ClinicsDoctorsTreatmentsResourcesWho we areTry PATHHow fertilityPATH collects, stores, and uses your data. Reproductive-health data is special-category personal data under UK GDPR; we keep what we hold to the minimum needed to operate the service and we expose your rights through self-service controls.
Policy version: 2026-05-27. Bumping this version triggers an in-app re-consent prompt for existing users so the record of what you agreed to stays current.
Account information you give us when you sign up: your email and authentication metadata. If you choose to add it, your full name.
Onboarding answers you provide when you first use the patient app: stage of your fertility journey, age, diagnosis (if any), goals, and other context PATH needs to personalise its responses.
Conversations you have with PATH, including any clinical numbers (AMH, AFC, FSH, semen analysis, etc.), medical history, and feelings you share.
Medical documents you choose to upload — for example, lab reports or letters from your clinic. These remain in your private vault unless you explicitly share them.
Clinic-interaction metadata: which clinic profiles you view, save, or request consultations from.
Standard request metadata required to operate the service: IP address, user-agent, timestamps. We do not maintain a long-term log of this.
Personalising PATH's responses to your situation — age, stage, diagnosis, and the numbers you've shared.
Surfacing clinic and treatment matches in the directory.
Operating long-term memory across sessions (paid tier only). On the free tier, PATH does not retain conversation context between sessions.
Fulfilling subscription and billing via Stripe.
Sending you essential service emails (account, billing) and, if you opt in, occasional product updates.
Improving the product in aggregate. We do not train any AI model on your data.
Reproductive-health data — anything you tell us about your fertility, pregnancy, loss, treatments, or clinical results — is special-category personal data under UK GDPR Art. 9.
We process this data under your explicit consent (Art. 9(2)(a)), given when you sign up and complete onboarding. You can withdraw your consent at any time by deleting your account from /account/delete-account; deletion is immediate and cascades through every system that holds your data.
We treat this data with the same care as any health record: encrypted in transit and at rest, access strictly limited to the systems and people who need it to operate the service.
We retain your data while your account is active.
You can download an export of everything we hold about you at any time from /account/export (UK GDPR Art. 20, data portability).
You can permanently delete your account at any time from /account/delete-account (UK GDPR Art. 17, right to erasure). Deletion cascades through every user-owned table in our database and removes your Supabase auth user; the operation is irreversible.
If you choose to delete, anonymised aggregate analytics (e.g. "X people in stage Y this month") may persist because they contain no identifiers.
Billing records we are required to keep for accounting and tax purposes (e.g. invoices) are retained for the period required by UK law, even after account deletion. These contain no health data.
Some of our sub-processors operate outside the EEA (Stripe, OpenAI, Vercel, Tavily — all in the US). Transfers to these providers are made under appropriate safeguards: either the EU-US Data Privacy Framework (for certified providers) or Standard Contractual Clauses (SCCs) adopted by the European Commission.
Supabase and Render store data in EU regions, so no third-country transfer applies for those.
The full subprocessor register at /subprocessors lists each provider's location and the applicable transfer mechanism.
Right of access (Art. 15): see what we hold — /account/export gives you a full JSON copy at any time.
Right to rectification (Art. 16): update or correct your profile — /profile and /onboarding edit views.
Right to erasure (Art. 17): permanently delete your account — /account/delete-account.
Right to restrict processing (Art. 18): contact info@fertilitypath.app.
Right to data portability (Art. 20): /account/export returns your data in machine-readable JSON.
Right to object (Art. 21): contact info@fertilitypath.app.
Right to withdraw consent: at any time, by deleting your account or contacting info@fertilitypath.app for partial withdrawal.
Right to complain to a supervisory authority: the UK Information Commissioner's Office (ICO) at ico.org.uk.
fertilityPATH is operated by MEDIPASS, registered in Greece (Miltiadou 23, PC 15232, Chalandri, Athens). For users in the European Economic Area, processing is governed by Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) — and Greek Law 4624/2019, which implements GDPR and Directive (EU) 2016/680 in Greek law.
EU users have the same rights as listed above (access, rectification, erasure, restriction, portability, objection, withdraw consent) under the corresponding EU GDPR articles.
EU users may lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) at www.dpa.gr.
If we become aware of a personal-data breach that poses a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office and/or the Hellenic Data Protection Authority within 72 hours of becoming aware, as required by UK/EU GDPR Art. 33.
We will inform you directly, without undue delay, if the breach is likely to result in a high risk to your rights (Art. 34).
For any privacy-related question — access requests, deletion concerns, suspected breaches, or anything else — contact info@fertilitypath.app.
We aim to respond within 7 days and resolve all data-rights requests within the 30-day window UK GDPR allows.
