Effective Date: June 27, 2026
Welcome to Health Journey. We value your privacy and are deeply committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you visit our website, become a member, complete forms, schedule appointments, communicate with us, or use any of our services.
Please read this Privacy Policy carefully before using our website or submitting any personal information.
Health Journey is a precision health membership platform that helps individuals understand, optimize, and improve their health through advanced diagnostics, epigenetic analysis, preventive wellness programs, medical consultations, and personalized health recommendations.
If you have any questions regarding this Privacy Policy, you may contact us using the information provided at the end of this document.
We may collect the following categories of information:
Full name
Date of birth
Gender
Nationality
Passport or identification information (when required)
Email address
Phone number
Mailing address
Emergency contact information
When voluntarily provided by you, we may collect:
Medical history
Current medications
Laboratory results
Diagnostic reports
Health questionnaires
Lifestyle information
Nutrition information
Family medical history
Epigenetic assessment information
Hair sample analysis results
Medical images or supporting documents uploaded by you
Health information is considered sensitive information and is handled with enhanced confidentiality and security measures.
When you visit our website, we may automatically collect:
IP address
Browser type
Device information
Operating system
Language preferences
Website usage statistics
Cookies and similar technologies
Pages visited
Referral source
Session information
Your information may be used to:
Create and manage your membership.
Schedule appointments and consultations.
Coordinate medical services.
Evaluate eligibility for our health programs.
Process laboratory and epigenetic analyses.
Communicate regarding appointments and services.
Improve our website and services.
Respond to customer support requests.
Send educational content related to your membership.
Comply with applicable legal obligations.
Detect fraud or unauthorized activity.
Maintain platform security.
We process only the information reasonably necessary to provide our services.
Depending on your location, we process your information based on one or more of the following legal grounds:
Your consent.
Performance of a contract.
Compliance with legal obligations.
Legitimate business interests.
Protection of vital interests when applicable.
Sensitive health information is processed only with your explicit consent or where otherwise permitted by applicable law.
We do not sell your personal information.
We may share information only when necessary with:
Licensed physicians.
Healthcare professionals.
Diagnostic laboratories.
Epigenetic analysis providers.
Secure technology providers.
Payment processors.
Cloud hosting providers.
Customer support platforms.
Government authorities when required by law.
All service providers are expected to maintain appropriate confidentiality and security safeguards.
We implement administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction.
Although we strive to use commercially reasonable security measures, no method of electronic transmission or storage is completely secure.
We retain your information only for as long as necessary to:
Provide our services.
Fulfill legal obligations.
Resolve disputes.
Maintain required medical or business records.
Enforce our agreements.
When information is no longer required, it will be securely deleted or anonymized where appropriate.
Subject to applicable law, you may have the right to:
Access your personal information.
Correct inaccurate information.
Request deletion of your information.
Restrict certain processing activities.
Withdraw consent.
Request a copy of your data.
Object to certain uses of your information.
Requests may be submitted using the contact information provided below.
Health Journey uses cookies and similar technologies to improve website functionality, analyze website performance, remember preferences, and enhance the user experience.
For additional information, please refer to our Cookie Policy.
Because Health Journey may coordinate services across different countries, your information may be transferred to and processed in jurisdictions outside your country of residence.
Whenever such transfers occur, we implement appropriate safeguards designed to protect your personal information in accordance with applicable laws.
Our services are intended for adults unless otherwise expressly stated. We do not knowingly collect personal information from children without appropriate parental or legal guardian authorization.
We may update this Privacy Policy from time to time. The revised version will be posted on this page together with the updated effective date. Continued use of our services after changes become effective constitutes acceptance of the revised Privacy Policy.
If you have questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact:
Entity: Health Journey
Email: privacy@healthjourney.com
Website: https://healthjourney.com
Business Hours: Monday–Friday, 9:00 AM – 5:00 PM
Health Journey may act as the data controller, data processor, or equivalent responsible party depending on the nature of the service and the applicable law. Certain services may require the involvement of third-party laboratories, healthcare professionals, healthcare institutions, diagnostic providers, technology platforms, cloud service providers, payment processors, scheduling platforms, and other specialized service providers.
Where Health Journey engages third parties to process personal information on its behalf, Health Journey will take reasonable steps to ensure that such parties process personal information only for authorized purposes and maintain appropriate confidentiality, security, and data protection safeguards.
Where a healthcare provider or other regulated professional independently provides healthcare services, that provider may act as an independent data controller or responsible party for information collected and maintained as part of the professional healthcare relationship, including medical records, subject to applicable law.
Health Journey recognizes that health-related, genetic, biometric, and certain epigenetic information may constitute sensitive personal information under applicable laws, including Colombian data protection regulations.
Because of the sensitive nature of this information, Health Journey will collect and process such information only when reasonably necessary for the purposes described in this Privacy Policy and when an appropriate legal basis exists, including the explicit consent of the individual where required by law.
