Version 2026-10-19.1. This notice explains, in plain language, what District Brief CY ("Σήμερα στην Περιοχή σου") does with your data. It is written to meet Articles 12–14 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Cyprus Law 125(I)/2018 that implements it.
Controller: Admin, cypriothealth.com (contact@cypriothealth.com). Data protection officer: No DPO appointed; contact the admin at contact@cypriothealth.com.
What the service does
Every morning it sends a short environmental health brief for a district of Cyprus (air quality, dust, heat, UV, pollen, water, fire smoke, infectious-disease notices, duty pharmacies), and it can send alerts during the day. It is environmental information and general public-health guidance only. It is not medical advice and it does not know anything about your health beyond the profile category you choose.
What we hold about you
| data | why | legal basis |
|---|---|---|
| your e-mail address, chosen language | to send the brief and sign-in links | contract (GDPR Art. 6(1)(b)) |
| for each recipient: a label you choose (e.g. "Mum in Larnaca"), district, language, channels, alert and quiet-hours settings, optional water supply area | to compose and send the right brief | contract (Art. 6(1)(b)) |
| optional condition profile codes (asthma/COPD, heart and circulation, pregnancy, infant or child, 65 and over, outdoor worker, athlete) | to add the general guidance lines for that group under each section | your explicit consent (Art. 9(2)(a)) — health-related data |
| Telegram chat id, web-push subscription (if you connect them) | to deliver on those channels | contract (Art. 6(1)(b)) |
| delivery records (what was sent, when, on which channel, whether it failed) | to avoid sending twice and to fix failures | legitimate interest in a reliable service (Art. 6(1)(f)) |
| sign-in tokens (stored only as a hash, expire in 1–24 hours) | to sign you in by e-mail link | contract |
We store a profile code only — never a diagnosis, a symptom, a medicine or a health record. You can use the service with no profile at all (district only).
Carer mode. If you add a recipient for someone else (for example a parent), you are telling us their district, the label you chose and, optionally, a profile code. Please add someone only with their agreement, and do not put health details or full names in the label. The brief goes to your channels unless you connect theirs.
What we never do
- No advertising, no profiling for marketing, no sale or sharing of your data.
- No personal data is sent to the AI model. The AI reading is written once per district from the district's environmental data; it never sees who you are or your profile.
- No location tracking: you choose the district.
Who processes data for us
Only to deliver the service, under contract: the e-mail delivery provider (none at present: no e-mail is sent while sign-ups are closed); Telegram (only if you connect Telegram); your browser's push service (Google, Mozilla, Apple or Microsoft, only if you enable push); the hosting provider Hetzner Online GmbH (servers in Nuremberg, Germany). Some of these may process data outside the EU; where they do, the transfer relies on the European Commission's adequacy decisions or standard contractual clauses.
How long we keep it
As long as your account exists. Deleting your account (Account → Delete, or DELETE /api/me) erases your account, recipients, channels, delivery records and tokens immediately; backups are overwritten within 14 days. Unconfirmed sign-ups are replaced by the next sign-up with the same e-mail.
Your rights
You can, at any time and free of charge:
- see and download everything we hold (Account → Export: a JSON file) — access and portability, Art. 15 and 20;
- correct it (Account → edit) — Art. 16;
- withdraw health consent (Account → withdraw consent): every profile code is erased at once and your briefs continue without condition lines — Art. 7(3);
- delete your account immediately — Art. 17;
- unsubscribe a channel with one click from any message;
- object to processing based on legitimate interest — Art. 21;
- complain to the Commissioner for Personal Data Protection, Cyprus.
Children
The service is meant for adults. A carer can add a recipient profile "infant or child" for their own child; the child does not have an account.
Automated decisions and AI
There are no decisions about you. The colour of each section comes from fixed, published thresholds (docs/thresholds.md). The plain-language reading under the brief is generated by an AI model and is labelled "AI-generated summary of the data above"; the sources are listed under it.
Changes
If this notice changes in a way that matters, we will tell you by e-mail before the change applies.