Privacy policy
How Bleedwise handles your personal data
Effective 18 September 2026
Bleedwise is a prototype developed by AuraHack as a participant in HackitRx 2026, for people living with haemophilia in Singapore and their caregivers. This policy explains what we collect, why, and the choices you have. It is written to meet the Personal Data Protection Act 2012 (PDPA).
Who is responsible
The AuraHack team is the organisation responsible for personal data collected through Bleedwise. Questions, requests and complaints about your data go to arieltyx@gmail.com or geraldho81@gmail.com.
What we collect
We collect only what the app needs to work.
- Account: your name, email address and a hashed password. Passwords are never stored in readable form.
- Health profile: haemophilia type and severity, your factor product, the dose and schedule recorded from your treatment plan, inhibitor status, your treatment centre, the kit you keep at home and your factor stock. You enter this yourself during setup.
- Bleed records: the site, timing, pain, treatment given, check-ins, notes and recovery steps for each bleed you log, and prophylaxis doses you record.
- Care team notes: anything your care team writes to you inside the app, when you have chosen to share.
- Caregiver accounts: the name of the person you care for and the same profile and bleed records, entered by you.
- Usage: which screens you open, when a bleed is started or closed, and any error the app hits. This is tied to your account so we can fix problems. It does not include the content of your records.
- Device storage: your session token in a secure cookie, and small app data on your phone (a session identifier, unsent usage events and your reading preferences).
Why we use it
- To show you your own plan, dose and records, and to remind you of check-ins.
- To share a bleed with the haemophilia team at your treatment centre, only when you switch sharing on for that bleed.
- To keep the app working and fix errors.
- To understand how the prototype is used during HackitRx 2026, in aggregate.
We do not sell personal data, show advertising, or use your data to train models.
Consent
By creating an account and entering your details you consent to this collection and use. Sharing with your care team is a separate choice you make per bleed and can switch off at any time. You may withdraw consent for everything else by asking us to delete your account.
Who can see your data
- You, when signed in.
- Care team accounts at your treatment centre, limited to the bleeds you have shared and the profile details needed to read them. They cannot see bleeds you have not shared.
- The AuraHack team, for support and to operate the prototype. Access is limited to what the request needs.
No treatment centre has been onboarded yet. Today no hospital or care team receives any data from Bleedwise; the care team features are under development.
We do not disclose your data to anyone else unless the law requires it.
Where it is stored
Bleedwise runs on Vercel in Singapore and stores data in a Neon Postgres database in the Singapore region. Backups follow those providers' standard practice. Your session cookie and small app data stay on your own device.
How long we keep it
For as long as your account exists. Bleedwise is a prototype; if the project ends we will delete the database or tell you first. Usage events are kept for up to twelve months.
Your rights
Under the PDPA you can ask us to:
- Give you a copy of the personal data we hold about you. You can also download your own records from the app as a CSV file at any time.
- Correct anything that is wrong. Most profile details can be edited in the app under Me.
- Delete your account and all data tied to it.
- Stop sharing with your care team, which you can do in the app for each bleed.
Send requests to arieltyx@gmail.com or geraldho81@gmail.com. We will respond within 30 days.
Security
Data travels over HTTPS. Passwords are hashed. Sessions expire after 90 days or when you sign out. No system is perfectly secure; if we learn of a breach that is likely to cause you harm we will notify you and the Personal Data Protection Commission as the PDPA requires.
Children
Caregivers may record data about a child in their care. The caregiver holds the account and gives consent on the child's behalf.
Changes
If this policy changes we will update the date at the top and, for significant changes, tell you in the app.