Privacy Policy

Last updated 21 May 2026.

dexa.report turns your DEXA (DXA) scan reports into a personal dashboard. Because those reports are health data, we treat them with care. This policy explains what we collect, why, who processes it, and the choices you have. We try to keep it honest and specific rather than reassuring and vague.

Who is responsible for your data

Data controller: to be confirmed. dexa.report is operated within an EU project; the formal controlling entity will be named here before any non-MVP public launch. Until then, reach us at [email protected] for any privacy question or request.

What we collect

We only collect what the product needs:

• Your account email and an authentication record (handled by our auth provider).
• The DEXA report PDFs (or images) you upload.
• The health metrics extracted from those reports (body composition, bone density, fat distribution, segmental data, etc.).
• The AI summary generated from your metrics.

We do not run third-party advertising or analytics trackers on your health data.

Why we process it, and our legal basis

We process this data solely to provide the dashboard, parsing and AI summary to you. DEXA results are special-category health data under GDPR Article 9. Our legal basis is your explicit consent, which you give at sign-up and can withdraw at any time (see your rights below).

AI processing by Google Gemini

To read your reports and write the summary, your uploaded PDF and the extracted metrics are sent to Google’s Gemini API for processing. This means your health data is processed by Google as a third party, and may be transferred to / processed in a third country (outside the EU) under Google’s terms. We send only what is needed to parse the report and produce the summary. If you are not comfortable with this, please do not upload reports.

Where your data is stored

Account data and extracted metrics are stored in our database hosted on Supabase in an EU region (eu-west-1). Uploaded PDFs are kept in private storage, not a public bucket. Every record is protected by row-level security so that only your account can read your scans, PDFs and summary.

How long we keep it

We keep your data while your account is active. You can delete any scan from your dashboard at any time, which removes its metrics and the stored PDF. To delete your whole account and all associated data, contact us at [email protected].

Your rights

Under GDPR you can:

• access the data we hold about you;
• correct inaccurate data;
• erase your data (the per-scan delete, or full account deletion on request);
• export your data (the dashboard offers a CSV export);
• withdraw your consent at any time;
• lodge a complaint with your national data-protection authority.

Changes to this policy

If we change how we handle your data, we will update this page and the “last updated” date. Material changes affecting consent will be surfaced in the app.

Contact

Questions or requests: [email protected].