Privacy Policy

This Privacy Policy explains how CreatureHealth ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use our application — available on the web at mycreaturehealth.com and as a mobile app for Android and iOS.

The data controller responsible for your personal data is Patryk Kuszczak (sole trader), based in Poland. You can reach us at privacy@mycreaturehealth.com (full postal address available on request).

2.1 Account & identity data

You can sign in with your email address (we email you a one-time code), or with Apple, Google or Facebook. In every case, via AWS Cognito, we receive and store:

• Your email address
• Your display name (if provided by your sign-in provider)
• The sign-in method used (email, Apple, Google or Facebook) and a unique authentication identifier

If you sign in with an email one-time code, that code is sent to your email only to sign you in, is valid for a short time, and is not retained after use. Signing in with email collects nothing beyond your email address.

Setting a password is optional. If you choose one, it is managed securely by AWS Cognito — we never store or see your password. We do not store your provider profile picture.

2.2 Your animals

• Name, species, breed, date of birth, sex and whether the animal is neutered
• Weight, the weights you log over time, a healthy weight range and body condition scores
• Chronic conditions, if you mark any
• An optional photo of your animal
• Microchip ID and free-text notes, if you add them

2.3 Health records you add

• Lab result files you upload (PDF documents or photos/images)
• Test parameters and values — extracted automatically by AI or entered manually (test name, value, unit, reference range, status, laboratory name, test date, result type such as blood, urine, stool, allergy, ultrasound (USG), MRI, X-ray, cardiac or genetic)
• Health events — vet visits (veterinarian, clinic, reason, date, and any photos or scans of visit documents you attach), medications (name, dose, frequency, schedule, and the doses you mark as given) and symptoms
• Diets — diet type (commercial, BARF or mixed), details, dates, notes and a diet-plan file if you attach one

2.4 Technical data (collected automatically)

• Device type, operating system and app version
• IP address and approximate region
• Application and error logs used for debugging and security

We use your data only to operate and improve the service:

• To create and manage your account and authenticate you securely
• To store and display your animals' profiles, health records, charts and history
• To extract structured values from the lab results you upload (see Section 4)
• To keep the service secure, prevent abuse, diagnose errors and fix bugs
• To count visits to our marketing site (www.mycreaturehealth.com) so we know whether people find it — no account is involved, nothing is stored in your browser, and the basis is our legitimate interest in knowing whether the site works; see PostHog in Section 6

Anonymized data

Some of what you record has value beyond your own account: how a lab parameter moves over time, how often a symptom shows up in a breed, what a healthy weight curve looks like. We reserve the right to use such data — only once it has been anonymized — to develop and improve CreatureHealth, to build features like reference ranges, trends and comparisons, to train our own models, and to share or license the anonymized dataset to third parties, including on commercial terms.

Producing that set from your records rests on our legitimate interest, so you can object at any time: email privacy@mycreaturehealth.com and we will exclude your records, with no effect on how you use the app. If you do not want anything of yours kept this way after you delete your account, tell us before you delete it — afterwards your email is gone from our systems, so we can no longer tell which records were yours.

Legal bases (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)) — providing the features you sign up for, including storing your records and running AI extraction at your request
• Legitimate interests (Art. 6(1)(f)) — security monitoring, abuse prevention, service improvement, and producing the anonymized datasets described above
• Consent (Art. 6(1)(a)) — where we ask for it; you may withdraw consent at any time

When you upload a lab result, we help you turn it into structured data:

• The file is sent to our backend and forwarded to the Google Gemini API (model gemini-3.1-flash-lite, or gemini-3.5-flash-lite for cardiac tests) to identify the test type and extract values (name, value, unit, reference range) and a short summary.

To improve how accurately we read your documents, we measure where the AI gets it wrong: when you save, we compare what the AI extracted with what you ultimately keep, and send our product analytics only a technical signal — which parameters were corrected (e.g. "protein") and what kind of change it was (a row added, removed, or a value, unit or status fixed). We do not send the values themselves, the uploaded file, or any personal data — only parameter identifiers and change types, tied to a pseudonymous account identifier. This relies on our legitimate interest in improving the service; you can object at any time at privacy@mycreaturehealth.com.

• All your data is hosted on Amazon Web Services (AWS) in the eu-central-1 region (Frankfurt, Germany) — within the European Union.
• Data in transit is encrypted with HTTPS / TLS.
• Uploaded files (lab results, animal photos) are stored in private Amazon S3 storage — not publicly accessible — and encrypted at rest (S3 server-side encryption, AES-256).
• Your records are stored in an Amazon RDS PostgreSQL database running in a private network that is not publicly accessible.
• Authentication is managed by AWS Cognito.
• We never use your data for advertising.

We rely on a small number of processors, each under their own data-processing terms:

International transfers

Your data is stored in the EU. However, when you use AI extraction (Google), when the app reports an error (Sentry, in the United States), or when you sign in with Apple, Google or Facebook, those providers may process the relevant data outside the European Economic Area. Such transfers are covered by the providers' safeguards, such as the EU Standard Contractual Clauses.

We keep your personal data for as long as your account is active. You can delete your account at any time from the app: Profile → Delete account.

When it is carried out, we permanently erase everything that identifies you or your animal:

• Your sign-in account at AWS Cognito — you can no longer log in.
• Your email address, your name and the sign-in method you used.
• Every file you uploaded — lab-result PDFs and photos, your animals' photos, vet-visit scans and diet plans — is deleted from our file storage.
• Your animals' names, microchip IDs and notes.
• The values read from your lab results, the laboratory's name and the original file names.
• Free text you typed and text recognised from your documents: the veterinarian's and the clinic's name, the reason for a visit, symptom descriptions, what a medication was prescribed for, and diet notes.

If you would rather that remaining record was not kept at all, email privacy@mycreaturehealth.com before you delete your account and we will remove it too — see Section 3.

Separately, our server logs are kept only for a short period (around 7 days) and are then deleted automatically. Error reports sent to Sentry are kept for the retention period of our Sentry plan and are then deleted by Sentry.

If you are in the European Economic Area, you have the following rights:

To exercise any of these rights, email privacy@mycreaturehealth.com. We respond within 30 days.

CreatureHealth is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. Continued use of the service after an update constitutes acceptance of the revised Policy.

For any question about this Policy or to exercise your rights, contact us:

We aim to respond to all privacy requests within 30 days. For complex requests we may extend this by up to a further 60 days and will tell you if we do.