Privacy Policy — Elna Health

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR")

Last updated: July 7, 2026

Elna Health, S.L. ("Elna," "we," "our," "us"), pursuant to Articles 13 and 14 of the GDPR, informs you, as a data subject, that it is necessary to process your personal data as set out in this Privacy Policy when you use the Elna mobile and web application (the "Service").

  1. Data Controller

    The data controller is Elna Health, S.L. (VAT/Tax ID: B24866535), with registered office at C/Sagunt 102, baixos, 08014 Barcelona, Spain, represented by its legal representative pro tempore. You may contact us by email at hello@elna.health.

  2. Data Protection Officer (DPO)

    Elna Health, S.L. has appointed a Data Protection Officer, who may be contacted at dpo@elna.health

  3. Source of Personal Data

    Personal data processed by Elna are collected:

    • Directly from you, when you register for or use the Service.
    • From your employer or healthcare institution, where the Service is provided through an institutional account.

  4. Categories of Personal Data Processed

    • Identification and contact data: first and last name, email address.
    • Professional data: medical specialty, institution, professional credentials.
    • Usage data: device information (IP address, browser type, device ID), time spent on the Service, clinical query logs.
    • Special category data (Art. 9 GDPR): to the extent clinical queries or use of the Service reveal information about your health or that of patients referenced in de-identified form, this is processed as special category data.
    • Cookies and tracking data: session and persistent cookies.

  5. Purposes, Legal Bases of Processing, and Retention Period

    a) Provision and management of the Service (account creation, authentication, core clinical AI functionality)

    • Legal basis: performance of a contract to which you are party (Art. 6(1)(b) GDPR); where special category/health-related data is involved, processing is necessary for the provision of health care or treatment, or management of health systems, subject to appropriate safeguards (Art. 9(2)(h) GDPR), or based on your explicit consent (Art. 9(2)(a) GDPR).
    • Retention: for the duration of your account, plus 2 years after account closure to address legal claims.

    b) Improving and personalizing the Service, analytics

    • Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).
    • Retention: 24 months from collection.

    c) Compliance with legal obligations (e.g., MDR, EU AI Act, tax/accounting law)

    • Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
    • Retention: for the period mandated by applicable law.

    d) Research and clinical validation (anonymized/aggregated data)

    • Legal basis: legitimate interest (Art. 6(1)(f) GDPR) where data is anonymized prior to use; where not fully anonymized, explicit consent (Art. 9(2)(a) GDPR).
    • Retention: anonymized data may be retained indefinitely; identifiable data as per purpose (a).

    e) Marketing communications (product updates, promotions)

    • Legal basis: consent (Art. 6(1)(a) GDPR), or legitimate interest under the "soft opt-in" exception for existing customers regarding similar services, in compliance with applicable e-Privacy rules.
    • Retention: until consent is withdrawn or you object, and in any case no longer than 1 year of inactivity.

    f) Automated processing / clinical AI decision support

    • Legal basis: explicit consent (Art. 9(2)(a) GDPR) combined with contractual necessity (Art. 6(1)(b)), given the clinical nature of outputs.
    • Retention: query logs retained for 2 years for safety, audit, and quality-assurance purposes.

    Upon expiry of the above retention periods, data will be deleted or anonymized.

  6. Nature of the Provision of Personal Data

    Provision of identification, contact, and professional data is necessary to create an account and use the Service; without it, we cannot provide the Service to you. Provision of data for marketing (purpose e) is optional and based on consent — declining it does not affect your ability to use the Service.

  7. Automated Decision-Making (Art. 13(2)(f) / Art. 22 GDPR)

    Elna's core functionality includes AI-generated clinical decision-support outputs. These outputs are intended solely as a support tool for qualified healthcare professionals and do not constitute automated decisions producing legal or similarly significant effects without human clinical judgment. You have the right not to be subject to a decision based solely on automated processing that produces such effects, and to request human intervention, express your point of view, and contest any such decision.

  8. Methods of Processing

    Personal data are processed in digital form using appropriate technical and organizational security measures. Only authorized Elna employees and collaborators may access such data, subject to confidentiality obligations.

  9. Categories of Recipients of Personal Data

    Your data may be shared with:

    • Service providers supporting our infrastructure and analytics (e.g., cloud hosting, CRM/email providers, database providers).
    • Professional advisors (legal, accounting) as needed.
    • Competent authorities, where required by law.
    • Parties involved in a merger, acquisition, or asset transfer.

    Elna Health does not sell your personal data. A full list of recipients is available on request at hello@elna.health.

  10. Transfer of Personal Data Outside the EEA

    Elna does not transfer your personal data outside the European Economic Area (EEA). All Service Providers and infrastructure used to process your personal data are located within the EEA. Should this change in the future, we will update this Privacy Policy and, where required, implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

  11. Your Rights

    You have the right to, at any time:

    • Withdraw consent (Art. 7(3) GDPR), without affecting the lawfulness of prior processing.
    • Access your data (Art. 15 GDPR).
    • Rectify inaccurate data (Art. 16 GDPR).
    • Erasure / "right to be forgotten" (Art. 17 GDPR).
    • Restrict processing (Art. 18 GDPR).
    • Data portability (Art. 20 GDPR).
    • Object to processing based on legitimate interest, including profiling (Art. 21 GDPR).
    • Not be subject to a decision based solely on automated processing producing legal/significant effects (Art. 22 GDPR).

    Requests may be sent to hello@elna.health. We will respond within one (1) month (extendable by two further months for complex requests, with notice of the delay within the first month). Responses are provided free of charge unless requests are manifestly unfounded or excessive.

  12. Right to Lodge a Complaint (Art. 77 GDPR)

    If you believe your rights have been violated, you may lodge a complaint with the competent supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) — www.aepd.es. If you reside in another EU/EEA member state, you may complain to your local supervisory authority instead.

  13. Children's Privacy

    The Service is not intended for individuals under 18, and we do not knowingly collect data from minors.

  14. Links to Other Websites

    The Service may contain links to third-party sites; we are not responsible for their privacy practices.

  15. Amendments and Updates

    Elna Health may amend this Privacy Policy following regulatory changes or changes to our processing activities. We will notify you of material changes via email or a notice within the Service.

  16. Contact Us

    Email: hello@elna.health Address: C/Sagunt 102, baixos, 08014 Barcelona, Spain