchange you have instructed.
x.
Professional advisers, such as lawyers, auditors, accountants and insurers, where they need the data for the professional services they provide to us and are bound by professional duties of confidentiality.
xi.
Regulators and other competent authorities, where we are required to report to them under applicable law.
xii.
Courts, law enforcement and public authorities, where we are subject to a legal obligation to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim. We disclose only what is validly and specifically required, we refuse demands that are vague or excessive.
The list above gives general categories. Please write to [support@elixi.com] and we will kindly share which specific legal entities currently receive your Personal Data, what each of them does with it, and where each one is located.
I. Transfer of the personal data to the third countries
Considering that our engineering and support teams operate globally, your Personal Data may be accessed by our affiliated companies and service providers located outside the EEA.
Please note that whenever we transfer your data outside the EEA to countries that do not have an adequacy decision from the European Commission, we ensure your data remains protected by implementing Standard Contractual Clauses (SCCs), approved by the European Commission, along with supplementary technical and organisational measures (such as strict role-based access controls and state-of-the-art encryption) to prevent unauthorized access by third-country public authorities and ensure compliance with the EU level of protection of personal data. We carry out a transfer impact assessment for each destination country before access is granted, and we keep it under review. Access from outside the EEA is remote only and Personal Data is not stored outside the EEA.
Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the EU or a Member State.
Please write to support@elixi.com for a copy of the safeguards we use and the current list of destination countries.
J. Your rights
Please see below the list of your existing rights in relation to the provided/collected Personal Data:
i.
to obtain confirmation as to whether or not your Personal Data is being processed, and, where that is the case, receive a copy of your Personal Data;
ii.
to correct inaccurate data and complete incomplete data;
iii.
to delete your Personal Data;
iv.
to restrict our processing;
v.
to port the Personal Data you provided in a structured, commonly used and machine-readable format; and
vi.
to lodge a complaint with an applicable data protection Supervisory Authority;
vii.
to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, including profiling based on those interests;
viii.
to object at any time to processing of your Personal Data for direct marketing purposes, including profiling related to that marketing;
ix.
not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; and
x.
to be informed of the appropriate safeguards we apply where your Personal Data is transferred outside the EEA, and to obtain a copy of them.
To exercise the above rights, please use the Application settings or submit a request to support@elixi.com. We will act on your request without undue delay and as promptly as possible, and in all cases within one month of receiving it. Where necessary, given the complexity or number of your requests, we may extend this by up to two further months and we will tell you within the first month if we do, and why. If we do not act on your request, we will inform you within one month of the reasons and of your right to lodge a complaint with a supervisory authority or go to court. If we have reasonable doubts about your identity, we may ask for information to confirm it.
Where we rely on your consent, you can withdraw it at any time in the Application settings or please contact support@elixi.com. Withdrawal does not affect the lawfulness of processing before it. If you withdraw consent for Health Data, the features that depend on it will stop working and we delete the data as set out in Section D.
We operate a formal complaints procedure. If you have concerns, you may lodge a complaint with us at any time via support@elixi.com or our DPO directly. You also have the right to lodge a complaint with the Supervisory Authority.
K. Automated decision-making and profiling
We use AI models, including Large Language Model technology, to analyze the Personal Data you explicitly provide in the Application and generate health scores, biomarker explanations, and wellness recommendations (the “AI-Generated Content”). This evaluates personal aspects relating to your health and constitutes profiling under the applicable law.
Please note that we do not take decisions based solely on automated processing that produce legal or similarly significant effects concerning you. All AI-Generated Content is produced by automated software systems without human medical review and is provided for informational purposes only, not as medical diagnosis or advice. The algorithms apply reference ranges derived from published research and our internal models. Because AI outputs are algorithmic predictions, they may occasionally be inaccurate or incomplete and do not determine your access to any medical care, insurance, or employment. Your health scores are calculated from the biomarker values, measurements and history you provide and from data your connected devices send us, compared against reference ranges drawn from published research and AI models. It is not a diagnosis and it does not decide anything about you.
