Version 1.6 — Last updated 2 November 2026

Privacy Policy

This policy explains what personal data Lifeline Health ehf. ("Lifeline", "we", "our") collects about you, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have over it. It sits alongside our Terms of Service — if anything here conflicts, this document wins for privacy matters.

1. Who controls your data

Lifeline Health ehf., an Icelandic company (Reykjavík), is the data controller for your personal data. For questions or requests, email contact@lifelinehealth.is.

2. Categories of data we collect

• Identity & contact: name, kennitala, email, phone number, address.
• Account: password (stored as a salted hash, never in plain text), login history, device + IP at session level.
• Health profile: date of birth, sex, height, weight, activity level, health goals, medical history you choose to share.
• Measurements: results of measurements in your health check (e.g. body composition and blood pressure) are recorded in Lifeline's secure electronic health record. Values you enter yourself, such as your weight, are kept in the app.
• Usage: meals logged, weigh-ins, program progress, app interactions, messages exchanged with Lifeline coaches.
• Business onboarding (B2B only): the company you belong to and onboarding completion status.

3. How we collect it

• Directly from you when you register, complete assessments, or use the app.
• From your employer (B2B only) who provides your name, kennitala, email and phone before inviting you — you then complete the rest yourself.
• Automatically via the app (e.g. your phone's timezone, device type for support).

4. Why we use it (legal basis)

• Performance of a contract (GDPR Art. 6(1)(b)). Providing the service you signed up for — assessments, reports, coaching, body composition tracking.
• Explicit consent for special-category data (Art. 9(2)(a)). Health data is only processed once you have agreed to our terms during onboarding.
• Legitimate interests (Art. 6(1)(f)). Fraud prevention, debugging errors, and secure operation of our platform.
• Consent (Art. 6(1)(a)). Marketing emails and use of anonymised data for research — both opt-in; you can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)). Where Icelandic health law, tax law, or court orders require retention or disclosure.

5. How we store your kennitala

Kennitala is considered sensitive personal data under Icelandic law. We follow the principle of data minimisation: only the last four digits are stored in our database, and only for the limited purposes of identifying employee rosters in B2B onboarding and matching duplicates. We do not store, decrypt, or transmit your full kennitala — neither to staff nor to any third party. If a future regulatory or clinical process requires it, that process will live inside Lifeline's secure electronic health record, where access is logged under Article 14 of Icelandic Act no. 55/2009, not in this app.

6. Who we share your data with

We never sell personal data. All processors are bound by GDPR-compliant data processing agreements. Transfers outside the EEA rely on EU Standard Contractual Clauses.

6a. Where your health record lives

Lifeline operates as a licensed healthcare service (heilbrigðisþjónusta) under Icelandic law nr. 40/2007. Your formal medical record (sjúkraskrá) — including clinical interpretations, blood-test results, doctor's notes, and finalised health-assessment outcomes — is held in Lifeline's secure electronic health record under Act no. 55/2009 on Medical Records. Lifeline Health ehf. is the controller of the record. Medalia ehf. hosts and operates it as Lifeline's processor (GDPR Art. 28), under a data processing agreement and only on Lifeline's instructions. You open the record with electronic ID (rafræn skilríki).

The Lifeline app and admin console are operational tools (scheduling, programs, coaching, self-tracking) — not your medical record. Body-composition results are recorded in the record as part of your assessment, and you read them there.

7. Body-composition measurements

Body-composition results reach Lifeline's secure electronic health record, operated by Medalia ehf. The Lifeline website and app no longer send data to, or fetch data from, the device vendor (Biody Manager, Aminogram SAS). That connection ended on 2 November 2026 and the data Lifeline held from it was deleted.

8. Retention

• Active accounts: we keep your data for as long as you use Lifeline.
• Account deletion: personally identifying information is deleted within 30 days of your request, except where retention is required by Icelandic law.
• Inactive B2B invitations: unused invitations are deleted after 12 months.
• Audit logs: kept for 24 months for security and regulatory purposes.
• Anonymised aggregates: may be kept indefinitely as they no longer identify you.

9. Security measures

• TLS encryption in transit; database hosted on Supabase with at-rest encryption at the storage layer.
• Role-based access control via Row-Level Security; specialty-based separation between coaches, clinicians, and admins.
• Audit logging on every write to health-sensitive tables (clients, messages, weight log, body composition events).
• Quarterly staff access review — every team member's permissions are revisited every 90 days.
• Service-role credentials stored in a secrets manager, never in source code.
• MFA (TOTP, AAL2) required for every Lifeline staff session before admin access is granted.
• Sentry redaction strips request bodies on health-related routes so error monitoring cannot leak Art. 9 data.

No system is perfectly secure. If you believe your account has been compromised, contact contact@lifelinehealth.is.

10. Your rights

Under the Icelandic Data Protection Act and the EU GDPR you have the right to:

• Access the personal data we hold about you.
• Correct anything that is wrong.
• Delete your data (the "right to be forgotten"), subject to legal retention.
• Restrict or object to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time for marketing or research use.
• Lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd).

To exercise any of these rights, email contact@lifelinehealth.is (our data protection inbox) or submit a request from your account settings under Data & privacy. We respond within 30 days per GDPR Art. 12. Lifeline answers requests concerning data in the health record as controller; Medalia ehf. assists us as processor.

11. Cookies & analytics

We use strictly necessary cookies to keep you signed in. We do not use advertising cookies. Any analytics we run is privacy-preserving and aggregate (no cross-site tracking).

12. Children

Lifeline is not intended for children under 18. If you believe a child has created an account, contact us and we will delete it.

13. B2B (company onboarding) specifics

When your employer onboards you through Lifeline:

• Lifeline acts as a data processor for the contact details your employer provides, and as a data controller for the health data you share directly with us.
• Your employer's contact person can see your name, email, phone, and the last four digits of your kennitala — not your body composition, measurements, or any clinical data.
• Your employer receives only onboarding completion status — nothing clinical.
• If you leave the company, your Lifeline account remains yours. You decide whether to keep it.

14. International transfers

Your data is primarily hosted in the EU. Some of our processors (e.g. Resend) operate in the US under EU Standard Contractual Clauses. We do not transfer data to jurisdictions without adequate protections.

15. Automated decision-making

Lifeline does not make decisions with legal or similarly significant effects based solely on automated processing. All clinically relevant decisions involve a qualified Lifeline physician.

16. Changes to this policy

We will notify you of material changes at least 14 days before they take effect, by email or in-app. The current version is always at lifelinehealth.is/privacy.

17. Contact

Questions, concerns, or requests about your personal data: contact@lifelinehealth.is.

Lifeline Health ehf. · Reykjavík, Iceland