At a glance
- 4 storage regionsIndia, Europe, the United States and international, each with its own database and file store.
- 241 countries and territoriesSign-up asks where you live and stores your records in that region.
- Nothing soldNo sale of health data, no sharing for advertising, no third-party trackers.
- One cookieA strictly necessary session cookie keeps you signed in.
1Global availability
LotusPond Health is open to adults in 241 countries and territories. In a few places, local law requires health data to stay inside the country, or other restrictions apply. We do not offer sign-up there yet, and sign-up shows the reason below to anyone who picks one of these countries.
| Country | Why sign-up is not offered yet |
|---|---|
| China | China requires security assessments before health data leaves the country (PIPL). LotusPond Health is not available here yet. |
| Cuba | LotusPond Health is not available in this country. |
| Iran | LotusPond Health is not available in this country. |
| North Korea | LotusPond Health is not available in this country. |
| Russia | Russian law requires personal data of citizens to be stored in Russia (Federal Law 242-FZ). LotusPond Health is not available here yet. |
| Saudi Arabia | Saudi rules on health data generally require hosting inside the Kingdom. LotusPond Health will open here once hosting in Saudi Arabia is in place. |
| Syria | LotusPond Health is not available in this country. |
| United Arab Emirates | Health data of people in the UAE must be stored inside the UAE (Federal Law No. 2 of 2019). LotusPond Health will open here once hosting in the UAE is in place. |
Partner-lab booking starts in India. Elsewhere, the lab finder shows public diagnostic labs, imaging centres and hospitals from OpenStreetMap, wherever they are listed.
2Storage by region
Each region is a separate database and file store, deployed in its own location. Sign-up picks the region from your country of residence and shows it to you before you agree. Where that region is outside your country, sign-up says so and asks for your agreement.
| Region | Where records are kept | Whose records |
|---|---|---|
| India | Servers in India | People living in India. |
| Europe | Servers in the European Union | People in the European Union and the European Economic Area, plus Guernsey, Isle of Man, Jersey, Switzerland and the United Kingdom. For Guernsey, Isle of Man, Jersey, Switzerland and the United Kingdom, records are stored outside the country, so sign-up says where and asks for agreement. |
| United States | Servers in the United States | People in the United States and its territories, plus Canada. For Canada, records are stored outside the country, so sign-up says where and asks for agreement. |
| International | Our international servers | People in every other country where LotusPond Health is available: 188 countries and territories, such as Australia, Brazil, Japan, Singapore and South Africa. Records are stored outside the person’s country, so sign-up names the region and asks for agreement. |
- A small directory maps a keyed hash of each email address to its region, so sign-in knows where to look without keeping your email in readable form outside your region.
- Your sign-in session remembers your region, so every later request goes straight there.
- Data that is not about people, such as partner-lab details and cached public facility listings, is kept separately from records.
- Hosting providers and data-centre locations: [Hosting providers and locations for each region — to be completed by LotusPond].
3Laws by region
These are the main data-protection laws for the people whose records each region holds, as our sign-up applies them.
| Region | Main laws we follow |
|---|---|
| India |
|
| Europe | The EU and the EEA
Switzerland
Guernsey, Isle of Man, Jersey and the United Kingdom
|
| United States | The United States and its territories
Canada
|
| International | The data-protection law of each country, for example:
|
4Rules we apply everywhere
Some rules differ from country to country. We apply the strictest common ones to everyone:
- Adults only for accounts. Anyone under 18 is added by a parent or guardian as a family profile.
- Explicit, recorded consent. Accepting the Terms and Privacy Policy, consenting to the processing of health data and, where storage is abroad, agreeing to the region are separate steps. Each is stored with the text version, the time and your country.
- No sale or sharing of health data, and no advertising trackers.
- Data rights built in: export, correction and deletion are controls in the app that work straight away.
- One cookie, and it is strictly necessary, so there is no cookie banner.
5Security measures
- PasswordsHashed with Argon2id. We never see or store them in readable form.
- SessionsRandom 256-bit tokens in an HttpOnly, HTTPS-only cookie. We store only a SHA-256 hash.
- Account isolationEvery request for a profile’s data is checked against the signed-in account.
- Cross-site protectionChanges are accepted only from our own pages.
- Rate limitsRepeated sign-in and sign-up attempts are slowed by address and by email.
- Content Security PolicyEach page may load code only from our own site. The public pages run no scripts at all.
- Safe file handlingUploaded files are served in a sandbox, and types a browser could run are only offered as downloads.
- EncryptionHTTPS everywhere with HSTS, and encrypted storage for records and files in each region.
- Audit logSecurity events on each account are recorded, which helps us investigate quickly.
6Your data rights
| Right | Where to use it |
|---|---|
| See and export your data | Profile details, then Export (a JSON file you can keep or import again) |
| Correct it | Profile details for personal and health details; edit or delete any result |
| Delete it | Files for a single file; Profile details for all records of a person or the whole profile; Account and sign-in for your account |
| Withdraw consent | Delete your account in Account and sign-in, or write to us |
| Know who has your data | Nobody outside our hosting providers. Ask us for the list at any time. |
| Complain | Our privacy contact or, in India, our Grievance Officer; then your regulator (see the Privacy Policy) |
Rights by law, including GDPR, the DPDP Act, the Washington My Health My Data Act, Nevada law and the CCPA, are set out in section 8 of the Privacy Policy and in our Consumer Health Data Privacy Policy.
7Breach readiness
Per-region storage and the account audit log let us find out quickly which records a problem touched. Our incident plan meets the strictest timelines that apply to us: notice to authorities within 72 hours under the GDPR and India’s DPDP Rules, and notice to affected people in the United States within 60 days under the FTC Health Breach Notification Rule. People affected are told directly.
8Medical scope
LotusPond explains results; it does not diagnose. It is a personal health record that you keep for yourself and your family, and we offer it to you directly. Read the medical disclaimer in the Terms of Use.
9Contact and reporting
- Report a security issue
- [Security contact email — to be completed by LotusPond]
- Privacy and data rights
- [Privacy contact email — to be completed by LotusPond]
- Grievance Officer (India)
- [Grievance Officer name, email and address in India — to be completed by LotusPond]
- Data Protection Officer
- [Data Protection Officer name and email — to be completed by LotusPond]