Privacy Policy

1. Who we are

Zelos (“Zelos”, “we”, “us”) runs the website at zelos.health and the Zelos app. Zelos, based in Croatia, is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything about privacy, contact us at info@zelos.health.

2. What we collect

When you join the waitlist

• Your email address, and the date you signed up.
• Technical data your browser sends with every request, such as your IP address and browser type. We use your IP address only for a few minutes, to stop automated sign-up abuse. Our hosting provider keeps short-lived request logs for security and reliability.

When you use the website

• We don’t use analytics, advertising or tracking cookies, and we don’t load third-party trackers. Fonts are served from our own domain.
• If you switch between light and dark mode, the choice is saved in your browser’s local storage (zelos-theme). It never leaves your device.

When you use the app

• Account details: name, username, email address, and your sign-in method (password, passkey, or Google / Apple sign-in).
• Profile details you choose to add, such as birth date, sex, height and training level. We use these to personalise ranges.
• Health and activity data from devices you connect, such as Garmin, Whoop, Google Health (Fitbit, Pixel Watch) and Apple Health. This includes heart rate, heart-rate variability, sleep, activity and workouts, stress, body composition and blood pressure, depending on the device.
• Lab reports you upload, and the blood-test results read from them.
• Connection tokens from your wearable providers. We store these encrypted so we can keep syncing.

Health data is a special category of personal data. We process it only because you explicitly ask us to, by connecting a device or uploading a report, and only to provide the service to you.

3. How we use it, and why we’re allowed to

• To run the waitlist and send your invite and launch updates. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• To provide the app: syncing your devices, building your dashboard, baselines and comparisons, and reading your lab reports. Legal basis: our contract with you (Art. 6(1)(b)), and your explicit consent for health data (Art. 9(2)(a)).
• To keep the service secure and working: preventing abuse, fixing errors, and protecting accounts. Legal basis: our legitimate interests (Art. 6(1)(f)).
• To meet legal obligations, where the law requires us to keep or disclose information (Art. 6(1)(c)).

We don’t sell your data, rent it, or use it for advertising. We don’t use your health data to train AI models. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. The ranges and statuses in the app are information, not medical judgements.

4. Who we share it with

We use a small number of service providers that process data on our behalf, under contract and only on our instructions:

• Resend: stores waitlist contacts and sends our emails.
• Vercel: hosts the website and the app.
• Neon: hosts the app’s database.
• Anthropic: reads the values from lab reports you upload. Reports are processed only to extract your results, and Anthropic doesn’t use them to train its models.

When you connect a wearable, we exchange data with that provider (for example Garmin, Whoop, Google or the Health Auto Export app for Apple Health) under your account with them. Their own privacy policies apply to the data they hold.

We may also disclose data if the law requires it, or to protect the rights and safety of our users or of Zelos. If Zelos is ever merged or acquired, your data would only move to the new owner under this policy, and we’d tell you first.

5. International transfers

Some of our providers may process data outside the European Economic Area. Where they do, we rely on safeguards the GDPR recognises, such as the European Commission’s Standard Contractual Clauses or an adequacy decision (including the EU–US Data Privacy Framework).

6. How long we keep it

• Waitlist email: until you unsubscribe, ask us to delete it, or we close the waitlist. If you never create an account, we delete it within 12 months of launch.
• Account and health data: for as long as you keep your account. Disconnecting a device deletes the data it sent. Deleting your account deletes your data, apart from anything we must keep by law. Backups are overwritten within 30 days.
• Request and security logs: kept briefly, usually no more than 30 days.

7. How we protect it

Data is encrypted in transit (HTTPS), and wearable connection tokens are encrypted at rest. Access to production systems is restricted. Sign-in supports passkeys. No system is perfectly secure, but if a breach ever affects your data, we will tell you and the authorities as the law requires.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy;
• correct data that’s wrong or incomplete;
• have your data deleted;
• restrict or object to how we process it;
• receive your data in a portable format (the app has a full export);
• withdraw your consent at any time — for example by unsubscribing, disconnecting a device or deleting your account — without affecting what happened before.

Every email we send has a one-click unsubscribe link. For anything else, email info@zelos.health; we reply within one month. You can also complain to a data protection authority — in Croatia, the Croatian Personal Data Protection Agency (AZOP) — or to the authority where you live.

9. Children

Zelos is not meant for anyone under 16, and we don’t knowingly collect their data. If you believe a child has signed up, contact us and we’ll delete it.

10. Changes to this policy

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll tell you by email or in the app before it takes effect.

11. Contact

Questions, requests or concerns about your data: info@zelos.health.