myHRTzone privacy policy
Last updated: [DATE OF FIRST RELEASE]
myHRTzone helps you record your HRT plan and reminds you when it's time to take or change it. It records and reminds. It does not give medical advice.
Who we are. myHRTzone is run by [CONTROLLER: Dr Layth Bunni, confirm personal or company] ("we", "us"). We are the data controller for the small amount of data described below. Contact: privacy@myhrtzone.com. We are based in Gibraltar and the app is offered to people in the UK.
This policy is also published at https://myhrtzone.com/privacy.
The short version
- Your health record stays on your phone. Your plan, doses, notes, symptoms, check dates and any photos are stored only on your device. We never receive them.
- Our server holds your email address and what's needed to sign you in, and nothing else. No health data is ever sent to it.
- No tracking, no analytics, no advertising. The app has no analytics or advertising code and we don't share data with anyone for those purposes.
- You must be 18 or over to use myHRTzone.
What our server holds
Our own sign-in service runs on Microsoft Azure in the UK (UK South). It holds:
| Data | Why | How it's kept |
|---|---|---|
| Email address | To sign you in, send confirmation and password-reset codes, and let you delete your account | Encrypted |
| Password | To sign you in | Only as a one-way salted hash (argon2id). We can't read it. |
| Authenticator-app secret | Two-step verification | Encrypted |
| Recovery codes | Backup for two-step verification | Only as one-way hashes |
| Sign-in sessions | To keep you signed in | Only a keyed hash of your sign-in token, with an expiry date |
| Short-lived email codes and attempt counters | To check codes and stop people guessing passwords | Only keyed hashes, deleted when they expire |
We do not store IP addresses. To stop abuse we count attempts. The count is kept against a one-way keyed hash, not your IP address or email in plain form, and it is deleted when the time limit ends.
We don't collect your name: if you enter one, it stays on your phone. We don't collect your health data, contacts, location or device identifiers. We don't write your email address, IP address, codes or tokens to our logs.
What stays on your phone
Everything you record in myHRTzone stays on your phone: your regime, dose history, plan changes, notes for appointments, symptoms, lifestyle entries, photos, check and screening dates, and reminder settings.
- The record is kept in a file encrypted with AES-256-GCM. The key is held by your phone's secure store: the iOS Keychain (this device only, available only while the phone is unlocked) or the Android Keystore.
- The record is not included in iCloud backups or Google backups. The file sits in a folder excluded from iCloud backup, and Android app backup is turned off.
- This means the record cannot be restored onto a new phone unless you have exported a backup file yourself (see below). If you lose your phone and have no backup file, your record is lost. We cannot recover it, because we never had it.
- Your sign-in token is kept in the iOS Keychain or Android Keystore.
- Reminders are scheduled by your phone's own notification system. They are not sent from a server.
When something leaves your phone
Only when you choose to:
- Backup file. "Save a backup file" creates a file you can save or send wherever you choose. The file is not encrypted, so keep it somewhere safe. The app deletes its own temporary copy after you have shared it.
- Show my doctor. This makes a link and a QR code. The summary is carried inside the link itself, in the part after "#", which browsers do not send to any server. We do not receive or store it. Anyone with the link or QR code can read the summary, so share it only with your clinician. The link stops opening after 4 hours. We chose not to encrypt it, because the key to unlock it would have to travel in the same link, which would add no real protection.
- Links to guides and services open in your browser. Those websites have their own privacy policies.
Lawful basis (UK GDPR)
- Your account (email, password hash, authenticator set-up, sessions): we need these to provide the service you signed up for (Article 6(1)(b), contract).
- Health information: we never receive your health record. But simply having an account with an HRT app may suggest something about your health. So we also ask for your explicit consent (Article 9(2)(a)) when you sign up. You tick a separate box, which is not ticked for you: "I agree that myHRTzone stores my email to run my account, and that using an HRT app may reveal health information about me (explicit consent, UK GDPR Art 9(2)(a))".
- Withdrawing consent: you can withdraw it at any time by deleting your account (see below). This does not affect anything we did before you withdrew it.
Who processes data for us
- Microsoft (Azure, UK South) hosts our sign-in service and its database.
- Microsoft Azure Communication Services (UK) sends the emails we send you: confirmation codes, password-reset codes, and account notices.
Both act only on our instructions. We don't sell your data or share it with anyone else.
How long we keep it
- Accounts never confirmed: if you sign up but don't confirm your email, the account is deleted after 7 days.
- Email codes and attempt counters: deleted automatically once they expire.
- Sessions: a sign-in lasts at most 90 days. After that you sign in again. Ended sessions are removed.
- Your account: kept until you delete it. Deleting it removes your email address, password hash, authenticator secret, recovery codes and sessions from our server straight away. We then send one email to confirm the deletion.
Deleting your account
- In the app: Health → Account and privacy → Delete my account and data. This deletes your sign-in on our server and wipes everything myHRTzone stored on your phone.
- On the web: https://myhrtzone.com/delete-account (sign in with your password and authenticator code, then delete).
- By email: write to privacy@myhrtzone.com from the address on the account.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the data we hold about you (your email address and account details);
- correct it;
- delete it;
- restrict or object to how we use it;
- give it to you in a portable format.
Email privacy@myhrtzone.com. We will reply within one month. Your health record is on your phone, so you already hold it: you can view it in the app or save a backup file.
Complaints. If you are unhappy with how we handle your data, please tell us first. You can also complain to:
- the UK Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113;
- in Gibraltar, the Gibraltar Regulatory Authority (Information Rights): gra.gi.
Age
myHRTzone is for adults only. You must be 18 or over to create an account. When you sign up you confirm that you are 18 or over.
Security
Data between the app and our server is encrypted in transit (HTTPS). Two-step verification is required for every account. We do not claim any security certification.
Medical disclaimer
myHRTzone records and reminds. It doesn't give medical advice, diagnose, or recommend treatment. Your clinician decides your treatment. In an emergency, call 999 or 112. See our Terms of Use: https://myhrtzone.com/terms.
Changes
If this policy changes, we'll update the date above. If the change is significant, we'll tell you in the app.