Privacy policy

Effective 26 October 2026 · version 1.1 · The Latvian version (Privātuma politika) prevails.

1. Who we are

The VissLabi app (visslabi.lv) is operated by SIA “VissLabi”, the data controller. Questions about your data and requests to exercise your rights: privatums@visslabi.lv.

2. What data we process

• Account: email, name, password (stored only as a secure hash). If you sign in with Google, your Google account identifier.
• Maternity passport: name, date of birth, phone, personal identity code and address — if you enter them; details of the baby's father — if you enter them.
• Pregnancy: dates, visits, lab results, measurements, documents, wellbeing, contractions, the baby's kick counts, medicines, postnatal questionnaire (EPDS) result.
• Everyday health: lab results, documents, allergies, conditions, vaccinations, menstrual cycle, activities, Garmin daily data — if you add them.
• Child: name, birth details, feeding, sleep, growth, temperature, photos, documents, questions.
• Conversations: your questions and the answers (from your doctor or the assistant Evi).
• Technical data: sign-in times, device key, notification permission, activity log.

Health data is a special category of personal data. We process it only to run the app and with your explicit consent.

3. Why, and on what legal basis

• Account and sign-in — performance of a contract (GDPR Art. 6(1)(b)).
• Storing your health data and showing overviews — your explicit consent (GDPR Art. 9(2)(a)).
• Use of artificial intelligence (AI) — your separate consent in Settings. AI is off until you turn it on.
• Personalised AI suggestions — a further separate consent with a double confirmation.
• Sharing with your doctor — your consent, given when you add a doctor or create a link.
• Security, troubleshooting and the activity log — our legitimate interests (GDPR Art. 6(1)(f)).

We do not sell your data and do not use it for advertising.

4. Artificial intelligence

If you allow it, AI reads values from your documents, answers your questions (the assistant “Evi”) and suggests actions, which are saved only after you say “Yes”.

• What the AI receives: text in which your name, personal identity code and phone number are masked. Lab values and dates remain, because the answer needs them. If you choose “Text and images”, also document images after personal details are covered, and the newest photo of your child when you ask about the child.
• Who processes it: Anthropic (Claude) and OpenAI (ChatGPT), USA. The answer to a medical question is checked in the background by the other provider, so both may receive the question. Transfers to the USA rely on the providers' data processing terms with the EU Standard Contractual Clauses.
• Training: the API terms of these providers state that submitted data is not used to train their models. We do not train AI models on your data.
• AI can make mistakes. Answers are informational, not a diagnosis. If you describe danger signs, you will see safety guidance advising you to call 113.
• How to turn it off: Settings → “Mākslīgais intelekts” → “Neizmantot AI”.

5. Google user data

We use Google services only if you choose to.

Sign in with Google

We receive your Google account identifier, email address and name (scopes “openid”, “email”, “profile”). We use them only to recognise you when you sign in and to show your name. They are stored encrypted.

Google Calendar sync

If you turn on “Google kalendārs” in Settings, we ask for the permission “Make secondary Google calendars, and see, create, change, and delete events on them” (calendar.app.created). With it the app:

• creates a separate calendar named “VissLabi” in your Google account;
• adds the visits you booked in the app to it: the title “Vizīte” (visit), date and time, and the place only if you allow it;
• updates or deletes those events when you change or cancel the visit in the app.

The app cannot see or change your other calendars and events. No diagnoses, notes or lab values are sent to Google. The access token is stored encrypted. When you turn sync off, we revoke the access at Google, delete the tokens and, if you choose, delete the “VissLabi” calendar. You can also revoke access at myaccount.google.com/permissions.

Limited Use

We do not sell data received from Google APIs, do not share it with others, do not use it for advertising, do not send it to AI services and do not use it to train AI models. People do not read it, except when you ask us to, when it is needed for security, or when the law requires it.

VissLabi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Where and how we store data

• On our server in the OVH data centre in Gravelines, France (EU).
• Uploaded files and the data that identify a person (name, email, personal identity code, date of birth, phone, address, Google account identifier, child's name) are stored encrypted. We do not keep the file names of uploaded documents.
• The connection to the app is encrypted (HTTPS). The app loads nothing from other websites.
• A backup copy is made on the server before every app update.

7. Who we share data with

• Your doctor (if you add one):
  • always sees the questions you send to her; everything else only with your permission or with a one-day access code you give her;
  • for your safety: if within one day you describe danger signs in five questions, your doctor sees those questions and is notified;
  • sees the postnatal questionnaire (EPDS) result;
  • sees whether you take your medicines — you can turn this off in “Zāles”.
• The consultant sees your questions about your child — you can turn this off in Settings.
• A QR link (for example for the maternity ward) works for 24 hours, 3 or 7 days; you can end it at any time and you see when it was opened.
• Service providers processing data on our behalf:
  • OVH — server (France);
  • Anthropic and OpenAI — AI, only if you allow it (USA);
  • Google — Sign in with Google and calendar sync, only if you choose them;
  • your browser's push service — a notification only says “Jauns paziņojums” (new notification);
  • Open-Meteo — weather: rounded coordinates, without your name;
  • Stripe — payments, only if you pay for a subscription.

8. How long we keep data

• We keep your data while you use your account or until you delete it. We do not delete it automatically.
• When you delete your account, we delete your data, your files and the activity log entries linked to you.
• After deletion, data may remain in server backups until they are replaced by newer ones.
• We cannot delete copies you downloaded yourself or sent to others.

9. Your rights

• Access, copy and portability: Settings → “Mana digitālā replika” → download (a machine-readable JSON file).
• Rectification: in any entry in the app; passport details in Settings → “Mani dati”.
• Erasure: Settings → “Mana digitālā replika” → “Datu dzēšana” (delete data or the whole account).
• Withdraw consent: AI, personalised suggestions, sharing with your doctor and Google Calendar can be turned off in Settings at any time.
• Object or restrict processing: write to privatums@visslabi.lv.
• Complain: to the Data State Inspectorate of Latvia, www.dvi.gov.lv.

10. Children's data

A parent enters the child's data. The parent decides on AI use and on what the doctor sees. The child's photo is shown to the doctor only if you allow it. Deleting the account also deletes the child's records.

11. Changes

If this policy changes materially, we will tell you in the app and show the new version and date on this page.