Privacy Statement

1. Who we are and how to contact us

Data Controller: Lampsy Health, Lda. (Portugal). We determine the purposes and means of processing for the personal data covered by this Privacy Policy, which makes us the data controller under the GDPR.

Address: Rua da Prata, 80, 1100-420 Lisbon, Portugal.

Contact for privacy questions and GDPR requests: privacy@lampsyhealth.com

If we appoint a Data Protection Officer (DPO) or change our privacy contacts, we will update this Privacy Policy accordingly.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

• Website use
• Waiting list sign-ups
• Use of cookies and tracking tools
• Analytics and marketing integrations
• Purchases on our website (upon availability)
• Use of Lampsy's services

3. Personal data we collect

We collect personal data in three main ways: by the (i) information you provide, (ii) information collected automatically (through cookies and/or logs), and (iii) information produced as you use Lampsy's connected features.

Contact and inquiries: If you contact us through website forms or communications, we may collect your name, email address, and the content of your message.

Waiting list: Our waiting list page shows the following fields and selection options, for which we may collect: Name, Email, Phone Number, Country of Residence, and "What's your experience with epilepsy?".

Purchases (upon availability): When you place an order, we may collect personal data needed to process and fulfil your purchase, such as: contact details (name and email), billing/shipping details (address), and transaction details.

Gift purchases and recipient details (if applicable): If you buy a product/subscription as a gift and provide the recipient's contact information, we will process that third-party data to deliver the gift and related notifications.

Technical and usage data: When you use our website we may collect data through cookies/pixels, including IP address, device/browser information, browsing activity, referral URLs, timestamps, and engagement analytics (pages viewed, time spent, clicks). Non-essential cookies are only activated with your consent.

Lampsy is an epilepsy monitoring device that processes motion data in a privacy-preserving way, with optional features such as live video, notifications, and saving/reviewing/sharing event videos.

• Account and contact data (your name, email and phone number)
• Caregiver/emergency contact data you voluntarily provide so the system can send notifications and automated calls (names and phone numbers)
• Motion/event information (event timestamps and logs) used to generate notifications
• Video data clips, if you enable such optional features
• Technical data
• Quiz answers, where you choose to take our fit-check quiz: your three answers (including what you tell us about seizure activity, which is health data), the result, your email address, the page language and, where available, the country you are in. See "Quiz answers, and what we do not do with them" below.

How and why we process your personal data

We process personal data only where we have a lawful basis under GDPR Articles 6 and 9.

We acquire and process your personal data for basic functionality, security monitoring, fraud prevention, and maintaining the availability and integrity of services.

When you purchase via our website, we process personal data to take payment, fulfil delivery, manage subscriptions (if applicable), communicate about your order, and provide support.

When using Lampsy's services, automated notifications/calls when abnormal motion is detected are generated, and (when such features are enabled) we may provide live video and saved event video review.

With your consent, we use analytics tools to understand site performance and improve content and the user experience.

Where you opt in, we may use marketing tools to measure and understand the effectiveness of campaigns.

We may process personal data to meet legal obligations, including tax/accounting recordkeeping obligations related to sales (where applicable), and to respond to lawful requests from public authorities.

Quiz answers, and what we do and do not do with them

Our fit-check quiz asks three questions: what you most want from monitoring, what kind of movements you or the person you care for experience, and who the monitoring is for. When you submit it to see your result we record those three answers, the result itself, your email address, the language the page was in, and — where our infrastructure makes it available to us — the country you were in at the time. Nothing else from the quiz is recorded.

One of those answers is health data. What kind of movements someone experiences permits an inference about their health, which makes it a special category of personal data under Article 9 of the GDPR. We process it only on your explicit consent under Article 9(2)(a) — the consent you give by ticking the box on the quiz before submitting it — and sending you the result and any further emails rests on your consent under Article 6(1)(a).

We hold these answers against your email address, and we use them to decide what we send you. In practice that means we know, for a given contact, whether they are a parent, a carer, someone living with epilepsy or a professional, what kind of movements they described, and which country they are in — and we use that to choose which emails, guidance and product information are relevant to them rather than sending everyone the same thing. Under the GDPR this is profiling, as defined in Article 4(4), and we would rather say so than describe it as something softer. We also read the same answers in aggregate, to see which needs are most common and where our own explanations are unclear.

