Privacy notice

Controller and contact

Daniel Lawrence is the data controller for the Checkpoint service and is responsible for deciding how personal information is processed. Privacy and data-protection enquiries can be sent to checkpointapphelp@gmail.com.

What Checkpoint stores

Depending on the features you use, Checkpoint may store your email-based account identity, profile preferences, treatment and schedule records, treatment events, inventory, measurements, check-ins, observations, bloodwork records, uploaded bloodwork documents, progress photos, notification preferences, exports and feedback you submit.

Why the information is used

Your information is used to provide the tracking features you choose to use, keep your records available to your account, authenticate you, generate user-requested summaries or exports, provide reminders you enable, protect the service from abuse, investigate technical problems, understand whether the private beta is usable and process privacy or account-deletion requests.

Checkpoint does not use your treatment or health records to decide what treatment or dose you should take.

Lawful bases and health-data condition

For account and service processing needed to provide Checkpoint when you choose to use it, the working UK GDPR lawful basis is Article 6(1)(b): processing necessary to provide the service you request under these Terms.

For limited service-security, reliability and privacy-minimal service measurement that is not based on your health-record content, Checkpoint relies on Article 6(1)(f) legitimate interests in keeping the beta secure, understanding whether the service works and improving material usability problems. Those interests are limited by data minimisation and the controls described in this notice.

Treatment records, measurements, bloodwork, observations, progress photos and similar information can reveal health information and may be special-category personal data. For that information, Checkpoint relies on your explicit consent under Article 9(2)(a) UK GDPR. You must actively opt in before protected tracking features are available.

The current consent wording is version 2026-09-13-beta-v1. Checkpoint records the user, consent type, wording version and time of acceptance; it does not place medical content inside the consent record.

Signed-in users can withdraw health-data consent through Privacy choices. Withdrawal stops protected tracking and permanently removes stored health and tracking records, private tracking files, beta feedback linked to the withdrawn profile and beta product-event history. The login account, limited non-health service state, withdrawn access state and consent-withdrawal record remain so the privacy choice can be honoured and evidenced. You can also permanently delete the whole account. Because processing the health-related information you choose to record is necessary for the protected tracking service to work, Checkpoint cannot continue providing those features after consent is withdrawn.

What you must provide

There is no statutory requirement to give Checkpoint personal or health information. An email-based account is required to use the private signed-in service. Health-related information is optional feature by feature, but protected tracking features cannot operate unless you choose to provide the relevant information and give the explicit health-data consent described above.

Sensitive health-related information

Treatment records, measurements, bloodwork, progress photos and observations can be sensitive information. Checkpoint only asks you to record information needed for features you choose to use. Do not add information you do not want stored in your account.

Service providers

Checkpoint currently uses Supabase for authentication, database and private file storage, and Vercel for web hosting and application infrastructure. Those providers process information only as required to provide their services to Checkpoint.

Checkpoint does not sell your personal or health information and does not currently use advertising SDKs.

International processing

Cloud service providers may process information in more than one country. Where data-protection law requires safeguards for an international transfer, Checkpoint relies on the contractual and transfer safeguards made available by the relevant service provider. You can ask for further information about those safeguards at checkpointapphelp@gmail.com.

Photos and documents

Progress photos and bloodwork documents are stored for your account. Checkpoint uses private storage and short-lived preview access rather than publishing permanent public links.

Service analytics

Checkpoint uses privacy-minimal first-party product events to understand whether the service is usable. These events are limited to actions such as opening the app, completing onboarding, creating a treatment, logging a treatment event, completing a check-in or submitting feedback. The analytics event store does not accept treatment names, dose values, bloodwork values, symptom text, photos, files or free-text medical content.

Feedback diagnostics

If you choose to include diagnostics with beta feedback, Checkpoint limits them to basic technical context such as app version, route, platform, viewport and browser family. The feedback form is designed not to include account, treatment, bloodwork, photo or authentication values in diagnostic context.

Automated decisions

Checkpoint does not make solely automated decisions about you that produce legal or similarly significant effects. Its calculations, trend summaries and tracking outputs are record-keeping features and are not used to decide eligibility for treatment, insurance, employment or another significant service.

Retention, export and deletion

Account data is kept while your account is active and as needed to provide the service. Privacy-minimal product events and submitted feedback are retained while they are needed to evaluate or resolve product issues, unless you withdraw health-data consent or delete the account first. Signed-in users can export their records from Checkpoint. You can permanently delete your account and user-owned data from Settings or from the public Delete Account page.

The deletion process removes user-owned database records, private progress-photo and bloodwork-document files, and linked beta-profile records before the authentication account is deleted. Limited information would only be retained where a legal, security or fraud-prevention obligation requires it.

Security

Checkpoint uses HTTPS, email-based authentication and account-level access controls. No internet service can guarantee absolute security, so you should also keep your email account and devices secure.

Your privacy rights

Depending on the circumstances, UK data-protection law can give you rights to access, correct, erase, restrict or receive a copy of personal information. Where processing relies on consent, you can withdraw that consent.

Right to object: where Checkpoint relies on legitimate interests, you can object to that processing. Send the objection to checkpointapphelp@gmail.com and it will be considered against the reasons for the processing.

Send any privacy request to checkpointapphelp@gmail.com. You can also complain to the UK Information Commissioner’s Office if you are unhappy with how a data-protection issue is handled: ico.org.uk/make-a-complaint.

Adults only

Checkpoint is intended for adults aged 18 and over.

Questions or privacy requests

For privacy questions, access requests or other account-data queries, email checkpointapphelp@gmail.com.

Last updated: 26 September 2026.