Legal

Privacy Policy

Last updated: 31 October 2026 · Version 1.3

Signature Health Intelligence (“SHI”, “we”, “us”) is a physician-led preventive health service operated by Dr. D. R. Gamalathge, MBBS (SLMC Registration No. 36999), of Dr. Gamalathge Healthcare Centre, Mirihana, Nugegoda, Sri Lanka. For the purposes of the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (the “PDPA”), the controller of personal data collected through this website is Dr. D. R. Gamalathge. Parts I and III of the PDPA take effect on 1 January 2027 (Extraordinary Gazette No. 2498/16, 22 July 2026). SHI applies the Act’s standards now, and honours the rights in section 6 before the provisions that create them come into force.

This policy explains what we collect through signaturehealthintel.com, why, where it goes, and the rights you hold. It covers this website and the enquiries you send us. Clinical care itself — your investigations, results and medical records — is governed additionally by the separate written consent you sign before any investigation, and by applicable medical record-keeping obligations.

1. What we collect

Details you give us. When you submit the enquiry form we collect your name, WhatsApp number, age, the programme you are interested in, optionally your email address, and your message describing what prompted your enquiry. When you contact us by WhatsApp, telephone or email, we collect the contact details and content you choose to send.

Health information you choose to share. Your enquiry message may include information about your health — for example a family history or a recent result. Health information is a special category of personal data under the PDPA. We ask for your explicit consent, via the checkbox on the form, before you submit it; we use it solely to advise you on the suitability of a programme and to prepare for your consultation; and you are free to leave it out entirely — an enquiry without any health detail is equally welcome.

Collected automatically. We use Google Analytics 4 to understand how the site is used: approximate location (city level), device and browser type, pages viewed, and interactions such as which programme or button was selected. This relies on cookies holding a pseudonymous identifier — it does not tell us your name. Our hosting provider also keeps standard server logs (IP address, time, page requested) for security and reliability.

The Know your numbers self-check. The answers you type into the self-check (Know your numbers and its version for talks) are worked out in your browser. They are never sent to us or saved. Google Analytics records ordinary page activity, such as the page being opened and a result being shown, with none of your answers attached, under the same cookie choice as the rest of the site.

2. Why we process it, and on what basis

Under the PDPA we process personal data: (a) to respond to your enquiry, recommend a programme tier and arrange your appointment — with your consent and as steps taken at your request prior to entering a contract; (b) to administer your programme once you enrol — performance of a contract; (c) to keep the website secure and improve how it communicates — our legitimate interests, applied proportionately; (d) to meet legal and regulatory obligations, including those of the Sri Lanka Medical Council; and (e) health information you volunteer — your explicit consent, which you may withdraw at any time.

We do not sell personal data. We do not share it with advertisers. We do not send marketing messages unless you have asked us to, and any such consent can be withdrawn at any time by replying or writing to us.

3. Where your data goes

We use a small number of established service providers to run this website and respond to you. Some are located outside Sri Lanka, which means your data may be transferred and stored abroad. Form submissions — including any health context — are transferred with your explicit consent, given via the consent box on the form. Infrastructure-level data (hosting, analytics and font requests generated by simply visiting the site) is transferred on the basis of our legitimate interest in operating a reliable, secure website (for analytics in the UK, EEA and Switzerland, on your cookie consent; see section 4), supported by the contractual and security commitments of these providers:

• n8n Cloud (workflow automation, hosted in the European Union) — receives your form submission and routes it to us.
• Google (Workspace email, storage, and Analytics; servers in the United States and globally) — holds our correspondence, enquiry records and analytics data.
• Vercel (website hosting, United States) — serves the site and keeps standard server logs. Fonts are served by Google Fonts, which sees your IP address when the page loads.
• Anthropic (AI assistant, United States) — receives the name, programme of interest and message of a website enquiry to prepare a draft reply, and laboratory results, without your name, to support the pattern analysis for a report. Dr. Gamalathge reviews everything before anything is sent or signed. The use of results is covered by the clinical consent described below.
• Supabase (enquiry database, Singapore) — stores enquiry records.
• Meta / WhatsApp — if you contact us on WhatsApp, your messages are handled by WhatsApp under its own terms and privacy policy.

