Privacy Policy

1. Overview

SuiviBio is an Android and iOS app for tracking and visualizing biological parameters (laboratory test results). It lets users enter, store, view and share their own results, follow how they change over time and schedule reminders.

Protecting your personal and health data is our top priority. This policy describes transparently what data is processed, for what purpose, and how it is protected.

2. Data controller

The data controller is the developer of the SuiviBio app. For any privacy-related question, contact us at: [email protected].

3. Data processed

3.1 Health data entered by the user

The app only processes the data you choose to enter or import, including:

• Laboratory test results (complete blood count, blood glucose, creatinine, liver panel, lipid panel, etc.)
• Home measurements (for example blood pressure, weight or blood glucose)
• Sample collection dates
• Follow-ups, test reminders and measurement reminders that you choose and confirm
• Original documents (photo or PDF) of scanned or imported lab reports

This data is stored only on your device.

3.2 Data from the scan feature (OCR)

SuiviBio offers an optional feature that extracts the values from a photo, an image or a PDF of your lab report. It works as follows:

• Before your first scan, the app asks for your explicit consent. You can stop using the scan at any time: no image is then sent, and manual entry is always available.
• You take a photo of your lab report, or import an image or a PDF, and crop it to the results area.
• The cropped image is sent in encrypted form (HTTPS) to our analysis server, hosted by Railway, which forwards it to the Anthropic API (Claude), a third-party artificial intelligence service, for the sole purpose of extracting the test values. Our server does not keep the image.
• In line with its policy for API users, Anthropic automatically deletes the data it receives and generates within 30 days, except in the cases provided for in its policies, for example to enforce its terms of use or to comply with the law. Anthropic does not use this data to train its models.
• The extracted values and the original document (photo or PDF) are stored only on your device.

This feature is entirely optional. You can always enter your values manually without using the scan.

3.3 Technical data

The app does not collect any advertising identifier or device identifier and does not include any third-party tracking or analytics tools.

When you use the scan, our hosting provider Railway automatically records a technical log for each request. This log contains your IP address, the date and time, the size of the request, and the app and operating system versions. It does not contain the content of the image.

3.4 Logbook sharing

You can share one report, a date range or your whole logbook in an encrypted file protected by a code. You choose how to send the file and the code. The file does not go through our servers.

• The recipient opens the file in the SuiviBio app, in a temporary viewing session.
• The shared data is not saved in the recipient's local database.
• Original documents are excluded by default.
• Anyone who has both the file and the code can view its contents. Send the code separately, and only to people you trust.

4. Purposes of processing

Your data is used exclusively to:

• Display your results and their reference ranges
• Display how your parameters change over time
• Alert you, through a local notification, that a value falls outside the reference range shown in the app
• Schedule the reminders you have chosen and confirmed (“My follow-ups” and measurement reminders) and show upcoming tests in the home screen widget. This processing takes place only on your device.
• Automatically extract test values from a photo or document of your lab report (OCR feature, optional)
• Create the reports and sharing files you request

No data is used for advertising, commercial or profiling purposes.

5. Data storage and security

5.1 Local storage

Your biological data is stored on your device. No health data is sent to a remote server or synced with a third-party cloud service without your explicit consent. The only exception is the image you choose to send when you use the scan.

5.2 Scan feature and temporary transmission

When you use the OCR scan, the image of your lab report is sent through our server to the Anthropic API (Claude) to extract the test values. This transmission is:

• Encrypted in transit (HTTPS)
• Not kept by our server
• Deleted by Anthropic within 30 days, subject to the exceptions provided for in its policies, and not used to train its models
• Limited to the image you selected and cropped

For more information, see Anthropic's privacy policy: https://www.anthropic.com/privacy

5.3 Security measures

• Storage in the app's internal database, which other apps cannot access
• No network transmission of your personal or health data, except during the OCR scan (optional and described above)
• Backup and sharing files created by the app are encrypted
• No third-party advertising or analytics SDK

6. Sensitive health data

Biological data is health data within the meaning of the General Data Protection Regulation (GDPR) and is classified as sensitive data. As a result:

• It is never shared with third parties without your explicit consent
• It is never sold, rented or transferred to advertisers or business partners
• Its processing is limited to what is strictly necessary for the app to work

7. Data sharing

SuiviBio does not share your data with any third party, except in the following cases:

• OCR feature (optional, with your consent): temporary transmission of an image through our server, hosted by Railway, to the Anthropic API, solely to extract the test values
• Hosting: technical logs recorded by Railway, described in section 3.3
• Exports and shares that you start yourself (for example a PDF report or a logbook file)
• Legal obligation: if required by applicable law in the context of legal proceedings

The app has no integration with social networks, advertising platforms or behavioral analytics services.

8. User rights

Under the GDPR and applicable local laws, you have the following rights regarding your data:

• Right of access: view all of your data stored in the app
• Right to rectification: edit or correct your data at any time from the app
• Right to erasure: delete all or part of your data from the app, or by uninstalling it
• Right to data portability: export your data in a standard format
• Right to withdraw consent: stop using the AI scan at any time and enter your values manually; no image is then sent

To exercise these rights or for any question, contact us at [email protected].

9. Data retention

Your data is kept on your device for as long as you use the app. It is completely deleted when you uninstall the app or use the “Delete my data” function in the app's settings.

Railway's technical logs are stored in the United States for 90 days and then deleted automatically. They cannot be deleted individually before the end of this period.

10. Children's data

SuiviBio is not intended for children under 18. We do not knowingly collect data from minors. If you are a parent or guardian and believe that your child has provided data through the app, please contact us so that we can address it.

11. Medical disclaimer

SuiviBio is a tool to help you understand and personally track your biological data. It is not a certified medical device and in no way replaces the advice, diagnosis or treatment of a qualified healthcare professional.

The reference ranges shown are for guidance only and come from published sources cited in the app (MSD Manual, WHO and specialized references). You can edit them to match your laboratory. Any medical decision must be made together with a doctor.

12. Changes to this privacy policy

We reserve the right to update this policy to reflect changes to the app or to legal requirements. Any change will be announced through an app update on the App Store and Google Play. The date of the last update is shown at the top of this document.

13. Governing law

This policy is governed by the law in force in the user's country of residence. For users living in the European Union or in countries applying equivalent regulations, the GDPR (Regulation (EU) 2016/679) applies.