Salubase Privacy Policy

Effective Date:

This policy describes how Salubase handles your personal data. It is the data section of our Terms & Privacy Policy, shown on its own, and the two always say the same. Salubase acts as the data controller for your personal data under the General Data Protection Regulation (GDPR).

What We Collect

  • Your email address when you create an account
  • Blood test PDFs you upload for processing
  • Personal details extracted from your PDFs during processing, including age and sex (used to determine appropriate biomarker reference ranges)
  • Usage data such as device type and page interactions

How We Process Your Data

  • Uploaded PDFs are sent to LLM APIs (Google Gemini, OpenAI, or Anthropic) to extract structured biomarker data
  • Extracted personal details (age, sex) are sent to LLM APIs to determine appropriate reference ranges for your biomarkers
  • After successful processing, all intermediate data (raw PDF text, extracted tables, and personal details such as age and sex) is deleted. We retain your measurements, encrypted, and some unencrypted metadata: which markers were measured, the file name, its upload time and a fingerprint of the file used to detect duplicate uploads. Details of a marker that could not be processed stay, unencrypted, with its report until you fix or discard it
  • LLM providers do not use your data for model training and retain it only briefly for abuse monitoring: OpenAI, Google Gemini, Anthropic

Automated Decision-Making

Salubase uses AI language models (LLMs) to automatically extract biomarker data from your uploaded PDFs, match biomarkers to reference ranges, and determine whether values fall within normal ranges. These automated processes determine the data you see in your dashboard.

  • No medical diagnoses or treatment decisions are made — results are informational only
  • You can review all extracted data in the app and contact us at support@salubase.com to request human review of any automated processing

Third-Party Services

  • LLM providers — Google Gemini, OpenAI, Anthropic (PDF data extraction)
  • Supabase — hosting, database, authentication
  • Stripe — payment processing
  • Google Analytics — anonymous usage analytics
  • Resend — transactional email delivery (processing notifications)

Each third-party service processes your data under a Data Processing Agreement (DPA) that governs their obligations as data processors under GDPR Article 28. These agreements include Standard Contractual Clauses (SCCs) for international data transfers:

Data Security

  • Measurement data is encrypted at rest using envelope encryption (AES-256-GCM + X25519 ECDH-ES)
  • Zero-knowledge key architecture — the server never has access to your private decryption key
  • Your data is isolated so that only your account can access it

Data Retention

  • Your data is retained while your account is active
  • All data is fully deleted when you delete your account, including stored PDFs, measurements, and encryption keys, with one exception: we keep de-identified samples of markers that failed processing, so we can fix what went wrong. Each holds the marker's name, units, reference range and error, with the value replaced by a placeholder, and nothing that identifies you or your report

International Transfers

Your data may be processed outside the European Economic Area (EEA) via third-party services based in the United States, including LLM providers (Google, OpenAI, Anthropic), Supabase, and Stripe. These transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the providers' compliance with recognised data protection frameworks.

Lawful Basis for Processing

We process your personal data on the following legal grounds:

  • Explicit consent (GDPR Article 6(1)(a) and Article 9(2)(a)) — Your health data (blood test results, biomarker values, age, and sex) is special category data under GDPR. We process it only with your explicit consent, which you provide at sign-up. You may withdraw your consent at any time (see "Your Rights" below).
  • Contract performance (GDPR Article 6(1)(b)) — Processing your email address, account credentials, and payment information is necessary to provide you with the Salubase service.
  • Legitimate interest (GDPR Article 6(1)(f)) — We collect anonymous usage analytics to improve the service, balanced against your privacy through anonymisation and minimal data collection. This processing does not apply to children — Salubase is not intended for users under the age of 16.

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access — View your data within the app at any time
  • Right to rectification — Request correction of inaccurate personal data
  • Right to erasure — Delete your account and all associated data from the Account section of your dashboard, except the de-identified failed-marker samples described under Data Retention
  • Right to restrict processing — Request that we limit how we use your data
  • Right to data portability — Request your data in a structured, machine-readable format
  • Right to object — Object to processing based on legitimate interest
  • Right to withdraw consent — You may withdraw your consent to health data processing at any time from the Account section of your dashboard. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
  • Right to lodge a complaint — You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data is being processed unlawfully

To exercise any of these rights, contact us at support@salubase.com. We will respond within 30 days.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours as required by GDPR Article 33. If the breach poses a high risk to you, we will also notify you directly without undue delay as required by Article 34, including a description of the breach and the measures taken to address it.

Changes

This policy changes only together with the Terms. Significant changes will be communicated via email.

Contact

For questions about this policy or your data, contact us at support@salubase.com.