If you enrol in a programme, your samples and results are additionally processed by our partner diagnostic laboratory in Colombo acting under our instructions, and that processing is covered by the separate written clinical consent you sign before any investigation.

4. Cookies and consent

This site uses Google Analytics cookies to distinguish visitors and measure use of the site, and one item of browser storage to remember your cookie choice. We use no advertising, remarketing or social-media tracking cookies, and advertising storage is disabled site-wide.

We use Google Consent Mode. For visitors in the United Kingdom, the European Economic Area and Switzerland, analytics storage is denied by default: no analytics cookie is set unless you accept it in the banner shown on your first visit or through Cookie settings, and until then Google Analytics receives only cookieless signals that carry no visitor identifier. Declining is a single click and has no effect on your use of the site.

Elsewhere, including Sri Lanka, analytics runs by default on the basis of our legitimate interest in understanding how the site is used and improving it (section 2(c) above). You can object at any time through Cookie settings.

Changing your choice. Every page has a Cookie settings link at the foot. It reopens the choice for any visitor: Decline switches analytics storage off and deletes the _ga cookies this site has set; Accept switches it on. Withdrawing consent does not affect analytics carried out before you withdrew it. You can also block cookies in your browser settings; the site works fully without them.

4a. Visitors from the UK, EEA and Switzerland

If you access this site from the United Kingdom or the EEA, the UK GDPR, the EU GDPR or the Swiss Federal Act on Data Protection may apply to you in addition to the PDPA. In that case you also have rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to your local supervisory authority. Your data is transferred to and stored in Sri Lanka and in the countries listed in section 3; we rely on your consent and on the contractual safeguards of our providers for those transfers. Exercise any of these rights using the contact details in section 11.

5. How long we keep it

Enquiry records (form submissions, WhatsApp and email correspondence) are reviewed at least annually and deleted within 24 months of our last contact, unless you enrol in a programme. If you enrol, records connected to your care become part of your clinical record and are retained in line with medical record-keeping obligations. User-level analytics data is retained on Google’s systems for at most 14 months; workflow and hosting logs (n8n, Vercel) rotate on shorter, provider-set schedules.

6. Your rights

Under the PDPA you may: access the personal data we hold about you; ask us to correct or complete it; ask us to erase it; withdraw consent at any time (without affecting processing already carried out); and object to particular processing. To exercise any of these, write to dimithra@signaturehealthintel.com or message +94 75 619 2319 — we will respond promptly, and within any timeline the Act sets. If you are dissatisfied with our response, you have the right to complain to the Data Protection Authority of Sri Lanka.

7. Automated analysis

SHI uses AI-assisted pattern analysis as a supporting tool (the provider is listed in section 3). No decision producing legal or similarly significant effects is made solely by automated means: every report is reviewed, interpreted and authored by Dr. Gamalathge personally.

8. Security

The site is served over TLS encryption; form submissions travel encrypted; access to enquiry data is limited to Dr. Gamalathge and authorised staff; and we use reputable providers with recognised security practices. In the event of a personal data breach we will act in accordance with the PDPA, including notifying the Data Protection Authority and affected individuals where required.

9. Age

SHI programmes and this website are intended for adults aged 18 and over. We do not knowingly collect personal data from minors through this site.

10. Changes

We may update this policy as the service or the law evolves. The current version, with its date, will always be published on this page. Material changes will be highlighted on the site.

11. Contact

Privacy questions and requests: dimithra@signaturehealthintel.com · +94 75 619 2319 · Dr. Gamalathge Healthcare Centre, Mirihana, Nugegoda, Sri Lanka.