privacy policy.

1. Introduction

Healthy Canary Limited (“Healthy Canary,” “we,” “us,” or “our”) provides a preventive health intelligence platform that helps individuals understand their health and helps employers support workforce wellbeing through aggregated insights from which no individual can be identified.

We treat the protection of your personal data — and especially your health data — as fundamental to our relationship with you. Health data is among the most sensitive categories of personal data under the EU General Data Protection Regulation (GDPR), and we handle it accordingly. This policy explains what data we process, why, on what legal basis, how we protect it, and the rights you have over it.

This policy applies to every individual who uses the Healthy Canary platform, whether you joined directly or through an employer that offers Healthy Canary as a benefit. Using Healthy Canary is voluntary: you choose whether to join, and you can withdraw at any time.

Healthy Canary is intended for use by adults in a workplace setting. The platform is not directed to children, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has used the platform, contact our Data Protection Officer and we will take appropriate steps.

2. Who we are (data controller)

Healthy Canary Limited is the data controller responsible for the personal data processed through the platform. We are a private limited company registered in Ireland.

Data Protection Officer: privacy@healthycanary.com

We have appointed a Data Protection Officer because of the scale and sensitivity of the health data we process. You may contact the DPO at any time with questions about this policy, to exercise your rights, or to raise a concern.

Where your employer provides Healthy Canary as a benefit, your employer is a separate, independent controller for the limited enrolment and eligibility data it uses to offer you the benefit. Healthy Canary is the sole controller of the health data you provide or generate through the platform, and your employer has no access to it (see Section 6).

Our lead supervisory authority is the Data Protection Commission (Ireland), and you may also contact the authority in your country of residence (see Section 11).

3. The data we process

Account data you provide. Your name, email address, and password (stored only in hashed form) — the information needed to create and secure your account.

Health data you provide or connect. This is special category data under Article 9 of the GDPR and receives our highest level of protection. It includes: biomarker and laboratory results you upload or that are delivered through our certified laboratory partners; metrics from wearable devices you choose to connect (such as heart-rate variability, sleep and recovery data from WHOOP or other supported devices); your responses to wellbeing check-ins; supplement and protocol adherence you log; and records of any interactions with clinicians or psychologists arranged through the platform.

Usage and technical data. Operational logs including page and feature usage, device and browser type, and error logs — used to run, secure and improve the platform.

What we do not collect. We do not collect precise geolocation. We do not track you across other websites or services. We do not buy personal data about you from data brokers. We do not use your health data for advertising, and we do not sell your data.

4. How we use your data and our legal basis

We process your personal data only where we have a valid legal basis under the GDPR. Because health data is special category data, we also identify a condition under Article 9.

Your consent is voluntary and free. You join Healthy Canary as an individual, and your consent is the basis on which we process your health data. Your employer cannot require you to join, cannot see whether you have joined or declined, and your choice has no effect on your employment — no benefit is withheld and no disadvantage follows from declining or withdrawing. This is what makes your consent freely given.

You can withdraw at any time. You may withdraw any consent in Settings → Privacy and consent, or by contacting the DPO. Withdrawal does not affect the lawfulness of processing carried out beforehand. Where you withdraw consent for a feature that depends on health data, that feature will no longer be available to you.

Where we rely on legitimate interests, we have balanced those interests against your rights and can provide our assessment on request.

5. Automated processing, profiling and AI insights

Healthy Canary uses algorithms and AI models to turn your data into health insights, trends and indicators — for example, recovery and capacity signals drawn from your wearable, check-in and biomarker data. Our AI insights are processed under a data processing agreement and are not used to train any AI model, ours or a third party's.

These insights are decision-support, not decisions. They are designed to inform you — and, where you have requested it, a clinician — not to make decisions about you automatically. We do not make decisions about you that are based solely on automated processing and that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR. Insights are never a diagnosis or medical advice, and they are never shared with your employer at an individual level.

You can ask us for meaningful information about the logic involved in an insight, request human review of it, and contest it. Contact the DPO to do so.

6. How your data is shared

Where your employer offers Healthy Canary as a benefit, the following apply without exception.

Your individual health data is never shared with your employer. Your employer cannot see your biomarker results, your check-in responses, your wellbeing or capacity scores, your clinician or psychologist interactions, or anything else that identifies you.

Employers receive only aggregated signals from which no individual can be identified. For example, an employer may see that strain indicators are elevated within a team, as a group-level trend. Employers never receive data about an identifiable individual, and never an individual score.

A minimum group size is enforced in the database. We do not display any cohort signal unless the group contains at least 5 enrolled individuals, so that no person can be identified or singled out by inference. This threshold is enforced technically (by row-level security in the database), not merely as policy.

You control this consent. Any consent for your data to contribute to aggregated workforce reporting can be reviewed and revoked at any time in Settings → Privacy and consent. Revoking it removes your data from future aggregate reporting.