One consequence of that is worth stating plainly. If you tell us you are a parent or a carer, the answer about movements is about the person you care for rather than about you. We hold it as context attached to your contact record, without any identifier for them, and we use it only to decide what we send YOU. We do not build a record about them, we do not contact them, and nothing here is a consent given on their behalf — which is not ours to collect from you. If that person ever becomes a contact of ours, it will be because they gave us their own address and their own consent.

Who else sees them: the answers are held in our own systems, and the emails they shape are sent through our email delivery provider, which processes the address and the content of the message on our instructions and for no purpose of its own. We do not pass the answers themselves to advertising platforms. Section 5 lists the categories of recipient that apply across this policy.

What we do not do matters as much. We do not make any decision about you by automated means: nothing here decides whether you can buy, what you pay, or what care you receive, so Article 22 of the GDPR is not engaged. We do not sell these answers or share them for anyone else's marketing. We do not combine them with data bought or obtained from third parties to build a fuller picture of you. We do not use them to diagnose anything or to offer medical advice, and we do not pass them to insurers, employers or advertisers. Access inside Lampsy Health is limited to the people who need it to run the communications described above.

This consent is entirely yours to give and to take back. You can withdraw it at any time under Article 7(3) by replying to any email we send you or writing to privacy@lampsyhealth.com, and withdrawing is as easy as giving it: we do not ask for a reason, we do not require you to sign in, and it takes effect on receipt. When you withdraw we stop using your answers, we delete them, and we remove the segmentation derived from them so it cannot go on shaping what you are sent — deleting the answer and keeping the label it produced would defeat the point. You can also ask for a copy of everything we hold about you under Article 15, ask us to erase it under Article 17, and object to the profiling described above under Article 21; we will confirm what we have done. None of this is conditional on being a customer, and refusing or withdrawing has no effect on any purchase, subscription or warranty. Withdrawal does not make what we did while the consent stood unlawful, and it does not reach anything we are separately required to keep, such as a record of the consent itself and of your request.

4. Cookies and similar technologies

EU ePrivacy rules require consent for storing or accessing information on a user's device, commonly implemented through cookies and similar technologies, except for storage/access that is strictly necessary to provide a service explicitly requested by the user.

Our current website privacy statement describes three categories of cookies: strictly necessary cookies (always active), analytics/performance cookies (activated only after consent), and marketing/targeting cookies (optional and disabled by default unless you opt in).

Your cookie choice is stored for 12 months and can be changed via the Cookie Settings window or through your browser settings.

Strictly necessary cookies: These cookies are necessary for the operation, security, and core functionality of our website and services. Because these technologies are strictly necessary, they are always active and do not require your consent.

Analytics cookies: These cookies help us understand how visitors use our website. Analytics cookies are only used if you have given your consent.

Product analytics (PostHog). We use PostHog (hosted in the EU by PostHog) to understand how visitors use our website: pages viewed, buttons and links clicked, feature and content interactions, conversion steps, and page-performance metrics (Web Vitals). Before you accept analytics cookies, PostHog runs in a cookieless mode: it stores nothing on your device, your IP address is not sent, and it processes only aggregate, non-identifying usage under our legitimate interest in measuring and improving the site. If you accept analytics cookies, PostHog uses first-party storage to recognise your device across visits, and your approximate location (country/city) is derived from your IP address for aggregate reporting. The raw IP address is used only for that lookup and is then discarded, not stored. We also capture masked session recordings and click/scroll heatmaps to diagnose usability issues: all typed input and on-screen text is redacted, recordings are tied only to an anonymous identifier, and both recording and interaction capture are disabled entirely on sensitive pages (account, checkout, sign-in, registration, and contact). We do not send health-related information, your name, email, or other identifying data to PostHog. You can change your choice anytime via Cookie Settings. See PostHog's privacy policy at posthog.com/privacy.

Marketing cookies: These cookies and similar technologies help us measure the effectiveness of our marketing campaigns. Marketing cookies are only used if you have given your consent.

Depending on the configuration of our website and services at a given time, the providers of these cookies and similar technologies may include, for example, Google Analytics, Hotjar, Meta, Google Ads, Stripe, and service providers supporting our website infrastructure or content management.

