Legal

Privacy Policy

Last updated: 9 June 2026

1. Introduction

This Privacy Policy explains how HealthInbox processes personal data when you use the HealthInbox browser extension and associated website. It is written to comply with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR").

HealthInbox is built on a single principle: your email data never leaves your device. Email classification, analysis, and storage all happen locally in your browser. This policy describes the limited personal data we process, the legal basis for each processing activity, and the rights you can exercise.

2. Data Controller

The data controller responsible for the processing described in this policy is HealthInbox. For any question relating to your personal data or to exercise your rights, contact us at contact@healthinbox.site.

3. Data We Process

We process the minimum data necessary to provide the service. The following is an exhaustive list of the personal data involved.

  • Email metadata (headers only): the From, Subject, Date, List-Unsubscribe, X-Mailer, Precedence, and List-Id header fields of the messages in your inbox. This data is read through the official Gmail API and is stored locally on your device only. It is never transmitted to us or to any third party.
  • Your licence email address: the email address you provide when purchasing or activating a Pro licence. This is transmitted to our validation server solely to confirm the status of your licence. It is never used for any other purpose and is never sold.
  • Payment data: processed exclusively by Stripe, our payment processor. HealthInbox never has access to your card number or banking details.

We never read, store, or transmit the body of your emails or their attachments.

4. Legal Basis for Processing

Under Article 6 of the GDPR, each processing activity relies on a specific legal basis.

  • Email metadata — legitimate interest (Art. 6(1)(f)): processing the headers of your own inbox to help you classify, analyse, and clean it serves your legitimate interest in managing your mailbox. The processing is local to your device, minimal in scope, and does not override your fundamental rights.
  • Licence email — performance of a contract (Art. 6(1)(b)): processing your licence email address is necessary to deliver and validate the Pro subscription you purchased.

5. Gmail API Access

HealthInbox uses the official Gmail REST API with the gmail.readonly scope. This scope allows the extension to read email headers but never email bodies. OAuth2 access tokens are held in browser memory only; they are never written to disk and never transmitted to any server other than Google's own OAuth endpoints.

Our use of Gmail data complies with the Google API Services User Data Policy , including the Limited Use requirements.

6. Processors and Recipients

Under Article 28 of the GDPR, we rely on the following processors. None of them ever receives any email data.

  • Stripe — payment processing and subscription management.
  • Vercel — hosting of the licence validation server.
  • Supabase — storage of licence records (licence email address and status only).

7. International Transfers

Our processors may operate infrastructure outside the European Union. Where personal data (limited to your licence email address) is transferred outside the EU, the transfer is governed by the European Commission's Standard Contractual Clauses, which provide appropriate safeguards under Chapter V of the GDPR. Email metadata is never transferred, as it never leaves your device.

8. Data Retention

Local data (email metadata, classifications, scan progress, preferences) is retained on your device until you delete it. You can erase all local data at any time by clicking "Disconnect Gmail" in the extension Settings — this revokes Gmail access and permanently deletes all scanned emails, classifications, and local data from your device. Your Pro licence is preserved and can be used with a new Gmail connection.

Your licence email address is retained for as long as your subscription is active, and is deleted following expiry or termination of the subscription.

9. Your Rights

Under Articles 15 to 22 of the GDPR, you have the following rights, which you can exercise directly and immediately.

  • Right of access (Art. 15): use the "Export my data" button in the extension Settings to obtain a copy of the data held locally.
  • Right to erasure (Art. 17): use the "Disconnect Gmail" button in the extension Settings to permanently erase all local data from your device.
  • Right to data portability (Art. 20): the "Export my data" button provides your data in a structured, machine-readable JSON format.
  • Right to object (Art. 21): use the "Disconnect Gmail" button in the extension Settings to stop the processing of your email metadata.
  • Right to rectification (Art. 16): not applicable. HealthInbox accesses your inbox in read-only mode and does not modify the underlying data.

For the licence email address held on our servers, contact contact@healthinbox.site to exercise any of these rights. We respond within one month, as required by Article 12 of the GDPR.

10. No Profiling or Automated Decision-Making

HealthInbox does not carry out profiling and does not make automated decisions producing legal or similarly significant effects within the meaning of Article 22 of the GDPR. The local classification of your emails is a convenience feature that produces no external effect and is never used to evaluate you as a person.

11. Cookies and Tracking

HealthInbox uses no third-party cookies and no tracking technologies. The extension does not monitor your browsing activity.

12. Right to Lodge a Complaint

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence or place of the alleged infringement. In France, the competent authority is the Commission Nationale de l'Informatique et des Libertes (CNIL), www.cnil.fr.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above. We encourage you to review this page periodically.

14. Contact

For any question regarding this policy or the processing of your personal data, contact us at contact@healthinbox.site.