Privacy Policy

HealthLens (“mysovera”, “we”, “us”) provides plain-language summaries of lab/pathology reports. This policy explains what personal data we collect, why, and your rights under Malaysia’s Personal Data Protection Act 2010 and its 2024 amendment (“PDPA”). It applies to anyone who submits a report through our site or is contacted by our team about one.

1. What we collect

When you submit a report, we collect:

• Contact details: name, email, age, gender (optional).
• Health information you tell us: your health concern, symptoms/notes, and the lab report file(s) you upload (PDFs or photos) — this is sensitive personal data under the PDPA, since it concerns your physical or mental health.
• Values extracted from your report (e.g. cholesterol, HbA1c, blood counts) and the resulting analysis.
• Feedback you give us after delivery (rating, comments).
• Basic records of your submission’s status and, once payment is enabled, your payment status (we do not store your card or bank details ourselves — that is handled directly by our payment processor).

2. Why we process it

We use your data to analyze your uploaded report, produce a plain-language summary and lifestyle recommendations, deliver that summary to you by email, respond to your questions, and improve our service. We do not use your health data for advertising, and we do not sell it.

3. How the analysis works — and who sees your data

To read scanned or photographed reports, we send your uploaded file(s) to Anthropic (the maker of Claude), a third-party AI provider, to extract lab values automatically. Every AI-assisted summary is reviewed by a member of our team before it is finalized or sent to you — it is never sent to a customer without human review. We also use the following processors to run the service:

• Supabase — database and file storage.
• Vercel — application hosting.
• Anthropic — automated extraction of lab values from uploaded files.
• Resend — delivery of emails (your report link, updates).

We do not share your data with anyone else, except where required by law or to protect someone’s safety.

4. Retention

We keep your submission and report data for as long as your account/records are active plus a reasonable period afterward for support and legal record-keeping, after which it is deleted or anonymized. You can ask us to delete your data earlier — see Section 6.

5. Security

Access to customer data is restricted to authorized staff members through individual login accounts; direct database access is locked down so it cannot be reached without going through our application. Files are stored with unguessable addresses. No system is completely risk-free, and we continually work to improve these protections.

If a data breach occurs that is likely to cause significant harm, or affects a significant number of people, we will notify Malaysia’s Personal Data Protection Commissioner and, where required, affected individuals, within the timeframes set by the PDPA and its guidelines.

6. Your rights

Under the PDPA, you may:

• Ask what personal data we hold about you and request a copy.
• Ask us to correct inaccurate data.
• Withdraw consent to further processing, or ask us to delete your data (this may limit our ability to deliver or support your report).
• Ask us to stop processing your data for a particular purpose.

To exercise any of these, email us at mysovera@gmail.com. We will respond within 21 days as required by the PDPA.

7. Not a medical record

Our reports are educational summaries, not a medical diagnosis, and are not a substitute for your own doctor’s records. Please keep a copy of your original lab report and share it with your healthcare provider directly.

8. Changes to this policy

We may update this policy as our service or the law changes. Material changes will be reflected here with an updated date above.

9. Contact

HealthLens — mysovera@gmail.com

This policy is provided for transparency and is not a substitute for independent legal advice.