Last updated September 25, 2026
This Privacy Notice for Haloscan, LLC ("we," "us," or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:
Who is responsible for your information. Haloscan, LLC, a limited liability company registered in the United States, is the controller of the personal information described in this notice — meaning the company that decides why it is collected and what happens to it. Contact details are in section 16.
Questions or concerns? If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at qassi@haloscan.co.
If you are a resident of Washington, Nevada, or another state with a consumer health data law, please also read our Consumer Health Data Privacy Policy.
What personal information do we process? Health information you enter — lab results, symptoms, medications and doses — together with your account details and technical information about your device.
Do we process sensitive personal information? Yes. Haloscan exists to store health data, which is "special category" data under UK and EU law and "sensitive" under US state laws. We process it to provide the Services to you, on the basis set out in section 3.
Do we collect information from third parties? Yes, in two narrow cases: subscription status from our payment provider, and your email address from our waitlist provider if you joined the waitlist.
Do we sell your information? No. We do not sell or share personal information, and we do not use health information for advertising.
How do you exercise your rights? In the app, you can export all of your data as a CSV file and delete your account and everything attached to it, with or without a subscription. You can also contact us at qassi@haloscan.co.
We process the following categories of sensitive information in order to provide the Services:
Subscriptions are purchased and billed by the Apple App Store or Google Play. We do not receive or store your payment card details. Our subscription provider, RevenueCat, gives us your subscription and entitlement status only. Their privacy notices: Apple, Google, RevenueCat.
If you use our application, we may collect the following where you grant permission:
We do not collect precise location data. We do not ask for location permission and we do not derive your location from your IP address.
We receive information about you from two sources, and no others:
We do not buy personal information, and we do not obtain it from public databases, data brokers, marketing partners, or social media platforms.
If you are located in the EU or UK, this section applies to you.
We rely on the following bases under Article 6:
Health information is special category data. In addition to a basis above, we rely on your explicit consent under Article 9(2)(a) to process it. You give that consent when you set up your account, and you can withdraw it at any time by deleting your account in Settings — which deletes your health information with it.
We never rely on legitimate interests to process health information.
We share your information with service providers who perform services for us and require access to do that work. We have contracts in place with each of them. They cannot use your information for their own purposes, cannot share it with anyone but us, and must retain it only for the period we instruct.
| Purpose | Provider | What they receive |
|---|---|---|
| Hosting and database | Supabase, Inc. | The information you enter, including your email address if you joined the waitlist, stored in the United States |
| AI — report wording | Anthropic, PBC | Figures and findings the app has already computed. Not your raw lab history or symptom logs |
| AI — reading lab reports | Google LLC | The photograph or file of the lab report you upload, for transcription only |
| Subscriptions | Apple App Store, Google Play, RevenueCat, Inc. | Purchase and entitlement status |
| Product analytics | PostHog, Inc. | Which features you use, and your ratings and multiple-choice answers to in-app surveys — only where you have turned analytics on. Never your results, symptoms, doses, notes or feedback messages, and never a recording of your screen |
| Website hosting | Netlify, Inc. | Server logs for our website |
| Waitlist and email | Launchlist | Your email address, if you joined the waitlist |
We may also share your information in connection with a business transfer — any merger, sale of assets, financing, or acquisition of all or part of our business.
We do not sell or share personal information, and we do not disclose it to advertisers, data brokers, employers or insurers.
We use only cookies and similar technologies that are necessary to operate our website and keep your account secure — for example, to keep you signed in and to remember your preferences.
We do not permit advertising technologies on our Services. We do not use cookies for targeted advertising, and we do not allow third parties to do so.
Two features in the Services use artificial intelligence:
Both features run only when you choose to use them. You can type lab results in manually instead of photographing a report, in which case no image is sent for transcription. The report's questions are generated only when you tap to create a report.
Neither feature makes decisions about you, and neither is used for profiling.
Our servers are located in the United States. Your information may be transferred to, stored by, and processed in the United States and in the facilities of the third parties listed in section 4.
If you are resident in the European Economic Area, the United Kingdom, or Switzerland, these countries may not have data protection laws as comprehensive as those in your own. We rely on the European Commission's Standard Contractual Clauses, and their UK equivalent, for transfers between us and our third-party providers. Copies can be provided on request.
We keep the information you enter for as long as you have an account with us.
Where we cannot immediately delete information — for example because it is held in a backup archive — we securely store it and isolate it from any further processing until deletion is possible.
