The most private thing you own deserves the most serious treatment

Account data: email address, hashed password, first and last name if you give them, postcode, country of residence, language and, only if you choose to give one, a phone number. The postcode is asked for because the service is open to residents in Spain only; the phone number is needed for nothing the application does and you can leave it empty.

What you use Hemora for: during onboarding you pick a situation from a list (a long follow-up, a history split between public and private care, a relative's record, and so on). It is there so we know who we are building this for, and it is never combined with your record. **None of the options names an illness, a treatment or a state of health**: they describe the shape of the record or the administrative situation, and that is deliberate. If you pick «other» a two-word free field appears, and the screen expressly asks you not to write health details in it.

Health data: the documents you upload and what is extracted from them, dates, clinics, measured values, summaries, together with what you record in your medical profile: date of birth, sex, height, weight, blood group, allergies, treatments and past conditions.

Technical data: a log of sign-ins and account actions, with the IP address truncated to its first three groups. We use no analytics or advertising cookies.

Audience measurement: we count how many times each screen is opened, per day and language, in our own database. That counter stores no IP address, no identifier and no cookie: there is no way to know who visited what, only how much each screen is used.

To run the service, storing, reading and ordering your record, on the explicit consent you give at sign-up (Article 9(2)(a) GDPR, as this is health data) and on performance of the contract (Article 6(1)(b)).

For AI reading, on a separate consent you can withdraw at any time. If you withdraw it we stop sending documents to the model provider; your record keeps working and you can enter values by hand.

For the security of the service, spotting access attempts, preventing abuse, on our legitimate interest (Article 6(1)(f)).

There are no automated decisions with legal effects and no commercial profiling. We do not sell or share data for advertising, with no exceptions.

At sign-up there is a separate, optional checkbox authorising your health data to be used in anonymised and aggregated form for two purposes: improving the service, and contributing to health research, including alongside third parties who carry out research, public or private.

If you tick it, what leaves here carries no name, no email address, no phone number and none of your documents: it is values and dates aggregated with those of other people, so that no conclusion can point back to you. If you do not tick it, nothing changes: the service works the same and you get exactly the same thing.

It is a consent of its own, and it is withdrawn from Settings at any time with a single switch. On withdrawal we stop including your data in any new set; what has already been aggregated and anonymised cannot be undone, because it is no longer possible to know which was yours, and that is precisely what makes it anonymous.

There is never advertising, nor any sale of identifiable data, and that has no exception and depends on no checkbox.

We name them one by one, because «a provider» is not an answer: whoever reads this has the right to know whose hands their record passes through.

**Application hosting**: Vercel. **Database**: Neon, on servers located in Frankfurt, Germany. **Files**: Vercel's object store, European. All of it encrypted before it leaves our process.

**Document reading**: Mistral AI, a French company whose infrastructure is in the European Union. It receives the document text in order to file it and extract its values; it receives neither your name nor your email address. We have turned off, in our account, the use of that data to improve or train their models. Nothing is sent to them unless you have ticked the corresponding box, and we stop sending anything the day you withdraw it.

Said all the way, because it is a retention period and it is yours to know: under the standard terms of its API, Mistral keeps what is sent and what it returns for thirty days, in the European Union, to detect abuse, then deletes it. None of it is used for training. We have asked for the zero retention arrangement, and this page will say we have it the day we do, not before.

**Email**: Mailjet, based in France, which receives only your address and the message we send you.

**Payments**: Stripe, if you subscribe. It receives your email and billing details; never any of your health data. Your card never passes through our servers.

A processor agreement under Article 28 GDPR is in place with each of them.

Said precisely, because it matters: **your data is stored and processed in the European Union**, but some of these providers are companies with a United States parent. Their support staff may, exceptionally and to resolve a technical problem, access it from outside the European Economic Area. That access is a transfer within the meaning of the GDPR, and it is covered by the European Commission's standard contractual clauses (Article 46) or by the EU–US Data Privacy Framework. We would rather write it this way than promise it does not happen.

Every file, and the text extracted from it, is stored encrypted with AES-256-GCM. The key is not stored alongside the data.

Passwords are stored derived with scrypt, never in clear. Session identifiers are stored only as a hash, so a database dump grants access to no account.

Technical access to a user's data is logged and only happens at that person's request, to resolve a problem.

For as long as your account is open. When you close it we offer you the full export of your record in the same step, and then destroy the content.

Access logs are kept for twelve months, for security. Proof of consent is kept for as long as needed to demonstrate it against a claim. And an account that never confirms its address is deleted entirely after thirty days: without confirmation there is no way in, so it is not a dormant account but an impossible one, and keeping it would serve no purpose.