• Account/contact: name, phone/WhatsApp, email (some may be hashed or encrypted).
• Health inputs & service data: symptoms you type/select, triage results, consult notes, referral letters.
• Device/usage: identifiers, logs, events (e.g., lexy_start/complete, consult_booked/paid).
• Payments: amounts, status (no card numbers stored by us).
• Google User Data (if connected):
  1. Gmail: email metadata (sender, subject, timestamp).
  2. Google Calendar: event titles, times, participants.
  3. Google Drive: file metadata (title, type, owner).
  4. Google Contacts: names, emails, phone numbers. We do not access or store full content of emails, files, or messages.

• Provide triage & telemedicine (contract).
• Ensure safety/emergency guidance (vital interest).
• Messaging nudges & CSAT with your consent (you can opt out anytime).
• Security, fraud prevention, audits (legitimate interests).
• Legal compliance (regulatory, retention).
• Google User Data Usage:
  1. Used only to deliver healthcare services (e.g., scheduling consults via Calendar, retrieving referral letters from Drive, contacting you via Gmail/Contacts).
  2. Not used for advertising or unrelated analytics.

• Health information is sensitive. We apply strict access, encryption, and retention controls.
• Our services are intended for adults (18+). If we learn we collected a child's data without guardian consent, we will take reasonable steps to delete it.

• Processors: Hosting, WhatsApp BSP, analytics, email/SMS, payments—bound by Data Processing Agreements.
• Partners (WL/HMO/API): Only per contract and purpose limitation.
• Legal requests, safety, or mergers: Shared as required by law.
• Google User Data Sharing:
  • Never sold or shared for advertising.
  • Shared only with contracted processors or healthcare partners strictly for care delivery.

Encryption at rest/in transit; role-based access; logging and monitoring; incident response.

• Encrypted at rest and in transit.
• Access is role-based and logged.
• Stored only on secure servers compliant with NDPA and Google API Services requirements.

We use analytics/ads pixels and server-side conversions. You can adjust preferences or opt out as available.