L. Cookies and similar technologies
Our Site uses cookies and similar tracking technologies to support functionality, analytics, security, and user experience. On the Site we also use advertising cookies, but only where you have consented to them.
Some cookies are strictly necessary for the provision of the Service, while the rest, including analytics, functional and advertising cookies, are optional. We request your Consent before placing any non-essential cookie or tracking technology on your device, and those technologies are not initialised before you have made your choice.
We will present you with a consent mechanism when you first use the Application or visit the Site.
You may withdraw or adjust your cookie preferences at any time through your device browser settings. Disabling certain cookies may affect the functionality of the Site.
For further information on the cookies we use, please refer to our Cookie Policy.
M. Data privacy policy amendments
We review this document at least once a year, and whenever the Application, our processing, our markets or the applicable law change materially. The version and date at the top tell which version of the Data Privacy Policy you are looking at.
If we intend to process your Personal Data for a purpose other than those mentioned in this Data Privacy Policy, we will inform you of that purpose and provide the further information before that processing begins, and will ask for your consent where the new purpose requires it.
N. Definitions
Terms
Definition
Account
Every user’s registered profile within the Application that contains basic identification data, which is contractually required to provide the Services in accordance with the Terms and Conditions
AI-Generated Content
Health scores, biomarker explanations, and wellness recommendations produced by automated software systems without human medical review, as well as chat responses in the Application’s chat
Application
The mobile software application for iOS and Android devices, distributed and operated by Elixi, which collects, aggregates, and analyzes Personal Data
Consent
Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her
Controller
The natural or legal person which determines the purposes and means of the processing of Personal Data. For the purposes of the Application and Services, Elixi Ltd acts as the Data Controller
Data Privacy Policy
This document, designed to fulfill the Controller’s transparency and information obligations under applicable law, explaining how Personal Data is collected, processed, and secured
Data Protection Officer (DPO)
The designated independent expert appointed to monitor internal compliance, advise the Controller or Processor, and act as the primary contact point for supervisory authorities and data subjects regarding their privacy rights
Health Data
Personal data related to the physical or mental health of a natural person (user) revealing information about his/her health status. This constitutes “special categories of personal data”, encompassing medical history, test results, biomarker values, and lifestyle information processed by the Application
Explicit Consent
Consent that is given by a clear affirmative act and expressly states that the data subject agrees to the processing of special categories of Personal Data, including Health Data
Personal Data
Any information relating to an identified or identifiable natural person. Within the context of the Application, this encompasses basic account details, device metadata, and special categories of data, including Health Data
Processor
A natural or legal person which processes Personal Data on behalf of the Controller. This includes the technology provider, software developer and engaged engineering or clinical specialists acting strictly under the documented instructions of the Controller
Services
The overall functionalities provided by the Application, including the collection, aggregation, and analysis of Personal Data to generate personalized wellness recommendations and educational content across key health domains
Site
The website operated by us and available at elixi.com
Supervisory Authority
Competent governmental body responsible for monitoring the application of data protection, privacy, and data security laws in the respective jurisdictions where the Application operates. For the purposes of this Data Privacy Policy, this term specifically applies to: (i) in the European Union, any independent public authority established by a Member State pursuant to Article 51 of the GDPR (including the Office of the Commissioner for Personal Data Protection in Cyprus, as the lead supervisory authority for Elixi Ltd); (ii) in the United Kingdom, the Information Commissioner’s Office (ICO) pursuant to the UK GDPR and the Data Protection Act 2018; and (iii) in the United States, any applicable federal or state regulatory body, agency, or Attorney General competent to enforce consumer privacy and data security laws within their respective jurisdiction (such as the Federal Trade Commission or the California Privacy Protection Agency).
