Skip to content

Privacy Policy

From Octo Health S.A., for members in the European Union, the European Economic Area, the United Kingdom and Switzerland.

This is a translation. In case of any discrepancy, the Portuguese version prevails.

Updated on November 3, 2026

I - IDENTIFICATION OF THE CONTROLLER

  • Name: OCTO HEALTH S.A.
  • Registered office: Avenida da Torre de Belém, n.º 19, 1400-342 Lisboa
  • Email: members@octohealth.com
  • NIPC (Portuguese corporate tax number): 516486063

II - PROCESSING OF PERSONAL DATA

The protection of the personal data of natural persons is governed in Portugal by Law No. 58/2019 of August 8 ("LPDP") and by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 ("General Data Protection Regulation" or "GDPR"), which ensure the protection of natural persons with regard to the processing of personal data and the free movement of such data.

For the purposes of this Privacy Policy (hereinafter, the "Policy"), "personal data" means any information, of any nature and regardless of its medium, including sound and image, relating to an identified or identifiable natural person; accordingly, the protection does not extend to data of legal persons. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity (for example, his or her name combined with his or her telephone number or email address).

This Policy relates to the processing of personal data carried out by OCTO HEALTH S.A. (hereinafter, "Octo Health") in connection with the Octo Health: AI Health Tracker mobile application and its website, https://octohealth.com/ (hereinafter, together, the "Platform").

By reading this Privacy Policy, the user is informed about the processing of personal data carried out by Octo Health.

III - PRIVACY, SECURITY AND PROTECTION OF MINORS

Octo Health does not knowingly collect or process personal data of data subjects under 18 (eighteen) years of age. Users who do not meet this age requirement must not provide any personal data through the Platform.

If Octo Health becomes aware that it has collected personal data from a minor under 18 (eighteen) years of age, it will delete such data without undue delay.

Anyone who becomes aware that a minor under 18 (eighteen) years of age has provided personal data through the Platform may inform Octo Health using the contact details set out in Section XI.

IV - CATEGORIES OF PERSONAL DATA

In accordance with the purposes set out in Section V, the following categories of personal data may be processed:

  • a) Identification data (full name, date of birth, username);
  • b) Profile data provided by the user: profile photo, sex at birth, height, weight and body mass index, ethnic origin and occupation. Sex and age are used to interpret lab results, including the reference ranges shown. Ethnic origin, like health data, is processed on the basis of the user's explicit consent (Article 9(2)(a) GDPR);
  • c) Health data (results of lab tests and medical examinations, medical history, chronic conditions, allergies, medications and supplements, symptoms, reproductive health, health-related habits and relevant family history, including relatives' conditions and the degree of relationship, without the relatives' names);
  • d) Documents and images uploaded by the user (for example, photographs, PDF files or discharge letters) and the information extracted from them;
  • e) Lifestyle data: activity level, types of exercise, tobacco and alcohol use, diet and how often the user feels anxious or overwhelmed, as well as answers to daily check-ins;
  • f) Contact data (email, telephone number);
  • g) Payment data (billing address, transaction details and amounts, and tax identification number, where applicable). Payment card details are handled directly by the payment service provider and are not stored in Octo Health's systems;
  • h) Data relating to profiling and personalization of the user experience, including activity on the Platform;
  • i) Platform usage data: pages and features used, device and browser type, app version and crash diagnostics;
  • j) Data sent to the artificial intelligence provider to produce the user's insights and protocol: the lab report, with identifying details removed, the values read from it (test, result, unit and reference range), age, sex and the medications, symptoms and habits logged. The name, email, telephone number, date of birth, address, any identification number and any account identifier are not sent;
  • k) Consent records: the user's choice regarding Cookies (decision, categories and date) and the version and date of the consents given on the Platform;
  • l) Campaign and advertising data, only with the user's consent to advertising Cookies: browser identifiers placed by the advertising partners, the campaign link parameters (utm and ad click identifiers) and the record of visits and of starting a membership, shared with the advertising partners identified in the Cookies Policy; and, when the user becomes a member, the fact that a purchase was made, its value and coded (hashed) identifiers, sent to the advertising partners through the payment service provider. The health record, lab results, symptoms and the user's answers are never shared with advertising partners;
  • m) Other data: any other data provided directly by the user through communications on the channels made available for that purpose; and
  • n) Browsing data: IP address, network activity and approximate location (city or region) derived from the IP address. Precise location is not collected.

V - PURPOSES OF THE PROCESSING OF PERSONAL DATA

The personal data we collect and process will be used solely for the following purposes:

  • a) Creation and management of the user's account;
  • b) Storage, organization, display and creation of a chronological history of the user's health information on the Platform;
  • c) Ordering of clinical lab tests from partner laboratories;
  • d) Improvement of the Platform and of the user experience;
  • e) Sending of marketing communications and communications, including newsletters and personalized communications;
  • f) Ensuring security, preventing fraud and verifying identity, where applicable; and
  • g) Compliance with legal obligations arising from applicable data protection legislation, as well as the exercise of data subjects' rights in judicial proceedings.

Octo Health implements appropriate technical and organizational measures to ensure the security and confidentiality of your personal data, preventing its alteration, loss, manipulation or unauthorized access, as described in Section X of this Policy.