Meta Conversions API: With your marketing consent, we use Meta's Conversions API (a server-side connection) to measure and improve our advertising. We send Meta a limited set of events about your activity on our marketing pages, such as viewing a page or product, adding an item to your order, and starting checkout, along with technical identifiers used only to match the event to your Meta account: your IP address, browser user-agent, Meta's _fbp and _fbc cookie identifiers, and, if you are signed in, an irreversibly hashed version of your email and name. We never send health-related information or anything that could reveal a medical condition. You can withdraw consent at any time in your cookie settings, after which we stop sending these events.

Your cookie preferences are collected and managed through our cookie banner and settings tool. Your choice is stored for 12 months unless you change it earlier. You may update or withdraw your consent at any time through the Cookie Settings link or window available on our website.

5. How we share personal data

We share personal data only as needed for the purposes described above, including with:

• Service providers (processors) who help us operate our website and deliver services (such as hosting, email delivery, analytics, customer support tooling)
• Analytics/advertising providers, such as Google and Meta, where you have consented to those cookies/tools
• Payment providers and logistics partners (if applicable) to process payments and deliver products
• Authorities and professional advisers, where required by law or necessary to establish, exercise, or defend legal claims

6. International transfers

Some of our providers (Google, Meta, AWS, etc.) may transfer data outside the EU. These transfers are safeguarded through mechanisms such as Standard Contractual Clauses or adequacy decisions by the European Commission.

7. Data retention

We keep personal data only as long as necessary for the purposes described in this Privacy Policy, and we either delete, anonymise, or securely archive data when no longer needed.

We retain your personal data only as long as necessary for the purposes stated:

Questionnaire answers are tied to the purpose you gave them for rather than to a fixed date, because a fixed date would be the wrong shape twice over. Deleting them while we are still sending you tailored emails would leave us emailing you with the tailoring removed — the thing you asked for, quietly stopped — and keeping them after you have gone would be keeping health information for nobody's benefit. So they live exactly as long as the purpose does: while you are subscribed to those emails. Withdraw your consent or unsubscribe and we delete them at that point. Stop opening our emails for twelve months and we delete them anyway, without waiting to be asked, because silence is not a purpose either. Your email address and the record of your consent follow the same rule; any correspondence between us is kept under the contact-submissions period above.

• Contact submissions: up to 2 years
• Quiz answers and result: for as long as you keep receiving tailored emails from us, and deleted on withdrawal, on unsubscribe, or after 12 months without you opening one
• Analytics data: 14 to 26 months
• Legal records: up to 6 years, as required under Portuguese law

8. Your rights and other important information

You have rights under the GDPR, including: access, rectification, erasure, restriction, portability, objection (including an unconditional right to object to direct marketing), and the right to withdraw consent.

When we process personal data based on consent, you can withdraw consent at any time; withdrawal does not affect past processing that was lawful before withdrawal, but it does affect future processing that relies on consent.

To exercise your rights, contact us at privacy@lampsyhealth.com. We may need to request additional information to verify your identity before fulfilling your request.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

9. Third-party data you provide

If you provide us with personal data about someone else (caregivers, emergency contacts, gift recipients), you must ensure you have the right to provide that data. Where GDPR Article 14 applies (data not obtained directly from the data subject), we will provide the required information to that person within the required timelines, unless an exception applies.

Questionnaire answers are a deliberate exception to the paragraph above, because they do not identify anyone else. Where you tell us you are a parent or a carer, the answer about movements describes the person you care for — but we never ask for their name, their age, their contact details or anything else that would let us identify them, and we do not try to work it out. What we hold is context about you: that you care for someone, and what kind of episodes you are dealing with. It is attached to your email address and to nobody else's, and Article 14 does not bite on data that identifies no one. If we ever want to hold information about the person you care for, we will ask them, not you, and we will ask them directly.

10. Children's privacy

Our services and communications are directed at adults, and we do not knowingly collect personal information from children under 16 through the website.

At the same time, our product use cases may involve children (under 16 years old) or disabled people, who may not be able to provide consent. Therefore, if you are a parent, guardian, or caregiver, and intend to monitor your child or the person with disability you are responsible for, we require the filling of a consent document allowing the processing of their data. Please contact us at privacy@lampsyhealth.com to fulfill said diligence.