Standard Contractual Clauses (SCCs)
Standard data protection clauses adopted by the European Commission, used as a transfer tool providing appropriate safeguards. SCCs, combined with supplementary measures where necessary, legally legitimize cross-border data transfers, ensuring an essentially equivalent level of data protection (if applicable under law)
Terms and Conditions
The legal document governing the use of the Application and the Services by the users, available in the Application, and incorporated into this Data Privacy Policy by reference
Annex A — United Kingdom
This Annex A is applicable for users in England, Scotland, Wales and Northern Ireland. If you are a resident of the United Kingdom, you have rights under the UK General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018. Those rights are substantially the same as the rights described in this Data Privacy Policy. To the extent of any conflict between this Annex A and any other provision of this Data Privacy Policy, this Annex A prevails.
A1. Controller and UK representative
Elixi Ltd is the Controller of your Personal Data. We are not established in the UK territory, so we have appointed a UK representative whom you may contact on any issue relating to the processing of your Personal Data:
Name: Nikita Adatia
Role: Compliance Officer
Email: nikita.adatia@elixi.com
Appointing a representative does not limit any action you may bring against us itself.
You have the right to complain at any time to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, +44 303 123 1113, on issues related to your Personal Data.
A2. Legal bases and your rights
Your Health Data is special category data under UK law, and we process it only on your Explicit Consent.
A3. Transfer out of the UK
The EEA is covered by UK adequacy regulations. Access from outside the EEA is protected by the International Data Transfer Agreement issued by the Information Commissioner, or by the Standard Contractual Clauses (SCCs) together with the UK Addendum, supported in either case by a transfer risk assessment and by the measures in Section I. Please obtain a copy through our UK representative.
A4. Children
While UK law permits children aged 13 or older to provide Consent, Elixi applies a stricter global safety standard. Our Services are strictly limited to individuals aged 18 and over. We do not knowingly process Personal Data of anyone under 18 in the UK.
A5. Marketing
We send you electronic marketing only where you have consented to receive it, except where you have bought a similar product or service from us, did not object at the time and are given a simple means of refusing in every message. Our use of technologies stored on or read from your device is described in Section L.
A6. Automated decision-making
Since the UK has its own rules on automated decision-making, under the UK GDPR, we do not take significant decisions about you based solely on automated processing. If we ever did, and that decision were based entirely or partly on your Health Data, we would take it only with your Explicit Consent. In that case we would tell you that the decision had been made, give you the opportunity to make representations about it, arrange for a person to look at it, and let you contest it.
A7. Complaining to us
We operate a single procedure for all users. You may complain directly to us about how we process your Personal Data, using the procedure described in Section J. We will acknowledge and respond to your complaint within the time required by UK law. This does not affect your right to complain to the Supervisory Authority at any time.
Annex B — United States
If you are a resident of a US state with a comprehensive consumer privacy law or a consumer health data law, the law in your state may give you additional rights. Those states currently include (i) states with a comprehensive consumer privacy law: Arkansas, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia; and (ii) states with a consumer health data law: Washington, Nevada and Connecticut.
The authority competent to receive your complaint about the Personal Data is the Attorney General of your State and in California - the California Privacy Protection Agency.
We are not a covered entity or a business associate under HIPAA, and the Application is not directed to children under 13, so COPPA does not apply to us.
B1. Your rights as a resident of the United States
In addition to the rights described in the Data Privacy Policy, you have the following rights:
i.
To request a copy of the Personal Data we maintain about you, together with the categories of source and of recipient and the purposes we use it for.
ii.
To ask us to delete the Personal Data we hold about you. This covers everything, not only what the Personal Data provided by yourself and includes the data your connected wearables and health platforms sent us, results sent to us by a laboratory or clinic at your request, and the billing data our payment and app-store providers passed to us.
iii.
To ask us to correct inaccuracies in your Personal Data.
iv.
To request for a copy in a portable and, where technically feasible, readily usable format.
v.
