Privacy Policy

Welcome to Heme Heroes ("Heme Heroes," "the App," "the Platform," "we," "our," or "us").

Heme Heroes is a health education and self-management support platform designed to support individuals and families living with thalassemia by providing health record management, treatment tracking, blood transfusion management, appointment scheduling, medication reminders, educational resources, and AI-supported informational and estimation features.

This Privacy Policy explains how we collect, use, process, store, protect, and disclose your information when you use our mobile applications, web-based administrative dashboard, backend services, artificial intelligence features, and related health-support services.

By creating an account, accessing, or using Heme Heroes, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by applicable law, we will request it through an appropriate consent mechanism; use of the App does not override rights that cannot lawfully be waived.

1. Scope of this Privacy Policy

This Privacy Policy applies to all components of the Heme Heroes platform, including:

• Patient Mobile Application
• Administrative Web Dashboard
• Backend API Services
• AI-supported information and estimation features
• Push notification services
• Website and related services (if applicable)

2. Information We Collect

To provide the App's health-support and self-management functions, we may collect the following categories of information.

A. Personal Information

Depending on how you use the Platform, we may collect:

• Full name
• Email address
• Phone number
• Date of birth
• Age
• Gender
• Preferred language
• Country or region
• Account credentials
• User role (Patient, Parent/Guardian, Healthcare Professional, Administrator)

B. Health Information

Users or authorized healthcare professionals may create and manage health records, including:

• Thalassemia diagnosis
• Blood group
• Blood transfusion history
• Blood transfusion dates
• Blood transfusion volume
• Hemoglobin (Hb) values
• Serum ferritin levels
• Iron chelation therapy
• Medication records
• Medication adherence
• Laboratory reports
• Medical documents
• Clinical appointments
• Hospital information
• Doctor information
• Treatment plans
• Clinical observations
• Medical history relevant to thalassemia
• Other health information voluntarily provided by users or authorized healthcare professionals

Health information is treated as sensitive personal information and is processed with appropriate safeguards.

C. Uploaded Files

Users or authorized healthcare professionals may upload:

• Laboratory reports
• Medical images
• Clinical documents
• Supporting healthcare records

Uploaded files may be securely processed (such as image optimization) before storage to improve application performance.

D. Device and Technical Information

When you use Heme Heroes, we may automatically collect:

• Device model
• Device manufacturer
• Operating system
• App version
• Device language
• Device identifiers
• IP address
• Browser information (Dashboard)
• Log files
• Error reports
• Performance diagnostics
• Connection information

For users who are children or of unknown age, device identifiers and other data are handled subject to the age-related restrictions and applicable Google Play Families requirements described in Section 13.

E. Notification Information

To deliver reminders and alerts, we collect:

• Firebase Cloud Messaging (FCM) device tokens
• Notification preferences
• Notification delivery status

F. Usage Information

We may collect information about how you interact with the Platform, including:

• Features used
• Login history
• Session activity
• Navigation patterns
• Reminder interactions
• Educational content viewed
• AI feature usage

3. How We Use Your Information

We use your information to:

• Create and manage user accounts
• Authenticate users securely
• Maintain electronic health records
• Display patient medical information
• Schedule appointments
• Track blood transfusions
• Monitor laboratory values
• Record medications
• Send medication reminders
• Send blood transfusion reminders
• Send appointment reminders
• Deliver healthcare notifications
• Provide multilingual support
• Deliver educational content
• Support treatment adherence and self-management
• Generate AI-supported informational responses and serum ferritin estimates where the relevant feature is used
• Improve platform performance
• Monitor service availability
• Detect fraud and unauthorized access
• Maintain system security
• Comply with legal and regulatory obligations
• Support approved research activities where the participant has separately provided the required informed consent

We use your information only for the purposes described in this Privacy Policy and for other compatible purposes permitted by applicable law. Personal and health information will not be used for unrelated purposes without appropriate notice or consent where required.

4. Artificial Intelligence (AI) Features

Heme Heroes incorporates AI-supported technologies to provide general thalassemia information, self-management support and a serum ferritin estimation feature.

