Healthidia Policy

1. Operator and purpose

Healthidia is operated by ASM Professional Services, registered in the Netherlands (KVK 42137630; VAT ID NL005526019B33). Its intended purpose is patient-controlled storage, organisation and retrieval of existing personal health information: laboratory reports, imaging and cardiology reports, prescriptions, medication records, medical history and measurements. Tables, charts and downloadable summaries help organise records; users choose whether to show or forward their copies to their own healthcare professional.

This notice supplements the Terms of Service, Privacy Policy, Medical Disclaimer and AI Disclaimer. It does not replace them or override mandatory law.

2. Adults only and personal records only

Account holders must be at least 18 years old and confirm this separately during registration or first-use onboarding. Healthidia is not offered to children or for maintaining children’s records. Accounts are for your own health information, not another person’s records, a clinic’s patient files or a professional care service. Age confirmation is not medical consent or proof of legal capacity in every jurisdiction.

3. No clinical services or professional relationship

No doctor, nurse, pharmacist or other healthcare professional participates in Healthidia’s record processing or reviews entries. Healthidia does not provide consultations, diagnosis, treatment, prescriptions, symptom triage, medication recommendations or emergency monitoring. Using the platform does not establish a clinician–patient relationship. A subscription buys access to recordkeeping functions, not healthcare or professional advice.

Do not use records, ranges, colours, labels, trends or summaries to make treatment decisions. Keep original documents, check Manual and Edited entries against their sources, and consult a qualified healthcare professional for interpretation. In an emergency, contact your local emergency services; Healthidia is not an emergency service.

4. Medical-device and healthcare licensing assessment

Describing a product as recordkeeping-only does not automatically exempt it from medical-device or healthcare law. Classification depends on its intended purpose, actual functions, outputs, promotional claims and applicable national rules. In the EU, software intended for a medical purpose may fall within Regulation (EU) 2017/745; software that supplies information for diagnostic or therapeutic decisions requires particular scrutiny, including the classification rules where applicable.

Before reopening, a competent regulatory adviser must assess the actual charts, reference ranges, glucose attention labels, pattern analysis, automated extraction and report outputs—not merely this disclaimer. If a function requires conformity assessment, registration, authorisation, a licensed provider or other safeguards, the operator must meet those requirements or remove or restrict the function before offering it in that market. This notice does not assert CE marking, medical-device clearance or a healthcare-service licence.

5. Health data remains specially protected

Patient-entered information and uploaded reports can be special-category health data even when no clinician is involved. Where GDPR applies, processing requires both an appropriate Article 6 legal basis and an applicable Article 9 condition. Healthidia’s stated basis for health-record processing is explicit consent under Article 9(2)(a), alongside the Article 6 bases described in the Privacy Policy. Consent must be valid, informed and withdrawable; it cannot waive statutory duties or a provider’s restrictions.

The operator must verify processor agreements, security appropriate to risk, data minimisation, retention, access/export/deletion procedures and incident response. Records of processing and a data protection impact assessment are required where the applicable GDPR criteria are met; DPO requirements also need assessment. GDPR compliance is an ongoing responsibility, not established by publishing policies or obtaining user consent.

6. Hosting, AI and international transfers

The configured application database, file storage and authentication region is EU West (Ireland), and EU processing is the preference. This does not establish EU-only storage or processing across backups, logs, support access, delivery networks, email or AI subprocessors. Complete service-specific locations, health-data eligibility, retention and contractual safeguards have not yet been verified. International processing, including by US-linked providers, must not be treated as excluded.

Health-document AI reading is disabled and new health uploads and record changes remain blocked during the protection hold. No health AI should resume until provider permission, processing locations, subprocessor access and required transfer safeguards have been verified. Where GDPR Chapter V applies, any transfer needs a lawful transfer mechanism and the additional assessment and safeguards required in the circumstances. EU hosting alone does not settle remote-access or onward-transfer obligations.

AI, if later approved, is limited to transcribing existing information for the user to check; it is not a clinician or an independent medical opinion. Dutch/EU tax treatment, company jurisdiction and data-processing location are separate matters. This notice changes neither VAT-inclusive plan prices nor Stripe billing and invoices.

7. Country-specific requirements

A website being reachable, displaying a local currency or accepting an adult user does not establish permission to offer the service in that country. The operator must assess target markets before activation and limit availability when required. Examples needing specialist review—not a complete list—include:

• EU/EEA and the Netherlands: GDPR, national health-data rules, applicable medical-device requirements and mandatory consumer protections.
• France: whether the particular hosting arrangement and collection context fall within French health-data hosting (HDS) certification requirements. No HDS certification is claimed.
• United Arab Emirates: applicability of Federal Law No. 2 of 2019 on ICT in health fields, relevant health authorities’ rules and restrictions on cross-border health-data processing. No exemption or transfer permission is claimed.
• United States: HIPAA applies to covered entities and business associates in specified circumstances, not automatically to every consumer health app. Even if HIPAA does not apply, FTC rules, including the Health Breach Notification Rule where applicable, and state privacy or consumer-health-data laws may apply.
• Other countries: local privacy, residency, professional licensing, software/device, accessibility and consumer rules must be reviewed as applicable.

Healthidia does not claim worldwide licensing, HIPAA compliance, HDS certification, GDPR certification, ISO 27001 certification or SOC 2 assurance. Silence about a country is not evidence of approval. Users’ responsibilities do not transfer the operator’s legal obligations to them.

8. Current status and conditions for reopening

As of this notice’s date, the operator has taken the live site offline and is awaiting written provider confirmation. This page does not reopen the service or remove the health-data protection hold. Before reopening, the operator must obtain and document:

1. Provider permission for this health-data use and binding processor terms.
2. A verified map of storage, backups, authentication, AI, logs and subprocessors, including access, retention and international transfers.
3. Required privacy, transfer, security and impact assessments and a review of past processing.
4. Function-specific medical-regulatory and target-country advice, with any required approvals or restrictions implemented.
5. Tested access controls, consent, rights delivery, deletion and incident procedures, accurate notices and explicit operator approval to reopen.

In-app report email remains disabled. For access, export, deletion or billing assistance, contact support without attaching health documents. Unpublishing does not itself delete existing records or cancel subscriptions. Your mandatory privacy and consumer rights remain intact.

9. Official references and limitations

These primary sources support the general framework, not a legal determination about Healthidia. Applicability, current amendments and national implementation must be checked by the operator’s qualified advisers before launch.

• EU General Data Protection Regulation — Articles 6, 9, 28, 30, 32–37 and Chapter V.
• EU Medical Device Regulation — intended purpose and Annex VIII classification rules.
• European Commission: MDCG medical-device software guidance — non-binding qualification and classification guidance.
• France’s Agence du Numérique en Santé: HDS.
• UAE Federal Law No. 2 of 2019 on ICT in health fields.
• US HHS: HIPAA covered entities and business associates.
• US FTC: Health Breach Notification Rule.

10. Contact and updates

Send regulatory, eligibility or privacy questions to support@healthidia.com. Do not include health records in ordinary support emails. For GDPR complaints, you may contact the Dutch Autoriteit Persoonsgegevens or your competent supervisory authority. Material changes to scope or regulatory status require an updated notice; this text is not a substitute for independent legal review.