SarcoLife

SarcoLife Companion Privacy Notice

Last updated: 6 October 2026

Who we are

SarcoLife Companion ("SarcoLife", "we", "us") is a digital health organisation and self-management support platform designed to help people living with sarcoidosis and other chronic health conditions organise and understand their own health information.

SarcoLife is not a healthcare provider and does not provide diagnosis, treatment, emergency care or personalised medical advice.

The data controller for SarcoLife Companion is Bibian Aletor, operating SarcoLife Companion as an individual. You can contact us about privacy at sarcolife.health@gmail.com.

Information we collect

Depending on the features you choose to use, SarcoLife may process:

  • your name and email address
  • account and authentication information
  • subscription and billing status
  • health information you voluntarily enter
  • symptoms and daily check-ins
  • medications
  • appointments
  • diagnoses and health history
  • pulmonary function and other medical test results
  • laboratory results
  • medical documents you upload
  • journal entries
  • health goals
  • Health Memory information
  • information you voluntarily provide when using Ask SarcoLife
  • technical and security information needed to operate and protect the service

Health information

Health information is "special category" personal data under UK data-protection law and receives extra protection. You choose what health information you enter into SarcoLife.

For health information you choose to provide for SarcoLife's health-management features, we rely on your explicit consent under Article 9(2)(a) UK GDPR. You give this consent separately when you create your account, and you can withdraw it at any time in Profile → Privacy & consent.

Our lawful bases

Under Article 6 UK GDPR we rely on different lawful bases for different purposes:

  • Contract (Article 6(1)(b)): to create and run your account and provide the SarcoLife features you ask for, including your subscription.
  • Legitimate interests (Article 6(1)(f)): to keep the service secure, prevent misuse, fix problems and respond to support requests.
  • Legal obligation (Article 6(1)(c)): to keep records we are required to keep by law, for example tax records about payments.

Where health information is involved, we also rely on your explicit consent (Article 9(2)(a)) as described above. We do not use consent as the lawful basis for every activity.

Why we use your information

  • to provide the SarcoLife service
  • to let you record and organise your health information
  • to provide symptom, medication, appointment, journal and results features
  • to provide Health Memory, where you have it switched on
  • to provide Ask SarcoLife, where you choose to use it
  • to maintain your account and subscription
  • to provide customer support
  • to maintain security and prevent misuse
  • to meet applicable legal and regulatory obligations

AI and Ask SarcoLife

Ask SarcoLife and SarcoLife's summaries use artificial intelligence (AI) to provide general information and help you organise your own records. Ask SarcoLife is not a doctor or healthcare professional. It can make mistakes and must not be relied on for diagnosis, treatment decisions or emergencies.

Your personal health information is only made available to Ask SarcoLife in line with your Health Memory and privacy choices in the app. For example, if you switch Health Memory off, Ask SarcoLife does not use your stored records or memories when answering. When you use these features, the relevant text is sent to our AI service provider to generate a reply.

Payments

Subscription payments are processed by Stripe. Your full card details are entered into and held by Stripe; SarcoLife does not store your full payment-card details. We receive your subscription status, billing period and limited payment information from Stripe.

Who we share information with

We use trusted service providers where needed to run SarcoLife. They act on our behalf and may only use your information to provide their services to us:

  • Lovable (Lovable Cloud): website hosting, database, sign-in (authentication) and private file storage, running on Amazon Web Services infrastructure.
  • Lovable AI Gateway: provides the AI models used by Ask SarcoLife and summaries.
  • Lovable transactional email: sends account emails such as sign-up confirmation and password reset.
  • Stripe: subscription payment processing.
  • Google: only if you choose to sign in with Google, to confirm your identity.

We do not sell your health information or any other personal information, and we do not use it for advertising. We may disclose information if required by law.

International transfers

Not all of your information stays in the UK. Our main database and file storage are hosted in the European Economic Area (Paris, France), which the UK recognises as providing adequate protection. Some of our service providers (including AI, email, authentication and payment providers) may process information in other countries, including the United States. Where information is transferred outside the UK, we rely on recognised safeguards such as UK adequacy regulations (including the UK–US "data bridge" for certified organisations) or the UK International Data Transfer Addendum to standard contractual clauses. You can contact us for more information about these safeguards.

How long we keep information

We keep personal information only for as long as necessary for the purposes described in this notice, including running your account, meeting legal obligations, resolving disputes and keeping the service secure. When information is no longer needed, we delete or anonymise it.

Security

We use appropriate technical and organisational safeguards, including secure sign-in, access controls, private file storage and database row-level access controls so that each person's records can only be accessed by their own account. However, no online system can be guaranteed to be completely secure.

Your rights

Under UK data-protection law you have the right to:

  • access the personal information we hold about you
  • have inaccurate information corrected
  • have your information erased
  • restrict how we use your information
  • data portability, where applicable
  • object to processing, where applicable
  • withdraw your consent at any time where we rely on consent

You can withdraw your health-data consent in Profile → Privacy & consent. Withdrawing consent does not make processing carried out before you withdrew it unlawful. Withdrawal does not delete your account or records; if you would like your data erased or exported, please email us.

To exercise any of your rights or ask a question about privacy, email sarcolife.health@gmail.com. We will respond within one month, as required by law.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to address your concerns first.

Changes to this notice

We may update this notice from time to time. If we make material changes, we will tell you appropriately, for example by email or in the app, and ask for fresh consent where required. See also our Terms of Use.