Who we are
Nexus Health is a personal health tracking application developed by Clare Goult. For the purpose of this policy, “we”, “us”, and “our” refers to Clare Goult as data controller.
Clare Goult is registered with the Information Commissioner’s Office (ICO) under registration number ZC121404.
Contact: clare@nexushealthapp.com
What data we collect
We collect only the data you choose to enter:
- Account data: email address, password (stored as a bcrypt hash — we cannot read it)
- Health data: blood test results, medications, appointments, symptoms, vital signs, and documents you upload
- Contextual data: sleep, stress, and other social determinants of health you choose to record
- Environmental data: air quality and pollen data fetched for your postcode district from public APIs (Open-Meteo, Met Office)
- Activity logs: a record of actions taken within the app (data access and changes), stored to protect the integrity of your health record
- Imported result data: test result data imported from the NHS App via the NexusCapture browser extension, as verified and confirmed by you before saving
We do not collect advertising data, sell data to third parties, or use tracking cookies.
Why we process your data
| Purpose |
Legal basis |
| Providing the app and storing your health records |
Contract (your use of the service) |
| Securing your account and detecting misuse |
Legitimate interest |
| AI-assisted interpretation of blood results |
Contract — you explicitly request this feature |
| Compliance with legal obligations |
Legal obligation |
Who we share data with
No one, except the infrastructure providers below who process data on our behalf under data processing agreements:
- Railway (backend hosting and PostgreSQL database) — servers in the EU or US depending on region selected at setup
- Netlify or Vercel (frontend hosting) — static files only, no health data
-
Anthropic — if you use the AI interpretation feature, blood result data is sent to the Anthropic API to generate an interpretation. Anthropic’s privacy policy applies to that processing.
When you use NexusCapture to import results from the NHS App, result text (including test names, values, units, reference ranges, dates, and provider details such as GP and laboratory names) is transmitted to Anthropic’s API for parsing.
No patient identifiers — including NHS number, date of birth, or name — are included in this transmission. Result text is not stored by Anthropic after processing.
- Open-Meteo and Met Office — your postcode district (not full postcode) is sent to fetch environmental data. No personal data beyond postcode district is transmitted.
Data retention
We retain your data for as long as your account is active. You can delete your account and all associated data at any time from Settings. Deletion is immediate and permanent. Anonymised activity log entries (with your identity removed) may be retained for security purposes.
Your rights (UK GDPR)
You have the right to:
- Access your data — export is available from Settings
- Rectify incorrect data — you can edit records within the app
- Erasure — delete your account and all data from Settings
- Portability — export your data as JSON from Settings
- Object to processing — contact us directly
- Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk (our ICO registration number is ZC121404)
To exercise any right, contact: clare@nexushealthapp.com
Security
- All data is transmitted over HTTPS
- Passwords are hashed with bcrypt (cost factor 12) and never stored in plaintext
- Access tokens expire after 15 minutes. A refresh token (valid for 30 days) is used to issue new access tokens automatically without requiring you to log in again.
- All data access is logged in an audit trail
Not medical advice: Nexus Health is a personal record-keeping tool. Nothing in this application constitutes medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional before making decisions about your health.
Changes to this policy
We will notify you of material changes by updating the date at the top of this document. Continued use of the app after changes constitutes acceptance.