To ask to opt out of the sale or sharing of your Personal Data, of processing for targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell Personal Data and we do not profile you in that way. We do share Site browsing data with advertising partners for targeted advertising where you have consented, and you may opt out at any time - in the cookie consent tool, through an opt-out preference signal such as Global Privacy Control, or by writing to us..
vi.
To limit our use and disclosure of your Health Data to what is necessary to provide the Services.
vii.
To withdraw, at any time and separately, your Explicit Consent and your authorisation for us to share it, and ask us to delete it.
viii.
To empower someone to submit a request on your behalf.
ix.
To appeal a decision by which we decline to act on your request, and, if we deny the appeal, to lodge a complaint with the Attorney General of your State.
B2. Exercising your rights
Submit a request either through the Support in the Application or by submitting a request on support@elixi.com. We will respond within the timeframes required by your state law. We will not deny you the Services, charge you a different price, or give you a lower quality of Service because you exercised these rights. If you withdraw your Explicit Consent to the processing of Health Data, the features that analyse it stop working, because that processing is what those features consist of.
B3. Sensitive personal information and users health data
Your Health Data is sensitive personal information under state law. We collect and process this information only with your affirmative opt-in Explicit Consent for each specified purpose. We limit our collection and processing of your Health Data to what is strictly necessary to provide our Services. Please note that because the core functionality of our Application relies on this Health Data, the Application cannot function, and Services cannot be provided to you, without your Explicit Consent. You may withdraw your Explicit Consent at any time or request data deletion in the Application settings or by contacting support@elixi.com.
B4. Provisions specific to users residing in California
At or before the point we collect your Personal Data we tell you which categories we collect, the purposes for which we use each of them, and how long we keep each of them. Since we began providing the Services, and, where applicable, during the preceding 12 months, we have collected the categories of Personal Data set out in the collection table in Section E, from the sources identified there, and for the purposes set out in Section G. We have also disclosed such Personal Data for a business purpose to the categories of recipients set out in Section H.
We have not sold any Personal Data. We have shared Site browsing data with advertising partners for cross-context behavioural advertising where consent was given.
The criteria we use to determine how long we retain each category of Personal Data are set out in Section D.
B5. Provisions specific to users residing in Washington, Nevada and Connecticut
If you are a resident of Washington State, Nevada or Connecticut, your Health Data is “consumer health data” and we are a regulated entity or controller under the applicable law of your state. If you are a resident of Washington State or Nevada, the Consumer Health Data Privacy Policy applicable to you is below, right after this document and is not replaced by this Data Privacy Policy. Connecticut does not require a separate consumer health data policy, so for Connecticut residents this Annex B is that notice.
We ask for your Explicit Consent to collect your consumer health data.
We do not sell consumer health data and we do not share it with advertising partners. We do not use geofencing around any facility that provides health care services.
The categories of consumer health data we collect and the purposes for which we use them, the categories of sources, and the categories of third parties are set out in Sections E, G and H of this Data Privacy Policy, and the specific affiliates with whom we share consumer health data are named individually in the Consumer Health Data Privacy Policy.
You may ask us to delete your consumer health data. We will respond to a request within 45 days of receipt and may extend that period once by a further 45 days when reasonably necessary. We complete a deletion request within 30 days of authenticating it. However, if the consumer health data is stored on archived or backup systems, the request for deletion may be delayed and may take up to six months from authenticating the deletion request. We will notify all affiliates, Processors and other third parties with whom we have shared that data of your request. If we decline your request you may appeal by writing to support@elixi.com and if we deny the appeal you may lodge a complaint with the Washington State Attorney General at www.atg.wa.gov, the Nevada Attorney General at ag.nv.gov, or the Connecticut Attorney General at portal.ct.gov/ag.
B6. Data breaches
If your Personal Data is involved in a security incident, we notify you in accordance with the breach notification law of your state, without unreasonable delay.
