1. Who is responsible for your information?
Pathhealth is currently a founder-operated service in development, not a registered company. The person responsible for the processing of personal data is Garvin Greene, trading as Pathhealth, domiciled in Cali, Valle del Cauca, Colombia.
Privacy requests can be sent to care@pathhealth.ai. This policy must be updated if the legal operating entity changes.
2. Information we collect
Depending on how you use Pathhealth, we may collect:
- identity and contact details, including name, email address and telephone number;
- account, authentication and service-selection information;
- payment status and transaction references supplied by our payment provider;
- appointment, testing and service-coordination information;
- sensitive health data, including health goals, symptoms, medical history, medicines, lifestyle information, laboratory documents, test results and clinical reports;
- communications and support requests; and
- security and technical information such as IP address, browser information, timestamps and audit records.
3. Sensitive health data
Health information is sensitive personal data. Before submitting the health intake, you will be asked for prior, express and informed authorisation. Providing sensitive data is voluntary, but Pathhealth may be unable to provide the requested health-related service without the information reasonably needed to coordinate and review it.
Please do not submit health information about another person unless you have lawful authority to do so.
4. Why we use your information
We process personal data only for relevant purposes, including to:
- create, secure and administer your account;
- provide information about available panels and services;
- coordinate appointments, laboratory testing and related logistics;
- support authorised clinical review and prepare and deliver reports;
- process payments, refunds and transaction records;
- communicate service updates and respond to requests;
- protect the service, prevent misuse and maintain audit records;
- improve the reliability and usability of Pathhealth using appropriately limited information; and
- comply with legal, regulatory and professional obligations.
We will request separate permission before using personal data for optional marketing where that permission is required.
5. Who may receive information
We disclose only what is reasonably necessary to people and providers supporting the service. These may include authorised Pathhealth operations staff and clinical reviewers; laboratories and collection providers selected for the service; payment providers; and providers of hosting, secure storage, authentication, email, document handling, security and technical support.
Current technology providers include Supabase for database, authentication and file storage; Vercel for website hosting; Stripe for payment processing; and Resend for service email. Provider roles may change, and this policy will be updated when a material change affects how personal data is processed.
Pathhealth does not sell personal or health information. A laboratory will not be described as a Pathhealth partner until that relationship has been formally verified.
6. International processing
Pathhealth is based in Colombia, while some technology providers and infrastructure operate in other countries. Personal data may therefore be transmitted to or processed outside Colombia, including through infrastructure hosted in the European Union and services operated internationally.
We will use contractual, technical and organisational safeguards appropriate to the provider and the information involved. The final international-transfer and transmission arrangements remain subject to specialist Colombian legal review before full public launch.
7. AI-assisted workflows
Pathhealth may use software tools to extract, organise or draft information from laboratory documents. These tools do not approve, diagnose or release a clinical report. A suitably authorised human reviewer must review and approve clinical content before release.
Pathhealth is still validating the contractual and privacy controls required before real patient information is processed through an artificial-intelligence provider. Training and demonstrations use fictional data.
8. How we protect and retain information
We use access controls, protected accounts, role-based permissions, private document storage, audit records and encrypted network connections. No internet service can guarantee absolute security.
Information is retained only for as long as reasonably necessary for the purposes described above and to meet applicable legal, regulatory, clinical-record, accounting and dispute-resolution requirements. Pathhealth is obtaining specialist advice before setting final category-specific retention periods. When retention is no longer required, information will be securely deleted or anonymised where appropriate.
9. Your rights
Subject to applicable law, you may:
- ask whether and how your personal data is being processed;
- access and obtain information about your data;
- request correction or updating of inaccurate or incomplete data;
- request evidence of the authorisation you provided;
- ask how your data has been used and to whom it has been disclosed;
- withdraw authorisation or request deletion where legally permitted; and
- raise a complaint with Colombia’s Superintendencia de Industria y Comercio after completing the applicable direct request procedure.
To exercise a right, email care@pathhealth.ai with your name, the right you wish to exercise, a clear description of the request and information reasonably necessary to verify your identity. We may ask for additional verification to protect health information. Requests will be handled within the periods required by applicable law.
10. Children
The current Pathhealth service is intended for adults aged 18 and over. Do not create an account or submit information for a child.
11. Changes and contact
We may update this policy as the service, providers, legal entity or applicable requirements change. Material changes will be highlighted through the website or an appropriate direct notice.
Questions, requests and complaints should be sent to care@pathhealth.ai.