AI features may assist with:

• Educational guidance
• Treatment adherence support
• Patient engagement
• General information about thalassemia, transfusions, medicines, iron chelation, nutrition and related self-management topics
• Generation of an estimated serum ferritin value using information required by the model

To provide these features, relevant information may be processed, including:

• Age
• Weight
• Hemoglobin values
• Ferritin levels
• Blood transfusion history
• Medication information
• Treatment adherence
• Other health information required for the requested AI functionality

Only the information necessary to provide the requested AI feature is processed.

The AI information assistant provides general educational and supportive information. It does not diagnose medical conditions, prescribe treatment or replace a qualified healthcare professional. AI-generated information may be incomplete or inaccurate.

Users should not enter unnecessary personally identifying information into the AI information assistant.

Users should always consult qualified healthcare professionals before making healthcare decisions.

5. Legal Basis for Processing

Where applicable, we process personal information based on:

• Your consent
• Performance of services requested by you
• Provision of healthcare services
• Compliance with legal obligations
• Legitimate interests in maintaining security, improving healthcare delivery, and operating the Platform

For sensitive health information, we rely on your explicit consent or another lawful basis permitted under applicable law.

Where Heme Heroes is used for an approved research study, research participation and research-related processing are governed by a separate informed-consent process and the applicable study protocol.

6. User Roles and Access Control

Heme Heroes implements role-based access control.

Access to information is restricted according to user roles, including:

• Patients
• Parents or legal guardians
• Healthcare professionals
• Medical staff
• Administrators

Users may only access information necessary for their authorized responsibilities.

Unauthorized access is prohibited.

7. Data Storage and Security

Protecting your information is a priority.

We implement appropriate technical and organizational safeguards, including:

• HTTPS/TLS encrypted communications
• Secure authentication using JSON Web Tokens (JWT)
• Role-based authorization
• Secure database management
• Password hashing
• API security controls
• Access logging
• Server monitoring
• Secure file handling
• Routine software updates
• Backup and recovery procedures
• Protection against unauthorized access

Although we use industry-standard security measures, no electronic storage or transmission method can be guaranteed to be completely secure.

8. Third-Party Services

To operate the Platform, Heme Heroes uses third-party technologies and service providers that process information as necessary to provide their services.

These include, where enabled in the production version:

• Firebase Authentication
• Firebase Cloud Messaging
• Firebase Realtime Database
• OpenAI services
• MySQL database infrastructure
• Secure backend hosting services

Third-party providers may process personal, technical or health-related information only to the extent required for the relevant service. Their processing is also subject to their applicable privacy and security terms.

Heme Heroes does not sell users' personal or health information and does not authorize service providers to use users' health information for unrelated advertising or marketing purposes.

9. System Logs and Monitoring

To ensure the reliability and security of the Platform, we maintain technical logs that may include:

• IP addresses
• Request timestamps
• Error logs
• Authentication events
• Security events
• Device information
• Performance metrics

These logs are used exclusively for security, troubleshooting, auditing, fraud prevention, and system maintenance.

10. Automated Background Processing

The Platform uses automated background services to:

• Generate medication reminders
• Schedule appointment notifications
• Send blood transfusion reminders
• Deliver healthcare alerts
• Maintain system performance

These automated processes operate without requiring continuous user interaction.

Reminder and notification functions are organizational tools and do not determine when treatment, transfusion or medical assessment is clinically required.

11. Sharing of Information

We do not sell, rent, or trade your personal or health information.

Information may be shared only:

• With authorized healthcare professionals involved in your care
• With authorized administrators managing healthcare services
• With trusted service providers supporting Platform operations
• When required by law or court order
• To protect the rights, safety, security, or property of users or the public
• During a merger, acquisition, or organizational restructuring, subject to applicable legal protections
• With authorized members of an approved research team where the participant has provided the required informed consent and the sharing is consistent with the applicable study protocol

12. Data Retention

We retain information only for as long as necessary to:

• Provide healthcare services
• Maintain medical records
• Comply with legal obligations
• Resolve disputes
• Improve healthcare services
• Protect system security
• Meet applicable ethical and research-record retention requirements where information is collected as part of an approved research study

When information is no longer required, it is securely deleted, anonymized, or archived in accordance with applicable law.

Where research information must be retained after a participant withdraws for ethical, scientific, legal or regulatory reasons, the applicable research consent documentation should explain that retention.