Clinical and laboratory partners. Certified laboratory partners analyse your samples as our processors, under a data processing agreement. Clinicians and psychologists you consult through the platform act as independent controllers for the clinical records they create and are bound by their own professional duty of confidentiality. We share your data with these partners only to the extent needed to deliver the service you have requested, and only with your consent.

7. Data storage, location and security

Location. All personal data is stored and processed within the European Union, on servers in Frankfurt, Germany. We do not transfer personal data outside the European Economic Area except where a specific processor requires it, with the safeguards described in Section 8.

Encryption. Data is encrypted at rest using AES-256 and in transit using TLS 1.3.

Access controls. Access to personal data is restricted to authorised personnel on a strict need-to-know basis, protected by multi-factor authentication and logged for audit. Special category health data is subject to additional access restrictions.

Organisational measures. We maintain internal policies for data handling, incident response and staff training, and we review our technical and organisational measures regularly.

Data breaches. We maintain an incident-response plan. If a personal data breach occurs, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33), and we will inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights (Article 34).

8. International transfers

Your data is stored in the EU by default. A small number of processors are located outside the European Economic Area (see Section 9). Where personal data is transferred to them, we rely on one or more of the following safeguards under Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
• the processor's certification under the EU–US Data Privacy Framework, where it provides an adequate basis for transfers to the United States.

Before relying on these, we carry out a transfer impact assessment and apply supplementary measures where needed. Health data is not transferred outside the EEA except where strictly necessary to provide a feature you have chosen to use (for example, connecting a wearable). You can request a copy of the relevant safeguards from our Data Protection Officer.

9. Third-party processors

We engage a limited number of carefully selected service providers (“processors”). Each is bound by a data processing agreement requiring them to protect your data to the standard in this policy and to process it only on our instructions.

We keep this list current. Where we add or change a material processor, we update this policy in line with Section 13.

10. How long we keep your data

We keep your personal data only for as long as necessary for the purposes in this policy.

While your account is active. We retain your data for as long as your account is active and you are using the service.

When you delete your account. At deletion, we offer you a full export of your longitudinal health history so you can keep it or give it to a clinician. We then delete your personal data, unless you ask us to keep an archived copy so you can return later — in which case we retain it, under the same protection, for the period shown when you make that choice, and then delete it. We will keep data longer only where an overriding legal retention obligation requires it, and only for as long as that obligation lasts.

Immediate deletion. You may ask for immediate and permanent deletion at any time, and we will erase your data without waiting for any period above, subject only to any such legal obligation.

Technical logs. Operational and security logs are kept for a shorter period consistent with their purpose.

11. Your rights under the GDPR

You have the following rights over your personal data:

• Access — confirmation of whether we process your data, and a copy of it.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your account and data (the “right to be forgotten”).
• Portability — your data in a structured, commonly used, machine-readable format, and transmitted to another provider where technically feasible.
• Restriction — limiting our processing in certain circumstances.
• Objection — objecting to processing based on legitimate interests.
• Withdraw consent — withdrawing any consent at any time.
• Automated decisions — not being subject to a decision based solely on automated processing that produces legal or similarly significant effects (see Section 5).

How to exercise them. Use Settings in the app or contact privacy@healthycanary.com. Exercising your rights is free, unless a request is manifestly unfounded or excessive. We may need to verify your identity. We respond within one month, extendable by a further two months for complex requests, and we will tell you if we need the extra time.

Complaints. You have the right to lodge a complaint with a supervisory authority — the Data Protection Commission (Ireland), or the authority in your country of residence — though we would welcome the chance to resolve your concern first.

12. Cookies

We use a single, strictly necessary session cookie to keep you securely signed in during your visit. Because it is essential to the service you have requested, it does not require consent. We also store your cookie choice in your browser so we don't ask again.

On our public website only, and only if you choose “Accept analytics,” we use PostHog (hosted in the EU) to understand which pages and buttons are used. PostHog sets first-party cookies and local-storage entries beginning with ph_ that hold a random visitor identifier. We do not record sessions, we do not use advertising cookies, and analytics never runs inside the member, employer or clinician apps. If you decline, PostHog is not loaded. You can change your choice at any time via “Cookie settings” in the website footer; withdrawing consent deletes these identifiers from your browser.

13. Changes to this policy

We may update this policy from time to time. Where a change is material — for example, a change to the categories of data we process, the purposes of processing, or the processors we use — we will notify you by email at least 30 days before it takes effect, so you can review it and, where relevant, withdraw consent.

The current version is always available at healthycanary.com/privacy. The effective date and version number at the top indicate when it was last updated.

14. Contact

For any question, request or concern about this policy or your personal data, contact our Data Protection Officer at privacy@healthycanary.com.