Health data

How we collect and protect data

A health record is only useful if it is collected the same way every time, with questions others use too, and if its origin is known. That is what lets your health professional see how things change over time. This page explains how we do it, where the data is kept and who sees it.

Last updated: 11 October 2026 · English translation; the Portuguese version is the reference

In short

Six things we do today

01

Validated questionnaires

We use instruments used in research worldwide and store every answer, not just the total.

02

Pain measured the same way every time

From 0 to 10, with coded body regions and the international definition of chronic pain.

03

Every value with its source

Date, unit and who recorded it. Correcting a value does not delete the previous one.

04

Present, not interpret

We show the data over time. What it means in your case, your health professional tells you.

05

Only those who should see it

Access rules live in the database itself, and professionals sign in with a second authentication factor.

06

Your data is yours

You can export everything and delete your account on any plan, including the free one.

What we ask

Validated questionnaires, not made-up questions

For mental health and wellbeing we use published instruments used in research. Answers are stored question by question, as research requires.

PHQ-9

Measures
Depressive symptoms
Questions
9
Period
Last two weeks

Kroenke, Spitzer and Williams, 2001

GAD-7

Measures
Anxiety symptoms
Questions
7
Period
Last two weeks

Spitzer, Kroenke, Williams and Löwe, 2006

PSS-4

Measures
Perceived stress
Questions
4
Period
Last month

Cohen, Kamarck and Mermelstein, 1983

Copenhagen Burnout Inventory

Measures
Personal, work-related and client-related burnout
Questions
19 (6, 7 and 6)

Kristensen, Borritz, Villadsen and Christensen, 2005

Hooper index

Measures
Sleep, stress, fatigue and mood, used in sport
Questions
4, from 1 to 7

Hooper and Mackinnon, 1995

Pain

Intensity is recorded from 0 to 10, in every episode and every consultation. Location uses coded body regions, always the same ones, so it can be counted and compared. Pain is chronic from 3 months on, as defined by the International Association for the Study of Pain (IASP) and the International Classification of Diseases (ICD-11).

Treede et al., Pain, 2019

Questions from the National Health Survey

At admission, general health, limitation in usual activities, smoking, alcohol and time spent sitting are asked in the same words as Statistics Portugal's (INE) National Health Survey, so that one day they can be compared with the Portuguese population. We use INE's questions; we are not INE's partners.

Questionnaires help give context; they are not a diagnosis.

Where each value comes from

Every value knows where it came from

01

Date and unit

Every measurement (weight, blood pressure, hours of sleep, a lab value) keeps the date it was measured and its unit.

02

Who recorded it

The person, the professional or the laboratory. It is always stated, so you know which value to trust and why.

03

Correcting without deleting

A correction creates a new record that replaces the previous one. The history stays, and you can see what changed.

04

Lab results as they come

The laboratory PDF is kept, and the reference range shown is the one in the laboratory's own report. Automatic reading of the PDF is only an aid: the values are there to review and correct.

Our line

Present, not interpret

Health Lab is not a medical device. It shows data in an organised way and over time; it does not diagnose, does not classify your health and does not set target values.

What a value means in your case, your health professional tells you.

Who sees what

Your data is yours

01

You

You see everything that is yours: what you recorded, what your professional shared with you and your history.

02

The professional who follows you

Sees what is needed to follow you, while following you. You can end that relationship in the app, and from then on they no longer see your record.

03

Item by item

You can close to a professional, item by item, what you do not want to share (for example, lab results or questionnaires).

04

Clinical notes

Each professional reads only their own notes. The clinical director, as administrator, reads all of them.

05

Second factor

Professionals and administrators only reach patient data with a second authentication factor.

06

Access log

Every time a professional opens your record, it is logged. That log is included when you export your data.

Where it is kept and how

In the European Union, with rules in the database itself

Protection does not depend on the screen: it lives in the database rules, which only give each person what belongs to them or what was shared with them.

For whatWhoWhere
Database, accounts and the files you uploadSupabaseEuropean Union (Frankfurt, Germany)
Service emailsResendEuropean Union (Ireland)
Reading the lab PDFs you uploadAnthropicUnited States, under standard contractual clauses; the content is not used to train models
Plan paymentsStripeReceives no health data
Hosting and delivery of the site and appCloudflareGlobal delivery network

We do not sell your data or pass it to third parties for marketing. The full list and the legal grounds are in the Privacy Policy, sections 6 and 9.

How it is protected

01

Encrypted connections

All communications use HTTPS, enforced by a strict transport policy.

02

Encryption at rest

The database and files are encrypted at rest by the infrastructure that hosts them.

03

Row-level rules

Active on every data table: each person only reads and writes what belongs to them or was shared with them.

04

Daily backups

Of the database, to recover from an error or a failure.

05

Keys on the server

Keys with elevated privileges exist only on the server side and never reach the browser.

06

Files by owner

Access to each file is checked against the identifier of whoever uploaded it.

Your rights

What you can do, and how

01

Export everything

In the app, under Profile, Export my data: a file with everything we hold about you, in a structured format. On every plan.

02

Delete your account

On any plan, including the free one.

03

Correct, restrict or object

Write to geral@health-lab.pt. We reply within one month.

04

Complain

You can lodge a complaint with the Portuguese Data Protection Authority (CNPD), at www.cnpd.pt.

What we are preparing

Where we are heading

This is not done yet. We say it here so you know where we are heading, not as something already done.

01

International codes

Every measurement will also carry its international code: LOINC for lab tests, UCUM for units, SNOMED CT for the rest. Exporting your data will follow the European standard, HL7 FHIR.

02

A public data dictionary

The definition of every variable we collect, with its unit, code and how it is collected.

03

Research, only with your permission

If Health Lab data is ever used for public health research, it will be under the rules of the European Health Data Space and, for data that could identify you, with your specific and separate consent (Privacy Policy, section 7).

A question about your data?

Write to geral@health-lab.pt. The legal basis for processing is in the Privacy Policy.