VI - LAWFUL BASIS FOR THE PROCESSING OF PERSONAL DATA

Octo Health processes users' personal data on the following lawful bases:

  • a) Performance of a contract entered into between the user and Octo Health, upon acceptance of the Platform's Terms and Conditions;
  • b) The user's consent;
  • c) Octo Health's legitimate interests, including ensuring the security, integrity and improvement of the Platform, as well as sending marketing communications relating to products or services similar to those previously purchased; and
  • d) Compliance with legal and contractual obligations applicable to Octo Health.

The user warrants that the information provided is true, accurate, complete and up to date, and is liable for any damage or loss, direct or indirect, that may be caused as a result of providing information that does not meet these criteria.

Where the processing of personal data is based on consent, the data subject may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

The processing of the user's health data for the purposes of storage, organization, display and creation of a chronological history on the Platform is essential to the provision of the services offered. Accordingly, if the user does not give consent to this processing, the user will not be able to create an account on the Platform or, if the user later withdraws the consent given, to continue using it.

If the data provided belongs to a third party, the user warrants that he or she has informed that third party of the matters contained in this Policy and has obtained that third party's authorization.

VII - RETENTION PERIODS

Octo Health only retains and processes users' personal data for the period necessary to fulfill the purposes for which they were collected and processed, in accordance with applicable legal and regulatory obligations, and in any event for the period during which the user's account exists on the Platform.

Octo Health keeps personal data in its systems in a form that permits identification of data subjects in accordance with the following criteria:

  • i. While the user's account remains active;
  • ii. To comply with legal obligations, including retention of billing data for the periods required by law;
  • iii. Until consent is withdrawn, where applicable;
  • iv. For the period strictly necessary for identity verification, where applicable.

VIII - DISCLOSURE OF DATA

To pursue the purposes set out in Section V, Octo Health may disclose personal data to third parties, namely:

  • I. PARTNER LABORATORIES:
    • 1. CENTRO DE MEDICINA LABORATORIAL GERMANO DE SOUSA S.A. (LABORATÓRIO GERMANO DE SOUSA):
  • II. OCTO HEALTH TECHNOLOGIES INC.:
  • III. SERVICE PROVIDERS (PROCESSORS):

    Entities that process personal data on behalf of Octo Health, under contract and only on its instructions, in the following categories:

    • 1. Hosting and infrastructure, including user authentication;
    • 2. Artificial intelligence provider, to produce the user's insights and protocol, which may not use the data it receives to train its models;
    • 3. Email and message delivery;
    • 4. Protection of forms against automated use;
    • 5. Call scheduling.
  • IV. USAGE ANALYTICS AND ADVERTISING PARTNERS, ONLY WITH THE USER'S CONSENT, AS SET OUT IN THE COOKIES POLICY:

    The health record, lab results, symptoms and the user's answers are never shared with these partners.

  • V. PEOPLE CHOSEN BY THE USER:

    When the user exports or shares his or her record, for example with a doctor, a relative or a nutritionist. Access granted through the Platform is time-limited and may be revoked by the user before it expires.

  • VI. PAYMENT PROCESSING SERVICE PROVIDERS:
  • VII. COMPETENT AUTHORITIES, PUBLIC ADMINISTRATION BODIES AND OTHER PUBLIC BODIES, WHERE REQUIRED BY LAW.

IX - INTERNATIONAL DATA TRANSFERS

To pursue the purposes identified in Section V, users' personal data may be transferred to OCTO HEALTH TECHNOLOGIES INC., established in the United States of America ("USA") and identified in Section VIII.

These transfers will be carried out in accordance with Chapter V of the General Data Protection Regulation ("GDPR"), on the basis of the adequacy decision on the EU-US Data Privacy Framework, adopted by Commission Implementing Decision (EU) 2023/1795 of July 10, 2023, pursuant to Article 45 of the GDPR.

X - INFORMATION SECURITY

Octo Health implements appropriate technical and organizational security measures to ensure the security and confidentiality of personal data, preventing its alteration, loss, processing or unauthorized access.

To that end, in the context of these activities, Octo Health undertakes to:

  • ensure the accuracy and currency of the data processed, and promptly accept any corrections and/or additions requested by the data subject;
  • adopt appropriate security measures to ensure due protection of personal data, taking into account the potential impact that the processing may have on the data subject's fundamental rights and freedoms;
  • notify the data subject, within the time limit and in the cases provided for by applicable law, of any personal data breaches;
  • ensure the legal compliance of all data processing activities.

XI - EXERCISE OF RIGHTS

In accordance with the GDPR, the data subject may exercise his or her rights of access, rectification, erasure, restriction of processing, portability, objection, withdrawal of consent and not to be subject to automated decisions, by making a written request through any of the following means, specifying the right or rights he or she wishes to exercise:

XII - SUPERVISORY AUTHORITY

The data subject has the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, the Portuguese data protection authority) regarding matters relating to the exercise of his or her rights and the protection of his or her personal data, through the following web page: www.cnpd.pt

XIII - CHANGES TO THE PRIVACY POLICY

Octo Health reserves the right to revise this Policy at any time it deems appropriate, and the user is therefore advised to check this Policy regularly.

Updated on November 3, 2026.

Ler em português: Política de Privacidade

Questions about any of this go to members@octohealth.com.