Privacy Policy

1. Who we are

Healogy.ai (the “Platform”) is operated by Pairox Pty Ltd (ACN 154 477 728), a company incorporated in New South Wales, Australia (“Pairox,” “we,” “us,” or “our”). Pairox is the data controller / data fiduciary for the personal data described in this policy. Our Privacy Officer is reachable at privacy@healogy.ai.

This policy explains what personal data we collect, why, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have. It applies to our website, mobile apps, and related services. It incorporates and is incorporated by our Terms of Service, our Cookie Notice, and our Medical Disclaimer.

2. Categories of personal data we collect

We collect the following categories of personal data. Sensitive / special-category categories are marked, and the legal basis for those is your explicit consent (see Section 4).

3. How and why we use your data (purposes)

• To provide the Service. Create and manage your account, generate AI readings and astrology content from your birth data, facilitate bookings and live video sessions with practitioners, and operate messaging.
• To process payments. Take payments, manage subscriptions and wallet balances, pay practitioners, and handle refunds and disputes.
• To send you communications you ask for. Transactional email, and SMS or WhatsApp reminders where you opt in. If you turn on text messages, we send them through Twilio to the mobile number you give us. We never share or sell your mobile number or your text message opt-in with third parties or affiliates for their marketing. If you reply STOP, we keep that number on a do-not-text list so we never text it again, even after you delete your account.
• To keep the Platform safe. Detect and prevent fraud, abuse, and security incidents.
• To meet legal obligations. Tax, financial-record-keeping, and consumer-protection requirements.
• To improve the Platform. We use analytics in your browser and apps only where you have agreed to them, and our servers count sign-ups, AI readings, upgrade steps, card activity, bookings, event tickets and payments. We do not use your readings, messages, care-record content, session recordings, or wearable data to train AI models (see Section 4).

Support replies and AI

Replies to the support emails and messages you send us may be written by our AI assistant. Every such reply is checked automatically before it is sent, and a reply written by AI says so. Before your message reaches the AI, names, email addresses, phone numbers, links and long runs of digits are masked. Messages about a crisis are never sent to it. The providers involved are listed in Section 5.

When you call or message the practitioner support line, the care desk checks the number against the phone numbers on practitioner accounts to route the request; a match is never treated as proof of who you are, and account matters are answered only by email to the account’s own address.

Automated decisions

Computer programs, including AI, make some decisions about your support conversations: they answer routine support questions, close messages that are obviously spam, and close a conversation that has been answered once 7 days pass without a reply from you. Everything else is passed on for review. You can ask for any decision to be reviewed. To ask, reply to the conversation or email support@healogy.ai.

Rules and an AI check decide practitioner applications. An application that passes every rule is approved, one with a missing detail is asked for more information, and anything the rules cannot confirm is decided by hand. The AI check reads only the text typed into the application form, never ID documents or other files, and it can only send an application to be decided by hand, never approve one. You can ask us to look at any decision again: reply to the decision email or email support@healogy.ai.

Practitioners’ published business contacts

We hold lists of independent practitioners’ business contact details. Before we contact anyone, we check the address or profile on the practitioner’s own page or public listing, and we note that page and the date we checked it. We use these details only to invite the practitioner to join Healogy.ai.

• We write at most twice.
• With no reply, we delete the practitioner’s details within 90 days of the first message.
• A reply of “stop” deletes them. Our mail provider’s recovery copy clears on its own schedule, usually within a few weeks.
• Either way, we keep only a scrambled copy of the email address, so we never write to it again.
• A practitioner who replies and then goes quiet is deleted after 180 days with no activity on their record.

Questions about this go to support@healogy.ai.

4. Legal bases for processing

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Explicit consent (Article 9(2)(a)) for all health and special-category data — your spiritual, religious, and philosophical beliefs (the belief systems and traditions you choose to follow), birth/astrology data, AI-reading inputs, wearable health metrics, care-record entries, and health-screening data. You can withdraw this consent at any time (Section 7).
• Performance of a contract (Article 6(1)(b)) — to provide the account, bookings, and payments you have signed up for.
• Consent (Article 6(1)(a)) — for analytics/marketing cookies and optional communications.
• Legitimate interests (Article 6(1)(f)) — for fraud prevention and platform security, and for counting sign-ups, AI readings, upgrade steps, card activity, bookings, event tickets and payments to understand how the service is used, balanced against your rights.
• Legal obligation (Article 6(1)(c)) — for tax and financial record-keeping.

For users in Australia, we handle personal and sensitive information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (sensitive information is collected only with consent, per APP 3). For users in India, we process personal data on the basis of consent under the Digital Personal Data Protection Act, 2023 (DPDP Act). For users in California, we honor CCPA/CPRA rights; we do not sell your personal data.

