Privacy policy
This policy explains how digitalmiles.org (“we”) handles information in the Sehat Diary app, currently shown as WeHealth on your phone, and on this website. Medical reports are sensitive, so please read it carefully.
Who is responsible
digitalmiles.org is responsible for your information. For any privacy question or request, email contact@digitalmiles.org.
What we collect
- Your phone number, to sign you in with a WhatsApp code and identify your account.
- Medical reports you add: photos and PDFs of lab reports, prescriptions and scans.
- Details read from them: tests, results, dates, doctors, labs and patient names.
- Family members you add: the names you use for them, their relation to you and the name printed on their reports.
- Your Ask AI questions and the answers. Chat history is kept on your phone and isn’t backed up, but questions are sent to our AI provider to answer them.
- Your consent decisions: what you chose, when, and which version you saw.
- Usage and security information: dates you used the app, number of reports, app version, phone type (Android or iPhone), and records of requests to our servers, including your IP address and the IDs of items involved. These records do not contain report contents.
We do not use advertising trackers, and this website sets no cookies.
Why we use it, and our legal basis
| Purpose | Legal basis under GDPR, where it applies |
|---|---|
| Reading reports and answering questions with AI | Your explicit consent (Articles 6(1)(a) and 9(2)(a)) |
| Backing up and restoring your reports | Your explicit consent (Articles 6(1)(a) and 9(2)(a)) |
| Signing you in and running your account | Providing the service you asked for (Article 6(1)(b)) |
| Security, preventing misuse, and understanding overall usage | Our legitimate interest in a safe, working service (Article 6(1)(f)) |
| Keeping proof of consent and meeting legal duties | Legal obligation (Article 6(1)(c)) |
Your consent
We ask for your consent after you sign in, and again if you try to add a report or use Ask AI without having accepted. You can reject or withdraw at any time in the app under Account and backup. Withdrawing stops new AI use and backup, but does not undo earlier use. Without consent you can still view reports on your phone, but you can’t add reports or use Ask AI.
Who receives your information
| Provider | What it does | Location |
|---|---|---|
| OpenAI | Reads report pages and answers questions. It may keep this data for up to 30 days for safety monitoring. | United States |
| Amazon Web Services | Hosts our servers, database and backups. | Singapore |
| Meta (WhatsApp) | Delivers sign-in codes. It receives your phone number and the code, but no reports. | Global |
| Expo | Delivers app updates. It receives technical information such as your device’s IP address, but no reports. | United States |
We do not sell your information or use it for advertising. We may disclose information if the law requires it.
International transfers
Your information is processed outside your country, including in Singapore and the United States, where privacy laws may differ. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses and your explicit consent. Ask us for details using the email above.
How long we keep it
- Reports, details and family members: until you delete them or your account. Backup copies are removed within 35 days after that.
- Temporary copies for AI reading: report pages are uploaded to temporary storage and deleted after reading, and removed within two days at the latest. What was read from them is kept for up to an hour so the app can collect it.
- Sign-in codes: stored in scrambled form and removed within about two hours.
- Server and security records: six years. They contain no report contents.
- Consent records: while your account exists. They are deleted with it, apart from what appears in server records.
Security
Information is encrypted in transit and in our cloud storage. Files are private, and reached only through links that expire after five minutes. The app opens with your phone’s own lock. Your reports also stay on your phone, protected by your phone’s security, so keep it locked and up to date. No system is perfectly secure. If a breach affects you, we will tell you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your information, to receive a copy in a portable format, and to withdraw consent. You can also complain to your data protection authority. Email contact@digitalmiles.org to make a request, and we will reply within one month.
Deleting your account
In the app, open Account and backup and choose Delete account and all reports. This removes your reports and family members from our cloud and your phone straight away, and backup copies within 35 days. You can also request deletion by email from your registered number.
Children and family members
You must be 18 or older to use Sehat Diary. If you add a child’s or another person’s reports, you confirm you are allowed to do so, as their parent or guardian or with their permission. A family member can ask us about their information using the email above.
HIPAA
Sehat Diary is a personal app for families and isn’t offered on behalf of US healthcare providers or insurers. We do not claim HIPAA compliance. Once shared, some information may no longer be protected by health privacy laws such as HIPAA.
Changes to this policy
We will update the date above when this policy changes. If a change affects how we use your information, we will ask for your consent again in the app.