Privacy Notice

1. Who is the controller

The data controller is SpineDAO, an entity established in the European Union.

• Registered address: [to be completed].
• Data Protection Officer / privacy contact: [email protected].

We are the sole controller of your data; there are no joint controllers.

2. What data we collect

• Account & identity: name, email address, profile image, and account state.
• Health data (special category): demographics (age, sex, height, weight, birthdate), lifestyle factors, past medical history, symptoms and pain profiles, prior treatments, risk and disability assessments (red/yellow flags, frailty, ODI, SI), triage results, chat transcripts, clinician handoff documents, and physiotherapy sessions and appointments.

Most of this data is provided directly by you during onboarding, assessments, and conversations with the application.

3. Why we use it and our legal basis

We process your data to deliver the Lamina service, relying on:

• Article 6(1)(b) — contract: processing necessary to provide the triage, assessment, chat, and physiotherapy service you signed up for.
• Article 9(2)(a) — explicit consent: your specific, informed, and freely-given consent to process your health data for AI triage and care. You give this consent as a separate step when you create your account.

You can withdraw your consent at any time (see section 8). Because your health data cannot be processed without this consent, withdrawing it means we can no longer provide the service and your data is deleted.

4. Automated decision-making

Lamina uses an AI triage pipeline to assess risk and suggest care pathways. These outputs are advisory only — they are not a medical diagnosis, and no clinical decision is made about you by SpineDAO. No SpineDAO staff member or clinician reviews or accesses your data; the pipeline runs automatically. Any actual clinical decision is made by your own doctor, offline, based on the handoff summary you choose to share with them. You may request human review of an automated assessment by contacting our data protection officer (see section 8).

5. Who has access and where data is processed

• Automated SpineDAO systems only — no staff member or clinician accesses your data.
• AI inference runs on our own infrastructure using a local model — your data is not sent to any third-party AI provider.
• We do not transfer your data outside the EU/EEA to any third country.

6. How long we keep it

• We retain your data while your account is active and you continue to use the service.
• If your account is inactive for 36 months, it is automatically deleted along with all associated data. We send you a warning email one month beforehand so you can keep your account.
• If you withdraw consent or delete your account, your data is erased immediately.
• We do not hold your data indefinitely (storage limitation, Article 5(1)(e)).

7. How we protect your data

We apply appropriate technical and organisational measures under Article 32, including encryption in transit (HTTPS/TLS, including the connection to our database), encryption at rest for the database storage, and authenticated, access-controlled systems. Patient data is processed only by our automated pipeline and is not exposed to SpineDAO staff or clinicians.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict or object to certain processing — by contacting our data protection officer (see below);
• data portability;
• withdraw your consent at any time, without affecting processing carried out before withdrawal.

You can withdraw consent and delete all of your data yourself at any time using the "Withdraw consent" option in your account menu. This permanently erases your account and all associated data. For any other request, contact [email protected].

9. Complaints

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your local EU data protection supervisory authority.

10. Changes to this notice

We may update this notice. The effective date at the top reflects the current version. Where changes affect the basis on which we process your health data, we will ask you to review and re-consent.