Get the Fitalthy app
Tap Share, then Add to Home Screen.
Free · opens straight from your home screen.
Fitalthy · policy
Your family's medical records are the most sensitive thing you will ever hand to a piece of software. This says exactly what we do with them, what we will never do with them, and how to make us stop.
Fitalthy is operated by Fitalthy (Private) Limited. Registered in Pakistan with the Securities and Exchange Commission of Pakistan (SECP).
| Registration | [SECP incorporation number — to be inserted] |
|---|---|
| Tax number | [FBR National Tax Number — to be inserted] |
| Registered office | [Registered office address — to be inserted] |
| Data protection contact | dpo@fitalthy.com |
| Privacy questions | privacy@fitalthy.com |
We are the controller of everything described here: we decide what is collected and why, and we are accountable for it. Doctors you consult through Fitalthy are separate controllers of their own clinical notes and prescriptions — they are licensed professionals with their own obligations, and we do not direct their clinical record-keeping.
Pakistan does not currently have a comprehensive data protection statute in force. The Personal Data Protection Bill 2023 has been approved by the Federal Cabinet and through public consultation, but not yet passed by both houses of Parliament, and the National Commission for Personal Data Protection (NCPDP) it provides for is provided for by the draft bill; not yet operating as a supervisory authority. Many Pakistani services claim to comply with that bill. We are not going to claim compliance with a law that has not been passed.
What does bind us in Pakistan today:
What binds us for users outside Pakistan, which is a large share of the people paying for their parents' records:
What we do about the gap. Rather than apply the weakest standard that covers us, we apply the strongest one to everybody: the rights in section 5 are given to every user in every country, and we hold ourselves to the Personal Data Protection Bill 2023's requirements now, before it becomes law. If and when it is passed and the National Commission for Personal Data Protection (NCPDP) begins operating, we will register as required and say so here.
Legal position last reviewed 26 September 2026. We re-check it quarterly and date this section when it changes.
Everything below comes from you or from a document you gave us. We do not buy data about you, we do not obtain it from brokers, and we do not track you across other websites.
| What | Specifically | How it is classified |
|---|---|---|
| Medical documents you photograph or upload | Lab reports, prescriptions, discharge notes, scans, vaccination cards — the image or PDF itself, and the text read from it. | Sensitive personal data. Treated as sensitive everywhere, including in countries whose law does not require it. |
| The values read out of those documents | Haemoglobin, blood sugar, creatinine and so on, with the units and the reference range your laboratory printed. | Sensitive personal data. |
| Measurements you enter yourself | Blood pressure, weight, height, pulse, temperature, oxygen saturation. | Sensitive personal data. |
| Who is in your household | Names, relationships, dates of birth, sex, blood group, and any allergies or ongoing conditions you choose to record. | Sensitive personal data for the health parts; ordinary personal data for the rest. |
| Your account | Email address, phone number, password (stored only as a one-way hash, never as text), language, country, time zone. | Ordinary personal data. |
| Consultations | Which doctor, when, what was discussed if either of you wrote it down, and any prescription issued. | Sensitive personal data, and subject to clinical confidentiality as well. |
| Payments | Amount, currency, date, method, and the reference your wallet or card provider returns. We never see or store a full card number or a wallet PIN. | Ordinary personal data. |
| Technical records | IP address, device and browser type, pages visited, and errors. Kept for security and for fixing what is broken. | Ordinary personal data. |
Health data is sensitive personal data under every framework that applies to us, and we treat every medical document and every value in it that way regardless of which country you are in.
| Purpose | Lawful basis |
|---|---|
| Reading a document you uploaded and explaining it in plain language | Your explicit consent, given when you upload it. This is the core of the service and you can withdraw it. |
| Filing records to the right person and keeping them available to your household | Performance of our contract with you. |
| Charting a value over time and telling you it has drifted | Your explicit consent. |
| Sharing your history with a doctor you booked | Your explicit consent, given for that consultation, plus the doctor's own basis for providing care. |
| Taking payment and keeping accounts | Contract, and legal obligation for tax records. |
| Keeping accounts secure and investigating abuse | Legitimate interests — yours as much as ours. |
| Answering a complaint or a data rights request | Legal obligation, and our own commitment in section 5. |
What we never do. We do not sell personal data. We do not sell aggregated or "anonymised" health data either — de-identified health data is notoriously re-identifiable and there is no version of this business that depends on it. We do not share your records with insurers, employers, pharmaceutical companies or advertisers. We do not use your medical documents to train anybody's AI model. We do not show advertising.
These apply to every user in every country, not only where the law requires them.
| Right | What it means here |
|---|---|
| Know | What we hold about you and your family, where it came from, and who it has been shared with. |
| See | A copy of everything — every document, every value, every measurement — exported in a format you can open without us. |
| Correct | Anything wrong. A misread value, a misspelled name, a report filed under the wrong person. |
| Delete | A single document, one family member's whole record, or the entire household. |
| Object | To any processing you did not ask for. In practice there is very little: we do not profile you and we do not advertise. |
| Withdraw consent | At any time, without giving a reason, and without losing access to the records already explained to you. |
| Take it elsewhere | A machine-readable export, so leaving Fitalthy never means leaving your history behind. |
| Complain | To us, free of charge, and — once Pakistan's supervisory authority begins operating — to it, and to your own country's regulator if you live abroad. |
How to exercise any of them: use the complaints and data rights form, which gives you a reference number and a deadline on the spot, or email dpo@fitalthy.com.
