Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account information: Your name and email address when you create an account. These are used to identify you and provide access to your personal vaccination file. Your data is encrypted at rest and in transit, is never shared with third parties for advertising or marketing purposes, and is only used to provide the core functionality of the application.
• Family profiles: Within the Family Profiles feature, you can create profiles for family members whose vaccination records need to be digitised. We collect their name, date of birth, and gender. This information is necessary to create a personal file, determine age-appropriate vaccine recommendations, and ensure the advice provided is relevant to each individual.
• Vaccination records: Records you add manually or via the camera scanning feature, including vaccine names, dates, and notes.
• AI chat history: Questions and responses from your interactions with the AI assistant. These are stored on our servers to allow us to conduct regular quality audits and ensure accurate, safe communications with users.
• Usage data: App interactions, feature usage, and crash reports to help us improve the application.
• Device information: Device type, operating system, and app version.

2. Camera Access

Vaccines.app requests access to your device camera to allow you to take photos of existing vaccination records (such as vaccination booklets, cards, or certificates). The captured image is securely transmitted to a trusted third-party AI service for image recognition processing. The AI reads and analyses the record to automatically populate your vaccination history, identify missing vaccines, and generate a personalised catch-up plan.

Example: If you photograph a vaccine booklet, the app will extract the dates and vaccine names from the image and add them to that family member's profile — saving you from entering the information manually.

We do not store, upload, or retain any photos, images, or videos taken through the app. All image processing is performed transiently, and images remain on your device. They are never saved to our servers.

3. How We Use Your Information

We use collected information to:

• Create and manage your account and family profiles.
• Determine relevant and age-appropriate vaccination schedules based on each individual's date of birth and gender.
• Process and respond to AI assistant queries.
• Audit AI chat interactions to maintain the quality and accuracy of responses provided to users.
• Analyse vaccination records captured via camera to identify completed and missing vaccines.
• When it's live, It can process payments for consultation bookings.
• Improve the application through analytics and crash reporting.
• Send important service-related communications.

4. Health Data

Vaccines.app collects and stores vaccination records, which are considered sensitive health data. We treat all health-related information with heightened security measures.

5. Data Storage & Infrastructure

Your account data, family profiles, and vaccination records are stored securely on our servers using a reputable, enterprise-grade cloud database platform. All data is encrypted at rest and in transit, ensuring it remains protected at all times. This allows you to access your records securely from any device at any time.

AI chat history is stored on our servers (not only on your device) so that we can conduct regular quality audits and ensure accurate communications with users.

Images and photos captured via the camera feature are not stored on our servers. They are processed transiently and remain on your device only.

6. AI Assistant & Third-Party AI Services

Our AI chat assistant uses a Retrieval-Augmented Generation (RAG) approach. Responses are generated by trusted third-party AI providers (such as OpenAI or Google Gemini) using our curated medical knowledge base as context.

Medical knowledge base: Our AI is trained on a curated dataset collected and vetted by a licensed paediatric healthcare consultant, drawing from authoritative public health sources including:

• NHS — National Health Service (UK)
• WHO — World Health Organisation
• CDC — Centres for Disease Control and Prevention (USA)

Third-party AI data usage: According to OpenAI, OpenAI's API does not train on customer data by default and retains inputs and outputs for a short abuse-monitoring window (Reference 1, Reference 2). Also, Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction (Reference).

We store AI chat conversations on our servers to conduct regular quality audits and ensure the accuracy and safety of the information provided to users.

7. Third-Party Services

We integrate with trusted third-party service providers to deliver core functionality, including:

• Cloud database & authentication provider — Secure, enterprise-grade infrastructure used to store your account data, family profiles, and vaccination records. All data is encrypted at rest and in transit.
• AI language model provider — A trusted third-party AI service used to power the in-app assistant. Queries are processed using our curated medical knowledge base as context.
• Stripe — Payment processing for consultation bookings.
• Cal.com / Google Meet — Consultation scheduling and video/phone appointment services.
• Subscription and in-app purchase management services (App Store / Google Play).
• Error tracking and performance monitoring services.

Each third-party provider is contractually obligated to protect your data and use it only for the purposes of providing their services.

8. Consultation Feature

The consultation feature allows users to book appointments with qualified, licensed healthcare professionals to discuss vaccination queries, catch-up schedules, travel vaccines, and general immunisation concerns.

The feature acts as a directory and booking portal. When you tap "Book Consultation", you can browse profiles of available healthcare professionals, including their names and licence numbers, and schedule a video or phone appointment. Payments are processed securely via Stripe, and appointments are managed through Cal.com or Google Meet.

Consultation sessions are documented by the healthcare professional and retained as medical records for the individual using the service. These records are maintained independently by the healthcare provider and are not stored within or linked to the Vaccines.app platform.

9. Biometric Data

We do not collect, store, or transmit biometric data.

10. User Consent

When you open the app for the first time, you will be prompted to review and consent to this Privacy Policy. You may only use the app if you agree to the collection and use of your data as described in this policy. Camera access is requested separately and only when you choose to use the scanning feature.

11. Data Retention & Account Deletion

You can access, view, and export your data at any time directly within the application. If you wish to delete your account and all associated data, you may do so through the app settings.

Upon requesting account deletion, your account and all linked data will be permanently deleted after 30 days. This grace period allows our team to review your experience and gives you the opportunity to restore your account if you change your mind. All data is automatically and permanently deleted at the end of this 30-day period.

If you have an active premium subscription, please ensure you cancel it through your App Store or Google Play account settings before deleting your account to avoid future charges.

12. Your Rights

a) Access Your Data

You can view all your personal data — including profile information, family members, and vaccination records — directly within the app at any time.

b) Edit Your Data

You can edit certain profile information directly in the app. However, some fields cannot be changed after creation because your vaccination schedules and records are generated based on them.

If you entered incorrect information for a non-editable field (such as date of birth or gender), please delete the family member profile and recreate it with the correct details.

c) Delete Your Data

You can request deletion of your account and all associated data at any time from the app settings. Your data will be permanently deleted within 30 days of the request.

d) Export Your Vaccination Records

You can export your vaccination records in a portable format for your personal records or to share with healthcare providers.

13. Children's Privacy

Users must be at least 16 years old to create an account. Family tracking features allow parents and guardians to store vaccination records for children under their care. This data is controlled by the parent or guardian account holder and is subject to the same security and privacy protections described in this policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted within the application and will take effect immediately. We encourage you to review this policy periodically.

15. Contact

For questions about this Privacy Policy, contact us at contact@vaccines.app.