By providing sensitive information, the individual acknowledges that such information may be used to coordinate testing, laboratory analysis, healthcare consultations, wellness assessments, personalized educational recommendations, reporting, service administration, and other purposes expressly disclosed at the time of collection.
Refusing to provide information that is necessary for a particular service may prevent Health Journey from providing that service. Health Journey will not condition unrelated services on the provision of sensitive information when such information is not reasonably necessary for the service.
Where Colombian law applies, Health Journey will obtain the prior, express, and informed authorization required for the processing of sensitive personal information.
The authorization process may be completed through electronic forms, digital consent mechanisms, written documents, or other legally recognized methods capable of demonstrating the individual's authorization.
Health Journey will maintain reasonable records of the authorization obtained, including the purposes for which the information was authorized to be processed.
Acceptance of this Privacy Policy alone will not necessarily constitute authorization for every type of processing of sensitive personal information. Where a separate authorization is legally required, Health Journey will obtain such authorization separately.
When a user receives a medical consultation or other regulated healthcare service in Colombia, the healthcare professional or healthcare institution responsible for providing that service may create and maintain a medical record in accordance with applicable Colombian healthcare regulations.
Medical records are subject to specific confidentiality, access, security, retention, and disclosure requirements. Health Journey will not access, copy, disclose, or use medical records beyond the purposes authorized by the user or permitted or required by applicable law.
Where Health Journey acts only as a platform or coordinator, the healthcare professional or healthcare institution remains responsible for the medical record and for the professional obligations associated with the healthcare service, to the extent required by law.
Nothing in this Privacy Policy is intended to replace the privacy notice, informed consent, medical confidentiality obligations, or other documentation required by the healthcare provider.
When a user purchases or participates in an epigenetic assessment or other laboratory-based service, Health Journey may collect or coordinate the collection of biological samples and related information necessary to perform the requested analysis.
Depending on the service, samples and related information may be transferred to laboratories, specialized testing providers, or technology partners located in Colombia or other jurisdictions.
Health Journey will take reasonable steps to ensure that samples and related information are handled only for the purposes disclosed to the user and in accordance with applicable contractual, privacy, security, and regulatory requirements.
The retention, storage, destruction, or return of biological samples may be governed by the policies and legal obligations of the laboratory or testing provider performing the analysis. Users may be provided with additional consent forms or laboratory-specific terms before sample collection.
Health Journey will use personal information only for legitimate and disclosed purposes and will seek to limit the collection and processing of information to what is reasonably necessary for those purposes.
Health Journey will not intentionally use a user's health, genetic, epigenetic, or other sensitive information to discriminate against the user, make unlawful decisions regarding the user's eligibility for unrelated services, or engage in purposes that are incompatible with the authorization provided by the user or applicable law.
Personal information will not be sold or commercially disclosed to unrelated third parties for their independent marketing purposes without the user's appropriate authorization or another lawful basis.
Health Journey may provide users with health, wellness, lifestyle, or epigenetic reports generated from information, assessments, laboratory results, or other services.
Such reports may contain personal and sensitive information and will therefore be treated as confidential information. Access to reports may be restricted through secure accounts, authentication mechanisms, or other reasonable security measures.
Reports are intended to support health education, wellness planning, and communication with qualified professionals, as applicable. They should not be disclosed, reproduced, modified, or distributed to third parties without authorization, except where required or permitted by law.
Where a report is generated or processed by a third-party laboratory or technology provider, the applicable provider's privacy practices may also apply.
Health Journey operates in an international environment and may use service providers, laboratories, healthcare professionals, cloud infrastructure, technology platforms, and other providers located outside Colombia or outside the user's country of residence.
As a result, personal information, including sensitive health-related information where legally permitted, may be transferred, stored, or processed in other jurisdictions.
Before carrying out an international transfer or processing activity, Health Journey will seek to implement the safeguards, authorizations, contractual measures, and other requirements applicable under Colombian law and other applicable data protection laws.
Where required, Health Journey will provide additional information or obtain additional authorization before transferring sensitive personal information internationally.
Health Journey may use third-party platforms to operate its services, including membership platforms, customer relationship management systems, scheduling services, communication platforms, cloud storage, laboratory systems, payment processors, analytics services, customer support systems, and other technology providers.
These providers may process certain personal information on behalf of Health Journey or independently, depending on their contractual relationship and applicable law.
Health Journey will take reasonable steps to select providers that maintain appropriate security and confidentiality measures. However, each third party may maintain its own privacy policy and terms of service, which may also apply to information processed through its systems.
Health Journey may use contact information to communicate with users regarding their memberships, appointments, laboratory services, reports, transactions, account activity, security notices, and other service-related matters.
Where permitted by applicable law and subject to the user's authorization where required, Health Journey may also send educational materials, newsletters, wellness information, service updates, and promotional communications.