We are a vendor of personal health records for the purposes of the Federal Trade Commission’s Health Breach Notification Rule (16 CFR Part 318). Accordingly, where a breach of security involving your unsecured identifiable health information occurs, we will notify you without unreasonable delay and in any event no later than 60 calendar days after we discover the breach. In case the breach involves 500 or more individuals we will notify the Federal Trade Commission at the same time as we notify you and if it involves fewer than 500 individuals we will record it in a log which we submit to the Federal Trade Commission within 60 days of the end of the calendar year. We will notify prominent media outlets where the breach affects 500 or more residents of a State. Our notice will include the information required by that Health Breach Notification Rule (16 CFR Part 318), including what happened, the types of information involved, the steps you can take, what we are doing, and who you can contact.
B7. Processing of personal data outside the US
To provide the Services, we process your Personal Data outside the US territory, including on servers in the EEA. Your data receives the protections described in this Data Privacy Policy, including our security measures and contractual safeguards.
Consumer health data privacy policy
Last updated: 21 August 2026.
A. Introduction
Considering that the Application is used globally, this Consumer Health Data Privacy Policy has been specifically developed to address the requirements of applicable consumer health data laws in Washington and Nevada.
Elixi Ltd, a company registered in Cyprus under company number HE 491665, with its registered office at Spyrou Kyprianou 50, IRIDA 3, 6th floor, 6057, Larnaca, Cyprus (“Elixi”, “we” or “us”), operates and distributes the Application and decides how and why Consumer Health Data is processed.
Elixi Technologies Ltd, a company registered in Cyprus under company number HE 481811, registered office at Spyrou Kyprianou 50, IRIDA 3, 6th Floor, 6057 Larnaca, Cyprus, develops, maintains and supports the Application on our documented instructions.
No other company in our corporate group receives Consumer Health Data.
B. Scope of this policy
This Consumer Health Data Privacy Policy explains how we handle Consumer Health Data when you use the Application. It is provided under the Washington My Health My Data Act (RCW chapter 19.373) and the Nevada consumer health data law (Senate Bill 370 (2023), codified within NRS chapter 603A and applies if you are a resident of Washington or Nevada, or if your Consumer Health Data is collected in either of those states.
“Consumer Health Data” means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status, as those laws define and includes the Health Data described in our Data Privacy Policy.
Capitalised terms that are not defined here have the meaning given to them in our Data Privacy Policy. This policy supplements our Data Privacy Policy, and where the two conflict in relation to Consumer Health Data, this policy prevails.
C. Consumer health data we collect
When you use the Application, we collect health and wellness information you choose to provide, including:
i.
Health and medical history, including family medical history, prior conditions, and information about healthcare services you have received or are seeking.
ii.
Self-reported biomarker values and laboratory results, such as cholesterol, blood glucose, and blood pressure readings you enter manually.
iii.
Lifestyle and wellness information, including activity levels, sleep patterns, dietary habits, and other health-related behaviours.
iv.
Other information about your physical or mental health that you choose to provide to the AI features of the Application, including anything you write in free-text notes.
v.
Demographic information, such as age and biological sex, to the extent used to provide the health screening information described in Section D.
vi.
Data you explicitly authorize us to receive from connected third-party sources, such as wearable devices and health platforms.
We also generate derived health information from what you provide, including your health scores, system-specific health sub-scores, and the personalised wellness recommendations and educational content we describe in our Data Privacy Policy as AI-Generated Content. This derived information is Consumer Health Data.
Sources of Consumer Health Data: We collect Consumer Health Data directly from you; from third-party services, devices or health platforms that you choose to connect to the Application or authorise to provide information to us; and from information that we generate, infer or derive from the information described above, including through the Application’s automated features.
D. How we use your consumer health data
We use the information you provide to deliver the Services to you, including to generate your health scores and health sub-scores, provide personalised wellness insights and recommended actions, provide relevant health screening information based on your age and biological sex, and enable the AI Assistant to respond to your health queries in context.
We also use your Consumer Health Data to communicate with you and provide customer support, detect and prevent fraud and misuse of our services, and comply with our legal obligations.
