Version 1.4 — Last updated 29 April 2026

Privacy Policy

This policy explains what personal data Lifeline Health ehf. ("Lifeline", "we", "our") collects about you, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have over it. It sits alongside our Terms of Service — if anything here conflicts, this document wins for privacy matters.

1. Who controls your data

Lifeline Health ehf., an Icelandic company (Reykjavík), is the data controller for your personal data. For questions or requests, email contact@lifelinehealth.is.

2. Categories of data we collect

• Identity & contact: name, kennitala, email, phone number, address.
• Account: password (stored as a salted hash, never in plain text), login history, device + IP at session level.
• Health profile: date of birth, sex, height, weight, activity level, health goals, medical history you choose to share.
• Measurements: body-composition results (fat %, muscle mass, phase angle, BMR, body water, etc.) from our measurement partner Biody.
• Usage: meals logged, weigh-ins, program progress, app interactions, messages exchanged with Lifeline coaches.
• Business onboarding (B2B only): the company you belong to and onboarding completion status.

3. How we collect it

• Directly from you when you register, complete assessments, or use the app.
• From your employer (B2B only) who provides your name, kennitala, email and phone before inviting you — you then complete the rest yourself.
• From Biody Manager when you attend a body-composition scan at one of our partner clinics.
• Automatically via the app (e.g. your phone's timezone, device type for support).

4. Why we use it (legal basis)

• Performance of a contract (GDPR Art. 6(1)(b)). Providing the service you signed up for — assessments, reports, coaching, body composition tracking.
• Explicit consent for special-category data (Art. 9(2)(a)). Health data is only processed once you have agreed to our terms during onboarding.
• Legitimate interests (Art. 6(1)(f)). Fraud prevention, debugging errors, and secure operation of our platform.
• Consent (Art. 6(1)(a)). Marketing emails and use of anonymised data for research — both opt-in; you can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)). Where Icelandic health law, tax law, or court orders require retention or disclosure.

5. How we store your kennitala

Kennitala is considered sensitive personal data under Icelandic law. We follow the principle of data minimisation: only the last four digits are stored in our database, and only for the limited purposes of identifying employee rosters in B2B onboarding and matching duplicates. We do not store, decrypt, or transmit your full kennitala — neither to staff nor to any third party. If a future regulatory or clinical process requires it, that process will live inside Medalia (the licensed sjúkraskrár- system) where access is logged under Icelandic law nr. 55/2009 §14, not in this app.

6. Who we share your data with

We never sell personal data. All processors are bound by GDPR-compliant data processing agreements. Transfers outside the EEA rely on EU Standard Contractual Clauses.

6a. Where your health record lives

Lifeline operates as a licensed healthcare service (heilbrigðisþjónusta) under Icelandic law nr. 40/2007. Your formal medical record (sjúkraskrá) — including clinical interpretations, blood-test results, doctor's notes, and finalised health-assessment outcomes — is held in Medalia ehf., a sjúkraskrár- system licensed under Icelandic law nr. 55/2009. Lifeline and Medalia act as joint controllers for that record under GDPR Art. 26.

The Lifeline app and admin console are operational tools (scheduling, programs, coaching, self-tracking) — not your medical record. Body-composition values from Biody scans are entered into Medalia by a clinician as part of your assessment; a copy is also shown in your Lifeline dashboard for your own self-tracking, with your explicit consent and only visible to you.

7. What we share with Biody Manager

To register you as a patient on the measurement device, we send Biody your name, email, date of birth (derived from your kennitala), sex, height, and activity level. We do not send your kennitala or your Lifeline account password. Biody stores the measurement data and returns it to us; we link it to your Lifeline account.

8. Retention

• Active accounts: we keep your data for as long as you use Lifeline.
• Account deletion: personally identifying information is deleted within 30 days of your request, except where retention is required by Icelandic law.
• Inactive B2B invitations: unused invitations are deleted after 12 months.
• Audit logs: kept for 24 months for security and regulatory purposes.
• Anonymised aggregates: may be kept indefinitely as they no longer identify you.

9. Security measures

• TLS encryption in transit; database hosted on Supabase with at-rest encryption at the storage layer.
• Role-based access control via Row-Level Security; specialty-based separation between coaches, clinicians, and admins.
• Audit logging on every write to health-sensitive tables (clients, messages, weight log, body composition events).
• Quarterly staff access review — every team member's permissions are revisited every 90 days.
• Service-role credentials stored in a secrets manager, never in source code.
• MFA (TOTP, AAL2) required for every Lifeline staff session before admin access is granted.
• Sentry redaction strips request bodies on health-related routes so error monitoring cannot leak Art. 9 data.

No system is perfectly secure. If you believe your account has been compromised, contact contact@lifelinehealth.is.

10. Your rights

Under the Icelandic Data Protection Act and the EU GDPR you have the right to:

• Access the personal data we hold about you.
• Correct anything that is wrong.
• Delete your data (the "right to be forgotten"), subject to legal retention.
• Restrict or object to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time for marketing or research use.
• Lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd).

To exercise any of these rights, email contact@lifelinehealth.is (our data protection inbox) or submit a request from your account settings under Data & privacy. We respond within 30 days per GDPR Art. 12. Health record requests that need data held in Medalia are coordinated with our joint-controller per the Art. 26 arrangement.

11. Cookies & analytics

We use strictly necessary cookies to keep you signed in. We do not use advertising cookies. Any analytics we run is privacy-preserving and aggregate (no cross-site tracking).

12. Children

Lifeline is not intended for children under 18. If you believe a child has created an account, contact us and we will delete it.

13. B2B (company onboarding) specifics

When your employer onboards you through Lifeline:

• Lifeline acts as a data processor for the contact details your employer provides, and as a data controller for the health data you share directly with us.
• Your employer's contact person can see your name, email, phone, and the last four digits of your kennitala — not your body composition, measurements, or any clinical data.
• Your employer receives only onboarding completion status — nothing clinical.
• If you leave the company, your Lifeline account remains yours. You decide whether to keep it.

14. International transfers

Your data is primarily hosted in the EU. Some of our processors (e.g. Resend) operate in the US under EU Standard Contractual Clauses. We do not transfer data to jurisdictions without adequate protections.

15. Automated decision-making

Lifeline does not make decisions with legal or similarly significant effects based solely on automated processing. All clinically relevant decisions involve a qualified Lifeline physician.

16. Changes to this policy

We will notify you of material changes at least 14 days before they take effect, by email or in-app. The current version is always at lifelinehealth.is/privacy.

17. Contact

Questions, concerns, or requests about your personal data: contact@lifelinehealth.is.

Lifeline Health ehf. · Reykjavík, Iceland