Users may withdraw consent to receive non-essential marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting Health Journey.
Withdrawing consent for marketing communications will not affect service-related communications that are necessary to administer the user's account, appointments, transactions, security, or other contractual or legal obligations.
Users are responsible for providing accurate, complete, current, and truthful information and for updating such information when necessary.
Health Journey may rely on the information provided by the user for the purpose of coordinating services, appointments, laboratory processing, and other activities. Users should promptly notify Health Journey if any information previously provided is inaccurate or has changed.
Health Journey may take reasonable steps to verify information when necessary to protect the security of the platform, comply with legal obligations, or prevent fraud or unauthorized activity.
Health Journey maintains administrative, technical, and organizational measures designed to reduce the risk of unauthorized access, loss, alteration, disclosure, or destruction of personal information.
If Health Journey becomes aware of a security incident affecting personal information, Health Journey will assess the incident and take reasonable steps to contain, investigate, mitigate, document, and respond to the incident in accordance with applicable law and its internal security procedures.
Where notification to affected individuals, regulatory authorities, or other parties is legally required, Health Journey will provide such notification in accordance with applicable law.
Subject to applicable law, individuals may exercise rights relating to their personal information, including the right to:
Request access to their personal information.
Request correction, updating, or modification of inaccurate information.
Request information regarding the processing of their personal information.
Request deletion of personal information when legally permitted.
Withdraw consent where processing is based on consent.
Request limitations on certain processing activities where legally available.
Submit complaints regarding the processing of personal information.
Receive information regarding the identity or categories of relevant data processors or third parties, where required by law.
Requests should be submitted to Health Journey using the privacy contact information provided in this Privacy Policy.
Health Journey may request reasonable information necessary to verify the identity of the person submitting a request and to protect the confidentiality of personal information.
Health Journey will respond to requests within the time periods required by applicable law.
When Health Journey collects, stores, uses, transfers, or otherwise processes personal information in connection with services provided in Colombia, Health Journey will seek to comply with applicable Colombian data protection requirements, including Law 1581 of 2012 and its implementing regulations, as applicable.
Health-related information and other sensitive personal information will receive enhanced protection in accordance with applicable Colombian law.
Where healthcare services are provided in Colombia, the processing and confidentiality of healthcare information and medical records may also be subject to specific healthcare regulations and professional confidentiality obligations.
Where a mandatory provision of Colombian law applies to the processing of personal information in Colombia, such mandatory provision will prevail over any inconsistent provision of this Privacy Policy.
Health Journey may provide services to individuals who reside in different countries and may therefore be subject to privacy laws in jurisdictions other than Colombia.
Nothing in this Privacy Policy is intended to remove or limit privacy rights that cannot legally be waived under the laws applicable to the individual.
Where multiple privacy laws apply, Health Journey will seek to implement appropriate measures to comply with the applicable requirements, particularly regarding sensitive personal information, consent, data access, international transfers, security, and individual rights.
Health Journey may disclose personal information when reasonably necessary to:
Comply with a legal obligation.
Respond to a valid court order, governmental request, or regulatory requirement.
Protect the rights, safety, security, or property of Health Journey, its users, healthcare partners, or other persons.
Detect, prevent, or investigate fraud, abuse, security incidents, or unlawful activity.
Establish, exercise, or defend legal claims.
Where legally permitted, Health Journey will seek to limit such disclosures to the information reasonably necessary for the applicable purpose.
If Health Journey is involved in a merger, acquisition, restructuring, financing, sale of assets, change of ownership, or similar corporate transaction, personal information may be transferred as part of that transaction, subject to applicable confidentiality, data protection, and legal requirements.
Any successor entity or acquiring party will be expected to handle personal information in accordance with applicable law and the commitments described in this Privacy Policy, unless otherwise permitted or required by law.
Where processing is based on consent, users may withdraw their consent at any time, subject to applicable legal requirements and the consequences of such withdrawal.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Certain information may continue to be retained when required by law, necessary to establish or defend legal claims, necessary to fulfill contractual or professional obligations, or otherwise permitted by applicable law.
Certain Health Journey services may require separate consent forms or authorizations in addition to this Privacy Policy.
These may include, where applicable:
Consent for the processing of sensitive health information.
Consent for epigenetic or laboratory testing.
Consent for collection and processing of biological samples.
Medical informed consent.
Authorization to share information with healthcare professionals.
Authorization for international data transfers.
Authorization for marketing communications.
Laboratory-specific privacy or consent documentation.
Where a separate consent is required, the applicable consent document will govern the specific processing activity addressed by that document.
This Privacy Policy is effective as of 27 June 2026.
Health Journey may periodically review and update this Privacy Policy to reflect changes in its services, technology, business operations, applicable laws, or regulatory requirements.
Material changes will be communicated through appropriate means where required by applicable law. The current version and effective date will always be made available through the Health Journey website.
Users are encouraged to review this Privacy Policy periodically.