No AI training on your personal data. We do not use your readings, messages, care-record content, session recordings, or wearable data to train, fine-tune, or develop AI/ML models without your separate, specific, written consent. We may use aggregated, anonymized data that does not identify you for service improvement.

5. Service providers (sub-processors)

To run Healogy.ai we share the minimum necessary data with the service providers below. Each provider we contract with is bound by a data-processing agreement and may only use the data to provide its service to us. Your browser's push service is not one of them: the company that makes your browser runs it. We never see or store your full card number — card data is entered directly with Stripe.

Some companies handle your data under their own privacy policies, not ours: Google or Apple when you sign in with them, the App Store or Google Play when you buy in our phone apps, and Meta for the messages you send us on Instagram or Messenger and the messages we send you on WhatsApp.

6. How we protect and limit use of sensitive data

• Encryption at rest. Care-record entries and the rich wearable payloads are encrypted with AES-256-GCM. Wearable OAuth tokens are encrypted at rest and are never written to logs.
• Consent-gated sharing. Your care record is private by default. A practitioner can only see an entry if you grant a specific, revocable consent.
• Audit logging. Every practitioner-side read of your care record or wearable data is recorded so you can see who accessed what, and when.
• Purpose limitation. Practitioners may use information you share only to deliver your sessions — never for marketing, for other clients, or to train AI models.

7. How long we keep your data (retention)

We keep personal data only as long as needed for the purpose you provided it, then delete or anonymize it — except where the law requires us to keep specific records for a fixed period. The detailed windows are set out in our Terms of Service §10; in summary:

• Tax and financial records — 5 years (Australian tax law).
• Billing and transaction records — 3 years (chargeback/dispute window).
• Security event logs (sign-in, sign-up and password-reset attempts and administrator data exports, with the IP address and device string of each) — 12 months, then automatically deleted.
• Security incident records (when our systems detect an attack: the rule that fired, attempt counts and the source network shortened to its first three IPv4 blocks or the first 48 bits of an IPv6 address) — kept in our tamper-evident audit trail, which cannot be edited or deleted.
• Fraud and abuse records — 12 months.
• Grievance and dispute correspondence — 3 years.
• Session recordings — we do not record live sessions or classes. Audio and video are streamed in real time through our live-video provider and are not saved. A practitioner may record a session themselves only with your explicit consent; if they deliver that recording to you through Healogy.ai’s post-session delivery, it is stored with that session’s post-session files. If we ever offer recording, it will be off unless both you and the practitioner agree to it at the time, and we will update this policy, including how long recordings are kept, before any session is recorded.
• Post-session notes and files (what a practitioner delivers to you after a session) — kept while your account is active so you can go back to them; deleted when you delete your account, the files within 2 days. If the practitioner deletes their account, what they delivered to you stays available to you. A file uploaded but never attached to a delivery is deleted within 2 days.
• Practitioner application documents (your government ID and any certificates or licences you upload) — kept while your application or your practitioner account exists. If your application is declined we still keep them; we do not yet delete them on a set date after a decision. When your account is deleted (Section 8), we remove the documents from your application and delete the stored files within 9 days. A file that is uploaded but not attached to any application is deleted within 9 days. When your account is deleted we also delete the answers you typed into the form, the coded copy of your government ID number, if you gave one, and the reviewer’s notes kept with your application and documents. We keep a record that an application was made, its decision and its dates. Our staff activity log, which cannot be edited, keeps each review decision with the reviewer’s note. If you were approved as a practitioner, your practitioner profile and earnings records are not yet removed automatically when your account is deleted; email privacy@healogy.ai and we will finish it.
• Camera scans (palm, face and the other photo readings) — the photo is sent to our AI provider (Anthropic, see Section 5) to produce the reading and is never saved on our servers. The reading it produces (the analysis and its clarity score) is kept for 90 days, then automatically deleted. If a reading is flagged by our safety checks or reported to us, an excerpt of it is kept with that safety review. A minimal record that a scan happened (its type and date) is kept while your account is active and deleted with it.
• Gift recipient details (the name, email address and message entered for a gift) — if a gift checkout is never paid for, deleted 30 days after it began; on a paid gift, deleted 30 days after the gift expires; and removed straight away if the person who redeemed the gift deletes their account. The payment record itself is kept as described above.
• Account/profile data, AI-reading history, birth/astrology data, care-record entries, and wearable samples — kept while your account is active; deleted or anonymized on account deletion, subject only to the legal-hold carve-outs above.

8. Your data protection rights

Depending on where you live, you have some or all of the following rights over your personal data. We honor these for users in the EU/EEA and UK (GDPR / UK GDPR), India (DPDP Act, 2023), Australia (Privacy Act 1988 / Australian Privacy Principles), and California (CCPA/CPRA), and we extend them to all users as a matter of policy.

