Privacy policy

This privacy policy explains how Oligo Analytics collects, uses and protects your data and the data you upload.

1. Data we collect

Account and profile data

Name, email address, professional details, password (stored hashed), preferences and settings you configure.

Patient and health data

Data that a practitioner enters or uploads about their patients, including mineral exam values, patient identifiers, and any notes. This may constitute special-category / sensitive health data and is treated with heightened protection.

Billing data

Subscription plan, transaction records and limited payment metadata. Card details are handled directly by our payment processor and are not stored on our servers.

Usage and technical data

Log data, device and browser information, IP address and interactions with the Service, collected to keep the platform secure and reliable.

2. Legal bases for processing

• Contract: to create your account and provide the Service you subscribe to.
• Legitimate interests: to secure, maintain and improve the Service, prevent abuse and communicate essential updates.
• Consent: for optional analytics cookies and certain marketing communications, which you can withdraw at any time.
• Legal obligation: to comply with tax, accounting and other legal requirements.

For patient health data, the practitioner (as controller) is responsible for establishing the appropriate legal basis and, where required, obtaining the patient's informed consent before uploading data to the Service.

3. How we use data

• to provide account access, patient management and exam management;
• to generate AI wellness evaluations and narratives across the detox, hormonal, energy and antiaging axes;
• to process subscriptions and payments;
• to provide support and respond to your requests;
• to secure, monitor and improve the Service;
• to meet legal and regulatory obligations.

4. AI processing and sub-processors

To generate interpretations, the Service sends exam-derived inputs to trusted AI processing providers, such as OpenAI, acting as our sub-processors under contractual data-protection commitments. We apply data-minimization measures so that only the information necessary to produce a wellness evaluation is processed, and we do not permit these providers to use your data to train their general-purpose models. AI outputs are wellness insights only and are described further in our Terms of Use.

5. Sharing and international transfers

We share data only with sub-processors that help us operate the Service, including cloud hosting, AI processing and payment processing, and only as needed to deliver the Service. We do not sell personal data. Where data is transferred outside your region, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

6. Storage and security

Data is stored on secure infrastructure with access controls, encryption in transit and at rest where applicable, hashed credentials, network protections and regular monitoring. No system is perfectly secure, but we maintain organizational and technical measures designed to protect your data against unauthorized access, loss or misuse.

7. Data retention

We retain account and patient data for as long as your account is active and as needed to provide the Service. When you delete data or close your account, we delete or anonymize personal data within a reasonable period, except where retention is required for legal, accounting or security purposes. Practitioners can delete individual patient and exam records at any time from within the platform.

8. Your rights

Subject to applicable law, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data;
• restrict or object to certain processing;
• request portability of data you provided;
• withdraw consent where processing is based on consent;
• lodge a complaint with your data-protection authority.

If you are a patient whose data was uploaded by a practitioner, please direct requests to that practitioner as controller; we will support them in fulfilling your request.

9. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage non-essential cookies at any time.

10. Data Protection Officer and contact

You can exercise your rights or ask questions about this Policy by contacting our Data Protection Officer at dpo@oligoanalytics.com, or by post to Aurea Medtech, [Aurea Medtech registered address]. Aurea Medtech company registration: [registration number].

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you through the Service.