13. Children's Privacy

Heme Heroes is designed to support people living with thalassemia, including children and adolescents, together with their parents, guardians or caregivers.

Where required by applicable law, accounts for minors must be created, authorized or managed with appropriate parent, legal guardian or other authorized adult involvement.

We do not knowingly collect personal information from children without appropriate authorization.

We seek to limit children's personal and sensitive information to data reasonably necessary for the App's disclosed functions. Heme Heroes does not knowingly use children's personal or health information for targeted advertising.

If social or community features are made available to child users, those features must be implemented with the age-appropriate safety reminders, adult management controls and adult action required before children can exchange personal information.

14. Your Privacy Rights

Subject to applicable law, you may have the right to:

• Access your information
• Correct inaccurate information
• Update your account
• Request deletion of your account
• Withdraw consent where applicable
• Request a copy of your personal information
• Request correction of incomplete information

Where applicable, you may also request deletion of associated personal data, subject to lawful retention requirements described in this Privacy Policy.

Requests may be submitted using the contact information below.

15. Account and Data Deletion

If Heme Heroes allows users to create an account, users can request deletion of their account and associated data through a readily discoverable in-app deletion path and through an external web resource.

Account deletion webpage: https://www.hemeheroes.com/account-deletion

Following a valid deletion request, associated user data will be deleted except where specific information must be retained for legitimate legal, security, ethical, healthcare-record or research obligations. Any retained information will be limited to what is required and handled in accordance with applicable requirements.

Deletion of an App account and withdrawal from an approved research study may be separate processes. Research participants should follow the withdrawal procedure described in their informed-consent documentation.

16. Push Notifications

The Platform may send notifications relating to:

• Medication reminders
• Blood transfusion reminders
• Clinical appointments
• Educational updates
• Healthcare alerts
• Important account or security notices

You may disable notifications through your device settings; however, some features may not function as intended.

Notifications are supportive reminders and are not medical advice or a substitute for instructions from a qualified healthcare professional.

17. Educational Content

Heme Heroes provides articles, videos, audio, and other educational resources to support thalassemia awareness and self-management.

Educational content is provided for informational purposes only and should not be considered medical advice.

18. Research Use

Heme Heroes may be used as part of approved health research involving people living with thalassemia. Participation in research is voluntary and, where applicable, is governed by a separate informed-consent process describing the research purpose, procedures, data use, confidentiality, withdrawal rights, relevant ethical approval and any study-specific retention requirements.

Declining or withdrawing from research participation will be handled according to the applicable study protocol and informed-consent documentation. Research participation does not remove the privacy rights available to users under applicable law.

19. International Data Transfers

Your information may be processed or stored on secure servers located in jurisdictions other than your country of residence.

Where international transfers occur, we implement reasonable safeguards designed to protect your information in accordance with applicable data protection laws.

20. Medical and AI Disclaimer

Heme Heroes is a health education and self-management support application. Heme Heroes is not a medical device and does not diagnose, treat, cure or prevent any medical condition.

The Platform does not provide emergency medical services. Information provided through the App, including educational content, AI-generated information, reference information and serum ferritin estimates, is for informational and self-management support purposes and is not a substitute for laboratory testing, professional medical diagnosis, treatment or clinical judgment.

Always consult a qualified healthcare professional before making medical decisions.

Never disregard professional medical advice or delay seeking medical care because of information provided by Heme Heroes.

21. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, technology, address or legal requirements.

The updated version will be made available within the Platform or through our official website.

Where required by applicable law, we will provide additional notice or obtain consent for material changes. The 'Last Updated' date will identify the current version.

22. Contact Us

If you have any questions, requests, or concerns regarding this Privacy Policy or your personal information, please contact us.

For research-related questions or withdrawal requests, users should use the research contact information provided in the applicable participant information and informed-consent materials.

23. Consent and Acknowledgment

By creating an account, accessing, or using Heme Heroes, you acknowledge that you have read and understood this Privacy Policy. Where consent is the applicable legal basis for processing, Heme Heroes will obtain the required consent through an appropriate mechanism, including explicit consent for sensitive health information where required by law.

Research consent, where applicable, is separate from acceptance of this Privacy Policy and is governed by the relevant study informed-consent process.