Privacy Notice

1. Who we are

Signal Labs (an Irish-registered company) provides a workplace preventive-health assessment platform. For assessment data, Signal Labs acts as a data processor on behalf of your employer (the controller). For this marketing site, Signal Labs is the controller of the limited firmographic and contact data you choose to submit. Our lead supervisory authority is the Irish Data Protection Commission (DPC) under the GDPR one-stop-shop.

2. The marketing site collects zero health data

The pilot-booking flow collects only firmographic details (headcount, the information you enter) and a work email. No health data is collected anywhere on this site. Booking a pilot is not consent to an assessment — explicit Art. 9(2)(a) consent is captured separately, from each employee individually, before any health data is processed.

3. Special-category health data (assessments)

When your organization runs an assessment, the Physical Signal Score, the CogniScore, the two biological ages and the underlying measurements are special-category data under Art. 9. We rely on explicit consent (Art. 9(2)(a)), and Art. 9(2)(h) where applicable. Scores are computed deterministically server-side; an LLM only narrates results and never computes a score, band, or trend.

4. Data residency & transfers

Employee health data and FHIR Observations are stored in your organization's residency region (eu or uk). For EU subjects, processing is EU-resident by default (EHDS, Reg (EU) 2025/327), and residency is enforced at the dispatch boundary and the model gateway — an EU tenant's request is never routed to a non-EU model provider.

5. Privacy by design

• Scores are computed, never generated — the model narrates, it never decides.
• Each employee's results go directly to them, in their own dashboard.
• Your employer sees only anonymised group trends — never an individual score, never a name next to a number. Groups too small to be anonymous are suppressed entirely.
• Per-source consent for every connected device, with revocation honored end-to-end.

6. Your rights

You may exercise access, rectification, erasure, restriction, portability, and objection rights (GDPR Arts. 15–22). Exports are provided in FHIR. To make a request, or to reach our Data Protection Officer, contact team@signallabs.ie.

7. Cookies

This site uses a localized, consent-first cookie banner. In the EU/EEA and UK, non-essential cookies are set only after you opt in. You can change your choice at any time.

This notice is the engineering and operational posture; it is not legal advice and is validated by Irish/EU and per-jurisdiction counsel before launch.