HealthSpan privacy notice
Last updated 15 October 2026. Version 1.2.
This notice explains what HealthSpan (healthspan.medicus.ai) does with your data. It covers people who use HealthSpan directly. If you use HealthSpan through a clinic, lab or employer, that organization is responsible for your data and its own privacy notice applies.
Who is responsible
Medicus AI FlexCo, Wehleweg 9 / Top 53, 1030 Vienna, Austria. Company register number FN 458726y, Handelsgericht Wien.
Contact for anything about your data: dataprivacy@medicus.ai.
What we collect
- Your account: name and email, held by Medicus's sign-in service. The name you give is also stored with your report and appears on it.
- Your questionnaire answers, including answers in progress.
- Profile details: date of birth, sex, height, weight and ethnicity. Ethnicity is used for reference ranges and risk models.
- Previous answers when you change one, so we can show how your answers change over time.
- Lab reports you upload (the file itself) and the values read from them, or values you type in.
- The report we generate for you, and a PDF copy of it.
- Which recommendations you view and act on, only if you have given consent for this.
- On your device: a sign-in cookie, and a copy of your unfinished answers in your browser so you do not lose them if your session ends.
This includes health data and data about ethnic origin, which the GDPR treats as special categories.
What we use it for
To generate and show your HealthSpan report and action plan, to read the values from lab files you upload, to keep your answers between visits, and to show you your history. We do not sell your data and do not use it for advertising.
With your separate permission, we also use your answers and reports, with your name and contact details removed, to improve HealthSpan's scoring and content. This is optional, it does not affect your report, and you can say no or change your mind at any time on the Privacy and consent page. We do not use your data to train AI models.
Our legal basis
Your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) GDPR. You can withdraw it at any time on the Privacy and consent page in your profile. Withdrawal stops us storing new data and generating reports from that point.
Who processes your data for us
- Supabase stores your answers, profile, reports and uploaded files, in the EU (Ireland). We have a data processing agreement with Supabase.
- Vercel runs the application. Our servers run in Dublin, Ireland, and requests pass through Vercel's network. Vercel Inc. is a US company. We have a data processing agreement with Vercel, with the EU Standard Contractual Clauses for any transfer outside the EU.
- Anthropic provides the AI model that writes parts of your report and reads values from uploaded lab files. To do this we send it your answers, your lab values, the lab file itself and the name you gave. Anthropic PBC is a US company and the processing may take place outside the EU. We have a data processing agreement with Anthropic, with the EU Standard Contractual Clauses for the transfer.
- Medicus sign-in service (Medicus IAM) handles your account and records your consent choices.
- PräNUDGE, only if you choose to connect it on the Connections page: we send the lab values you choose to share with PräNUDGE, which then processes them under its own privacy notice.
Nobody else receives your data, unless the law requires us to disclose it.
How long we keep it
For as long as you have an account. We do not delete data on a timer. When you delete your account, we delete your account and the data HealthSpan holds about you.
Your rights
- See and download your data: "Download my data" on your profile gives you a file of everything HealthSpan stores about you, including your uploaded lab files.
- Correct it: edit your answers and profile details on your profile.
- Delete it: "Delete account" on your profile deletes your account and your HealthSpan data.
- Withdraw consent: on the Privacy and consent page.
- You can also ask us to restrict processing or object to it, by writing to the contact above.
- You can complain to a data protection authority. In Austria that is the Datenschutzbehörde (dsb.gv.at).
Automated processing
Your report is generated automatically from your answers and lab values. It has no legal effect and makes no decision about you, and it is not medical advice. Please talk to a doctor about any health concern.
Age
HealthSpan is for people aged 18 and over.
Changes
If we change this notice in a way that affects you, we will tell you in the app before it applies.