• Access. You can ask for a copy of the personal data we hold about you.
• Portability. You have the right to receive the personal data you provided to us in a structured, commonly-used, machine-readable format (we provide JSON), and to reuse it elsewhere. Where you ask and it is technically feasible, we will help you move it to another service. This applies to data you provided that we process on the basis of consent or contract.
• Correction. You can ask us to correct inaccurate or incomplete data, including from within your account settings.
• Erasure (“right to be forgotten”). You can delete your account and ask us to erase your personal data. A 30-day grace period applies, during which you can cancel by signing in; after that, your data is permanently erased except for the limited records the law requires us to keep and the items Section 7 says are kept.
• Restriction & objection. You can ask us to restrict, or object to, certain processing.
• Withdraw consent. Where we rely on your consent (including for health, wearable, and astrology/birth data), you can withdraw it at any time — for example, by disconnecting a wearable, revoking a care-record share, or deleting the data. Withdrawal does not affect processing that already happened.
• Do Not Sell or Share (California). We do not sell your personal data. You can exercise the “Do Not Sell or Share My Personal Information” control from the cookie preference centre in our footer.
• Complain. You can complain to us (privacy@healogy.ai, attn. Privacy Officer) or to your local data protection authority — for example, the Office of the Australian Information Commissioner (OAIC), your EU/EEA supervisory authority, the UK ICO, or the Data Protection Board of India.

How to exercise your rights. Signed-in users: Settings → Privacy. Anyone: email privacy@healogy.ai or use the controls on our Your privacy rights page. We respond to verified requests within 30 days. We may ask you to confirm your identity before acting on a sensitive request.

9. Getting a copy of your data (right of access and data portability)

You can ask us for a copy of the personal data we hold about you at any time. If you have an account, go to Settings → Privacy → Request my data; if you don’t, contact us at privacy@healogy.ai.

Format. We provide your data in a machine-readable format: a ZIP archive containing a structured JSON file (export.json) with your data, plus a plain-language PDF summary (summary.pdf). The JSON format means you can read, search, or import your data into another service.

What’s included. Your export contains your profile (with security secrets such as passwords removed); your messages (sent and received); your readings, signature and cosmic-DNA profiles, generated cards, daily briefings, angel-number, crystal, manifestation and dream-journal entries, and yearly summaries; your AI assistant sessions, conversations and feedback; transaction and billing records; gifts you sent and gifts you redeemed; post-session notes and files delivered to you (and, if you are a practitioner, those you delivered); your notifications, favourites, camera-scan records and feature-test assignments; your connected accounts, calendars, wearable connections and push-notification devices (without their access tokens); your care-record consents and the log of who viewed your wearable data; — decrypted for your own access — your care-record entries and wearable health samples; and the security events on your account (sign-in, sign-up and password-reset attempts, and administrator exports you ran) — the event, its time and its reason; the IP address and device of each attempt are withheld because the attempt may have been made by someone else. Because some categories can be very large, generous per-category limits apply; if your export reaches a limit, the included summary tells you so and how to request the remainder.

Practitioner application. If you applied to offer services, your export includes your application: the answers you typed, its status and dates, the reviewer’s notes, and a list of the documents you uploaded with the result of each check.

What is not included. The export lists the documents you uploaded with a practitioner application but does not contain the files. To get a copy of a file, email privacy@healogy.ai.

Timeframe. We respond to verified requests within 30 days (consistent with GDPR Articles 15 and 20, the DPDP Act, and equivalent laws), and may extend this where the law permits for complex requests, telling you why. Your download link is available for 7 days, after which you can request a fresh one.

Sensitive data. Your care record and wearable readings are health data. We decrypt them in your export only for you; the export is delivered over a secure, time-limited link.

10. Where your data is handled

Pairox Pty Ltd is an Australian company. Our main database and the servers behind our website and phone apps are in the United States (Virginia), so most of the personal data we hold is stored and processed there. Our customer-care system and the support conversations it keeps are in Australia (Sydney). The table in Section 5 shows where each provider handles your data. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (2021/914) or equivalent mechanisms.

Your personal data is likely to be sent outside Australia. The providers in Section 5 handle it in these other countries and regions: United States, Ireland, Switzerland, European Union, New Zealand, France, Singapore, Belgium, Netherlands, Japan, Malaysia.

Some providers also handle it in places that depend on where you are or what you use: Google's data centres in other countries, the Vercel location nearest you and your browser maker's push service.

11. Children

Healogy.ai is for adults. You must be 18 or older to use the Platform. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, notify you by email or in-app notice.

13. Contact

Privacy and data matters: privacy@healogy.ai (Privacy Officer). General support: support@healogy.ai. You can also use our contact page or the Your privacy rights self-service controls.