We implement appropriate technical and organisational security measures, including:
However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Although we do our best to protect your personal information, transmission to and from our Services is at your own risk.
We do not knowingly collect data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18. If we learn that personal information from a user under 18 has been collected, we will deactivate the account and promptly delete the data. If you become aware of any such data, please contact us at qassi@haloscan.co.
Depending on where you live, you may have the right to access your personal information, obtain a copy of it, correct inaccuracies, request its deletion, restrict or object to processing, and withdraw consent.
| Right | How |
|---|---|
| Access and portability | Export all of your data as a CSV file from Settings. This works with or without a subscription. |
| Erasure | Delete your account in Settings. This removes everything attached to it. |
| Withdraw consent | Turn off analytics or marketing in Settings. Both are off by default. To withdraw consent to processing your health information, delete your account in Settings — this removes that information. |
| Anything else | Email qassi@haloscan.co |
A note on accounts without an email address. If you use the Services without signing in, we hold no information that lets us verify who you are. We may therefore be unable to act on a request made by email about such an account. The in-app export and delete controls work regardless.
If you are located in the UK and are unhappy with how we have handled your personal information, you can complain to us at qassi@haloscan.co. We will acknowledge within 30 days, investigate without undue delay, and explain the outcome. If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113).
If you are located in the EEA, you may complain to your Member State data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any marketing email we send, by turning marketing emails off in Settings, or by contacting us. This setting is off unless you have switched it on. We may still send service messages necessary for the administration of your account.
No uniform standard for Do-Not-Track signals has been finalised, and we do not currently respond to them.
Global Privacy Control is a signal to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing for that signal to switch off.
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and details about the personal information we maintain about you, correct inaccuracies, obtain a copy of it, or delete it. You may also withdraw consent to processing.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, online identifier, IP address, email address, account name | YES |
| B. Personal information under the California Customer Records statute | Name, contact information, medical information | YES |
| C. Protected classification characteristics | Gender, age, date of birth, race, national origin, marital status | NO |
| D. Commercial information | Transaction information, purchase history | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other network activity | Interactions with our application and website | YES |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory, or similar information | Photographs of lab reports that you upload | YES |
| I. Professional or employment-related information | Job title, work history | NO |
| J. Education information | Student records | NO |
| K. Inferences drawn from collected personal information | Patterns between your symptoms and your lab markers | YES |
| L. Sensitive personal information | Health data, use of prescribed medication, reproductive health information | YES |
About category K. The only inferences we draw are patterns between your own symptoms and your own lab results, shown to you inside the app. We do not use them to target advertising, to segment users, or to make decisions about you. Every pattern is displayed with the number of observations behind it, and nothing is presented as a pattern on insufficient data.
About category L. We process sensitive personal information only to provide the Services or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.
We retain information in each of the categories above for as long as you have an account with us, as described in section 8.
We have not sold or shared any personal information in the preceding twelve months, and we will not do so. We have disclosed categories A, B, D, F, H, K and L to the service providers listed in section 4, for the business purposes described there, under written contract.
To exercise these rights, use the in-app controls described in section 11 or email qassi@haloscan.co. You may designate an authorized agent, who must provide proof of authorization.
Verification. We need to verify your identity before acting on a request. We use only the information provided in your request for that purpose. Where we cannot verify your identity from information we already hold — which is the case for accounts created without an email address — we may be unable to proceed, and will tell you so.
Appeals. If we decline to act on your request, you may appeal by emailing qassi@haloscan.co. We will respond in writing with our reasons. If your appeal is denied, you may complain to your state attorney general.
California residents may request, once a year and free of charge, information about the categories of personal information we disclosed to third parties for direct marketing purposes in the preceding calendar year. We disclose no personal information for third-party direct marketing purposes.
We collect and process your personal information under Australia's Privacy Act 1988. This Privacy Notice satisfies the notice requirements of that Act. You have the right to request access to or correction of your personal information by contacting us. If you believe we are unlawfully processing your personal information, you may complain to the Office of the Australian Information Commissioner.
Yes. The updated version is indicated by a revised date at the top. If we make material changes to how we handle your information, we will notify you directly and ask you to review the change before continuing to use the Services.
Haloscan, LLC 26787 Agoura Rd Ste E8 PMB 1134 Calabasas, CA 91302 United States qassi@haloscan.co
Use the export and delete controls in Settings, or email qassi@haloscan.co.