Your Consumer Health Data is processed electronically on our systems, which are hosted in the European Union, and on the systems of the service providers described in Section E, using automated tools to generate your health scores, health sub-scores and personalised insights. It is encrypted in transit and at rest. Access is limited to personnel who need it for a specific task, and that access is logged.
We use Consumer Health Data to enable these automated tools, including the AI Assistant, to generate the outputs described above. You may withdraw this consent at any time (see Section G).
E. Disclosure of consumer health data
The categories of Consumer Health Data we share are those described in Section C. We share them only so far as is necessary to provide the Services to you, or where you instruct us to, with the following categories of third parties:
i.
Cloud hosting and infrastructure providers;
ii.
AI providers, which receive pseudonymised input only.
iii.
Engineering, security, clinical, quality and support specialists engaged under service agreements.
iv.
Laboratories, clinics and health professionals, and then only for the specific exchange you instruct.
v.
Professional advisers who are bound by duties of confidentiality.
vi.
Regulators and competent authorities where we are required to report to them.
vii.
Courts, law enforcement and public authorities where we are under a legal obligation to disclose.
Each of our service providers processes Consumer Health Data only on our documented instructions under a written contract. We do not share Consumer Health Data with analytics, crash-reporting, marketing, payment or app-store providers.
The specific affiliate with whom we share Consumer Health Data is Elixi Technologies Ltd, including its branch in the Dubai International Financial Centre, which develops, maintains, supports and secures the Application as our Processor. Its personnel, including personnel of the DIFC branch, have controlled, logged and role-limited access. No other company in our corporate group receives Consumer Health Data.
We do not sell Consumer Health Data. We do not share Consumer Health Data with third parties for their own purposes without your separate authorisation.
Third parties do not collect Consumer Health Data about you across other websites or online services through the Application.
F. Your rights
Please be informed that you have the right to:
i.
Confirm whether we collect, share or sell your Consumer Health Data and to access it
ii.
Obtain a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data, together with an active email address or other online mechanism you can use to contact each of them
iii.
Withdraw your consent to our collection of your Consumer Health Data and separately, to our sharing of it
iv.
Require us to cease collecting, sharing or selling it
v.
Have it deleted
vi.
Review your Consumer Health Data and request that we correct it if it is inaccurate
To appeal if we decline to act on your request, as described in Section G.
We will not discriminate against you for exercising these rights.
G. How to exercise your rights
You can submit a request through the Application settings, by emailing support@elixi.com, or by writing to us at:
Spyrou Kyprianou 50 IRIDA 3, 6th floor 6057, Larnaca, Cyprus
We will respond to your request without undue delay and, in any event, within 45 days of receipt. We may extend this period once by a further 45 days where reasonably necessary, taking into account the complexity and number of your requests; if we do, we will tell you within the initial 45-day period and explain why. Under Nevada law, we will complete a deletion request within 30 days of authenticating it. Where your Consumer Health Data is held in backup or archived systems, deletion may take up to 6 months to complete.
Responding to your requests is free of charge at least twice a year. If a request is manifestly unfounded, excessive or repetitive we may charge a reasonable fee to cover our administrative costs, or decline to act on it, and the burden of showing that a request is of that kind rests on us.
We will not require you to create a new account to submit a request.
If we decline to act on your request, you may appeal by submitting a written appeal to the contact details above. We will inform you of the outcome in writing within 45 days of receiving your appeal, including the reasons for our decision. If we do not uphold your appeal, we will also provide you with information on how to contact the Washington State Attorney General or the Nevada Attorney General to submit a complaint.
H. Consumer health data privacy policy amendments
We may update this Consumer Health Data Privacy Policy from time to time. When we make material changes – including to the categories of data we collect, how we use it, or with whom we share it – we will notify you in advance by email or in-Application notification before the changes take effect. We will publish the updated Consumer Health Data Privacy Policy with a new effective date.