Health Data Processing Notice

1. What Is Health Data

Health data is a special category of personal data under GDPR Article 9. It receives the highest level of legal protection. We process it only with your explicit consent.

2. What Health Data We Collect

3. Legal Basis

• GDPR Article 9(2)(a): explicit consent
• GDPR Article 9(2)(h): preventive medicine or health assessment purposes
• GDPR Article 9(2)(j): scientific research with appropriate safeguards (anonymised data only)

4. Explicit Consent Workflow

We obtain explicit consent for health data processing through the following workflow:

5. How Health Data Is Used

6. Data Minimisation

We apply strict data minimisation to health data:

• We collect only health data necessary for the service tier you have subscribed to
• App-only subscribers without CGM do not have glucose data collected
• Optional data types (sleep, activity, dietary) are never collected without your active input
• EVA’s models use only the minimum data required to generate each prediction type
• Health data is logically separated from other personal data in our systems

You can review and correct your health profile at any time through Account Settings.

7. Anonymised Secondary Use

We use anonymised and aggregated health data derived from our user base to improve EVA’s accuracy and the platform. The following safeguards apply to this secondary use:

• Data is irreversibly anonymised before use in model training or research (k-anonymity minimum k=50)
• Anonymised data cannot be re-linked to any individual user
• No third party receives access to identifiable health data for model training or research purposes
• You may opt out of your anonymised data being used for model improvement by contacting dpo@alva.health — this does not affect your ability to use the platform
• Opt-out of secondary use does not affect your primary service delivery in any way

8. CGM Sensor and Manufacturer

Manufacturer

Zhejiang PocTech Co., Ltd. · No.1633 Hongfeng Road, Building 11 & 12, Huzhou City 313000, Zhejiang, China · REF: ZKCTT01101

EU device — T-300D TRANSMITTER

UK device — CT-300D TRANSMITTER

9. Health Data Security

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Health data logically separated from other personal data
• Access restricted to minimum authorised staff
• All staff with access bound by confidentiality obligations
• Regular security audits and penetration testing
• CGM data encrypted end-to-end between sensor and platform

10. Retention

11. Sharing

• Zhejiang PocTech Co., Ltd. and authorised EC/UK representatives (transmission only)
• Cloud infrastructure providers under data processing agreements
• Law enforcement where legally required
• With your explicit consent for any other purpose

12. Your Rights

• Withdraw consent at any time without affecting prior processing
• Request deletion of all health data
• Receive a machine-readable copy of your health data
• Restrict processing of your health data
• Opt out of anonymised secondary use for model improvement
• Request human review of any EVA prediction or recommendation

13. Consent Withdrawal

You may withdraw health data consent at any time through:

• Account Settings → Privacy → Health data consent
• Email: dpo@alva.health

What happens when you withdraw consent:

• EVA will stop generating new personalised predictions based on your health data immediately
• Existing health data is retained for the period in Section 10 unless you also request deletion
• You retain access to the platform but core EVA features will be limited
• You may restore consent at any time in Account Settings

We will confirm receipt and processing of your withdrawal within 5 working days.

14. Contact and DPO

Legal enquiries: legal@alva.health

Data protection / DPO: dpo@alva.health

General support: support@alva.health

Security issues: security@alva.health

EU supervisory authority: Berliner Beauftragte fur Datenschutz und Informationsfreiheit (BlnBDI)

UK supervisory authority: Information Commissioner’s Office (ICO) — ico.org.uk