Privacy Policy
Last updated: 25 June 2026
This policy explains how superhumanlab (“we”, “us”) — the operator of the service and the data controller for your personal data — handles your data.We treat your health information as sensitive and collect only what we need to run the service. Contact us any time at [email protected].
What we collect
- Account data — your name and email. If you sign in with Google, Microsoft or Facebook, we receive your name, email and profile photo from that provider.
- Profile data — the goals, date of birth, sex, height, weight and optional lifestyle details (activity, sleep, diet, supplements/medications) you choose to enter.
- Health data — the biomarker and lab readings you add (values, units, test dates, notes), any lab report you upload for parsing, and insights derived from them (e.g. status colours, biological-age estimates). This is special-category / consumer health data and is treated with extra care.
- Technical data — limited data needed to keep the service secure and working (e.g. IP address for a bot check at sign-up and to record consent). We use cookie-less analytics — there are no tracking cookies.
Why we can process it (legal bases)
Under the UK/EU GDPR we rely on: contract — to provide the dashboard, history and account you sign up for; legitimate interests — to keep the service secure and prevent abuse; and your consent — for processing your health data and, where applicable, for parental consent if you are under 18. Because health data is special-category data, we ask for your explicit consent before storing it, and you can withdraw that consent at any time by deleting your data or account.
How we use it
Your data is used solely to show you your own dashboard, history and AI-powered insights, to operate and secure your account, and to contact you about the service (e.g. verification and password emails). It is never sold, never used for advertising, and never shared with third parties except the service partners below. Every request is authenticated and your data is only ever returned to your own account.
Who we share it with (our partners)
We use a small number of trusted service partners that process data on our behalf under contract, only to provide the service:
- a hosting & infrastructure partner that stores the database and runs the app;
- an AI partner that powers the overview and lab-report parsing features (see below);
- an email-delivery partner for verification and password emails;
- a bot-protection partner for the “I’m human” check at sign-up;
- your chosen sign-in provider (Google, Microsoft or Facebook) if you use social login.
We describe partners by role rather than name to keep our setup private; we’ll tell you the specific providers on request. We may also disclose data if required by law, or to a successor if the business is transferred.
AI processing of your data
When you request an AI overview, or upload a lab report for parsing, the relevant data is sent to our AI partner to generate the result. Our AI partner processes it only to return that result and does not store your inputs or use them to train AI models.
Where your data is processed & international transfers
Your data may be processed on infrastructure located outside your country, including outside the UK/EEA. Where it is transferred internationally, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.
How long we keep it
We keep your personal data for as long as your account is active and as needed to provide the service, plus any period required by law. When you delete your account, your profile, readings, notes, sessions, consent records and identity data are removed promptly.
Security
Data is encrypted in transit and at rest, access is authenticated and scoped to your own account, and a session cookie (strictly necessary, HttpOnly) keeps you signed in — it is the only cookie we set. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data, and if a breach affects your data we will notify you and the relevant authority as required by law.
Your rights
You can access, correct, delete, export (portability), restrict or object to the processing of your data, and withdraw consent at any time. From your Profile page you can download a full JSON copy of your data and permanently delete your account yourself; for anything else, email [email protected]. If you are in the UK/EEA you also have the right to complain to your local data-protection supervisory authority.
Children
The Services are for users 13 and over, and under-18s need a parent or guardian’s consent. We do not knowingly collect data from children under 13; if we learn we have, we will delete it.
Changes
We’ll update the date above when this policy changes and, for material changes, give you notice or ask you to re-consent.
US Consumer Health Data Notice
This section applies to residents of US states with consumer-health-data laws (such as Washington’s My Health My Data Act). “Consumer health data” includes your biomarker and lab results and the health trends or estimates we derive from them. We collect it only to provide the service, with your consent; we do not sell your consumer health data and do not share it for advertising. You may withdraw consent, and access, correct or delete this data, and appeal a declined request, by using the export/delete tools on your Profile page or emailing [email protected]. We will not discriminate against you for exercising these rights.
Contact
Data controller: superhumanlab, contactable at [email protected]. We are in the process of incorporating SuperhumanLabAi Ltd and appointing an EU/EEA representative; this notice will be updated with their details.