What it costs: nothing. How long we take: within 30 days, usually far sooner. If a request is genuinely complex we will tell you inside those 30 days why, and by when.
Acting for someone else. Most of our users manage records for a parent. If the person can consent, we will ask them. If they cannot — dementia, serious illness, a child — tell us the relationship and we will deal with you, because the alternative is a policy that protects nobody and blocks the daughter doing the caring.
Cancelling your subscription never deletes your medical records. Nobody is removed from your household, nothing is erased, and everything stays readable and exportable. Holding a family's medical history hostage to a monthly payment would be indefensible, so we have written the commitment into the policy where it binds us.
| What | How long | Why |
|---|---|---|
| Medical documents and the values read from them | Until you delete them, or 90 days after you delete your household | They are the family's record, not ours. Cancelling a subscription never deletes them. |
| Health measurements you entered yourself | Same as above | Same reason. |
| Account and household details | Life of the account, then 90 days | The 90 days is a grace period for accidental deletion. |
| Consultation records and prescriptions | 10 years from the consultation | Clinical records have their own retention expectations, and a doctor may need to account for their advice. |
| Payment records | As long as tax and accounting law requires, currently 6 years | We do not get to choose this one. |
| Complaints and data rights requests | 3 years from closure | So a pattern of the same failure is visible rather than forgotten. |
| Security and access logs | 12 months | Long enough to investigate a breach, short enough not to be a second copy of your life. |
| Backups | Rolling 35 days | A deletion reaches backups within 35 days, because backups cannot be edited row by row. |
When you delete something it is removed from the live service immediately and from backups within 35 days. Backups cannot be edited row by row, which is why that number is 35 and not zero — and we would rather tell you that than imply a deletion is instantaneous everywhere.
People you chose. The family members you add to your household, and any doctor you book a consultation with — who sees the history you share for that consultation and nothing else.
Companies that run parts of the service for us. These are processors: they act on our instructions, may not use your data for their own purposes, and are bound by contract.
| Who | What they do | Where |
|---|---|---|
| Namecheap (shared hosting) | Application hosting and encrypted storage of records | United States |
| Cloudflare (Workers AI) | Reads a document to produce a plain-language explanation | United States and Cloudflare's network |
| JazzCash (Jazz / Mobilink Microfinance Bank) | Mobile wallet payments in Pakistan | Pakistan |
| Easypaisa (Telenor Microfinance Bank) | Mobile wallet payments in Pakistan | Pakistan |
| Stripe | Card payments outside Pakistan | United States / Ireland |
| PayPal | Card and wallet payments outside Pakistan | United States |
| Email delivery provider | Transactional email — sign-in, receipts, complaint acknowledgements | United States |
The AI that explains your report receives the text of that document in order to explain it, and nothing else — not your name, not your family, not your history. The provider is contractually barred from training on it.
Nobody else, unless a court or a law obliges us, in which case we will tell you unless we are legally forbidden from doing so.
Some of the companies above are outside Pakistan, so your data crosses borders. We tell you this plainly because a policy that hides it is a policy that is lying about where your mother's reports live.
Where the receiving country's law is weaker than the standard in this policy, we rely on contractual protections — Standard Contractual Clauses or their equivalent — that require the recipient to hold your data to the standard described here. You can ask dpo@fitalthy.com for a list of exactly which mechanism covers which processor.
If there is a breach that puts you at risk, we will tell you — directly, in plain language, saying what happened, what data was involved and what to do — and we will notify the relevant authority where we are required to. See the Personal Data Protection Policy for the procedure and the timings.
Fitalthy is used by families, and families include children. A child's records are managed by the adult responsible for them, not by the child, and we do not offer accounts to under-18s in their own name.
A child's health data is sensitive data belonging to the child. When they reach adulthood they can ask us to move their records into their own account, or to delete them, and we will do it without requiring the parent's permission.
We use one essential cookie: the one that keeps you signed in. Without it the service cannot work, so there is nothing to consent to and no banner to dismiss.
We do not use advertising cookies, tracking pixels, or third-party analytics that follow you elsewhere. If that ever changes, it will require your consent first, and this section will say so before it happens.
Fitalthy explains and remembers medical documents. It does not diagnose and it does not treat. It tells you what each value measures and repeats the reference range your own laboratory printed beside it. It will not tell you whether a result is normal or abnormal, will not name a condition, and will not recommend a medicine — not if you ask it to. That boundary is enforced in the code and covered by tests. See Safety.
This matters for privacy as well as for safety: because the app does not form clinical opinions, there is no hidden profile of what we think is wrong with you. The only health information in your record is what your own documents say and what you entered yourself.
If we change something that materially affects your rights or what we do with your data, we will tell you before it takes effect — by email, not by quietly editing this page — and the top of the document will show the new version and date.
Previous versions are kept. Ask privacy@fitalthy.com if you want to see what a clause said on a particular date.
| Data protection and your rights | dpo@fitalthy.com |
|---|---|
| Privacy questions | privacy@fitalthy.com |
| Anything else | support@fitalthy.com |
| Registered office | [Registered office address — to be inserted] |
Complaining costs nothing and does not affect your service. Use the complaints form — you get a reference number and a deadline immediately.
If we do not resolve it, you can escalate: in Pakistan to the National Commission for Personal Data Protection (NCPDP) once it begins operating; in the UK to the Information Commissioner's Office; in the EU to your national data protection authority; in Saudi Arabia to SDAIA; in the UAE to the UAE Data Office. You do not have to come to us first, though we would rather you did, because we can usually just fix it.