Delete your Rosa Health account

How to request deletion of your Rosa Health account and the data linked to it, what we delete, what we keep and for how long.

This page covers the Rosa Health app for Android and iOS and the portal at rosahealth.ai, run by Rosa Health S.r.l. (Milan). You can request deletion at any time, also without the app.

1. How to request deletion

You have two options, and you do not need to give a reason:

• In the app: open Profile, then Settings, scroll to the bottom and tap “Delete account”. Confirm with “Schedule deletion”. If you cannot find “Delete account”, email us.
• By email: write to privacy@rosahealth.ai from your account's email address, with the subject “Account deletion”. An email request does not include the 30 days to change your mind (see section 2). First we close your membership, cancel any upcoming appointments and remove your address from the newsletter. Then we delete your account and data, and confirm it by replying to your email, within one month and usually much sooner.

Have an active membership? When you request deletion in the app, we stop the renewal for you, so we do not charge you for another year. With an email request, we close the membership as soon as we handle it. Deletion does not include an automatic refund: if you think you are entitled to one, write to legal@rosahealth.ai.

2. What happens after your request

After a request in the app:

• Right away: we deactivate your account, stop marketing emails and your membership renewal, and send you a confirmation email.
• For 30 days you can change your mind: sign in again and choose to keep your account. Your renewal then goes back to how it was before your request, unless your membership has already ended. Three days before the deadline we send you a reminder.
• After 30 days we close your membership, cancel any upcoming appointments and delete your account and data permanently: they cannot be recovered. We send you a final confirmation email.

3. What we delete

• Your account data: name, email, phone number, date of birth, sex, profile photo and sign-in credentials.
• Your health profile: conditions, medications, supplements, allergies, family history, height, weight, goals and lifestyle answers.
• Your test results, biomarker values, reports and analyses, including the notes of the doctor who reviewed them.
• The files you uploaded, for example PDFs or photos of earlier tests.
• Your conversations with Rosa AI and in the chat with a doctor.
• Your appointments, your invite code and your newsletter subscription (for the newsletter form on the website, see section 4).

4. What we keep, for how long and why

Some data stays after the deletion. For each item we say why and for how long:

• Record of AI-generated content: technical fingerprints and an excerpt of up to 500 characters of each generated text, which can include your values. It also holds some answers you typed in your health profile (for example a medication or an allergy) and the corrections the doctor made. It serves the traceability that Italian Law 132/2025 requires and deletes itself 90 days after the deletion.
• Doctor access log: which doctor opened your record and when, identifiers only. Each entry deletes itself about 25 months after the access, as the Garante's guidelines on health records ask.
• Deletion record: an internal identifier, the date of the deletion and, for requests in the app, the date of the request, with no name, email or health data. We keep it with no time limit, to prove that we honoured your request (Art. 17 GDPR).
• Billing data: our payment provider (Stripe) keeps invoices, payment records, your name and email for at least 10 years, as Italian tax law requires.
• Friend invites: if you joined through a friend's invite, a link between that invite and an internal identifier stays with no expiry, with no name or email. It is part of your friend's record of invite rewards.
• Backups: so we can restore the service after a failure, the technical backups of our databases contain deleted data for at most 35 days, then they are overwritten.
• Server logs: to find and fix errors, the technical logs of our systems can contain your email address (for example when we send you an email) and internal identifiers. They delete themselves after 30 days. For security, the activity record of our cloud provider (AWS) keeps the sign-ins and other requests to your account (for example the sign-up or a password reset), with the IP address and details of the browser or app, for 90 days. The provider sets this period and we cannot shorten it.
• Human review requests: if you used “Request human review”, the medical team's work queue keeps a copy of the request with an internal identifier, a reference to the test, the date, the screen you sent it from and any note you wrote.
• Founding member or advisor invites: if you joined with one of these invites, the invite register keeps the name written on the invite, an internal identifier and, for founding members, your number, so each number is used only once. Anyone who has your personal link can still get that name from our server.
• Website newsletter form signups: if you left your email in the newsletter form on the website, we keep your address with the date and the source of the signup. The signup is stored separately, not in your account. Our team may also have received a notice of it by email.
• Lab reports awaiting verification: if a report that the laboratory sent could not be processed automatically (for example because it could not be matched to your account), the file and a note with the file name stay in a restricted area until our team deletes them.

Human review requests, founding member or advisor invites, website newsletter form signups and lab reports awaiting verification stay with no time limit, because the account deletion does not include them. Write to privacy@rosahealth.ai and we delete them: you can also ask in the same email as your deletion request.

The partner laboratory that performed your blood draw keeps its own clinical records, as healthcare law requires. For those, contact the laboratory directly.

5. Deleting only some data

Want to delete only an uploaded file or a conversation, without closing your account? Write to privacy@rosahealth.ai and tell us what to delete.

6. Contact

Rosa Health S.r.l., Via Lattanzio 31, 20137 Milan, Italy. Email: privacy@rosahealth.ai. If you think your request was not handled correctly, you can file a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).