Privacy policy

Who processes your data

The data controller is MB „Zinify Labs“. For anything about your data, write to privatumas@ilgai.life.

What data we process

• Account data: the email address and name we receive from Google when you sign in. We never receive your password.
• Health data from the Lithuanian e-health portal (e. sveikata): visits, diagnoses, doctors' notes, tests, prescriptions, vaccinations and referrals, the names of doctors and institutions in them, and your name, date of birth and sex. National personal codes (yours and your doctors') are removed in your browser and never reach us.
• Data you enter: planned visits, test results typed in by hand, uploaded test reports (PDFs or photos) and the state of your reminders.
• Consents: which consent you gave or withdrew, when, for which version of its text, and your IP address at the time.
• Technical data: the sign-in cookie and server logs (IP address, time, request).
• Website visit data, only if you accept cookies: which ilgai.life pages you visited, where you came from, your browser, device and cookie identifiers. Google collects it.

Why, and on what legal basis

• To run your account and the service (sign-in, showing your records, reminders, notifications): performance of a contract (GDPR Art. 6(1)(b)).
• To process health data: your explicit consent (GDPR Art. 9(2)(a)), given before the first import.
• For processing by artificial intelligence (Ilgai DI): your explicit consent (GDPR Art. 9(2)(a)), given together with the health-data consent. The service cannot work without it, as it is built on Ilgai DI.
• Consent records: the legal obligation to show that you consented (GDPR Art. 6(1)(c), 7(1)).
• Server logs: our legitimate interest in keeping the service secure and fixing errors (GDPR Art. 6(1)(f)).
• Measuring website visits and ad results: your consent (GDPR Art. 6(1)(a)), given in the cookie banner.

We do not sell health data or use it for advertising or for training AI models. We make no automated decisions with legal or similarly significant effects on you. Reminders are based on your records and general guidelines: they are not a medical opinion.

The Chrome extension

• It works only on pacientas.esveikata.lt and ilgai.life.
• It reads records only after you have logged in to e. sveikata yourself and started an import from Ilgai. It never sees your passwords, never reads cookies and changes nothing in e. sveikata.
• It removes national personal codes before sending anything, and sends records only to your own Ilgai account.
• It keeps a short-lived (60-minute) upload token in the browser's memory only: it is gone when the browser closes.
• It does not collect browsing history and sends data to no one else.

Service providers

Only these providers process data, and only as far as their service needs:

• Hostinger: the server that stores all data. It is in Lithuania (EU).
• Google: sign-in with a Google account and, if you accept cookies, measuring visits to ilgai.life and ad results (Google Tag Manager and the Google tools it loads). Google never receives health data.
• OpenRouter, with Anthropic or Google models: Ilgai DI processing. Doctors' notes are sent without your or your doctors' names, personal codes, phone numbers or email addresses; files you upload are sent as they are. Processing runs on EU-region servers, and the data is neither retained nor used to train models.
• Resend: only if you turn on email reminders. An email contains only the number of reminders and a link, never health information.

Where a provider operates outside the EEA, data is transferred under the safeguards the GDPR provides for, such as the European Commission's standard contractual clauses. We would disclose data to public authorities only when the law requires it.

How long we keep data

• Account, health and entered data: while you have an account. Deleting the account deletes everything at once.
• Withdrawing the health-data consent deletes all imported records and everything derived from them: reminders, visits, tests, uploaded files.
• Withdrawing the AI consent deletes automatically extracted data you have not confirmed and the descriptions Ilgai DI prepared. Confirmed data stays.
• Consent records: while you have an account.
• The sign-in cookie: up to 7 days.
• Google's measurement cookies: until you withdraw consent, and no longer than 2 years.
• Server logs: briefly, for as long as security and error fixing need them.

Your rights

• Get your data: "Paskyra" (Account) → "Atsisiųsti mano duomenis" (Download my data).
• Delete your data: "Paskyra" → "Ištrinti paskyrą ir duomenis" (Delete account and data).
• Withdraw consents at any time under "Paskyra". Withdrawal does not affect processing before it.
• Ask us to correct your data, restrict its processing, or object to it: write to privatumas@ilgai.life. We reply within a month.
• Lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt).

We can't correct records in e. sveikata itself: your healthcare institution can.

Security

Data travels only over encrypted connections (HTTPS). In the database, each user's data is separated by row-level security, so one account cannot reach another's data.

Cookies

The app uses a single necessary cookie, "ilgai_session", which keeps you signed in. The app and the Chrome extension have no analytics or advertising cookies.

On the website ilgai.life, and only if you accept, Google Tag Manager loads Google cookies to measure visits and ad results. Until you accept, nothing is loaded from Google. You can change your choice at any time with "Cookie settings" at the bottom of the page.

Age

Ilgai is for people aged 18 and over, and only for importing your own records.

Changes

We will announce significant changes to this policy in the app. If what you consented to changes, we will ask for your consent again.