Privacy Policy

1. Who we are

[Company/operator name] ("we", "us") operates this website, which lets you track personal health information and purchase wellness products. This policy explains what data we collect, why, and how you can control it. Contact us at [privacy@yourdomain.com] with any questions or requests.

2. Information we collect

• Account information: email address and password (password is never stored in plain text — authentication is handled by our infrastructure provider, Supabase).
• Health data you enter: vitals, symptoms, medications, and similar entries you choose to log.
• Health documents you upload: files such as lab results or medical records you choose to store.
• Lab results you enter or import: test values, reference ranges, and dates.
• Fitness data you import from a Garmin or Google Health export file: steps, heart rate, sleep, and similar wellness metrics. Import happens directly from your browser to our database — the raw export file itself is never uploaded to or stored on our servers.
• Medical procedures, immunizations, medications/supplements, insurance benefits, goals, medical conditions, and food sensitivity/allergy test results you enter: names, dates, providers, coverage details, and related notes.
• Documents and photos you upload for AI-assisted import (lab reports, CGM/glucose reports, CPAP reports, immunization records, supplement/medication labels, procedure/pathology/imaging reports, medication + immunization history exports, insurance benefit booklets, and food sensitivity/allergy reports): the file you upload is stored (same private document storage as other health documents) and its contents are processed by an AI model to extract structured data — see Section 7 for exactly which model and where.
• Questions you ask the Coach feature, if you use it: your question, plus a summary of your own health data assembled fresh each time to answer it. This summary is not stored anywhere beyond the request itself; chat history is kept only in your browser for the current session.
• AI Insights, if you generate them on the Overview tab: a summary of your own health data is sent to generate a short list of insight callouts, which — unlike Coach chat history — are saved to your account so they persist between visits until you regenerate them.
• Doctor Visit Prep sheets, if you generate them: the reason you give for the visit, any free-text note about recent changes, and a summary of your own health data are used to draft an appointment-prep sheet, which is saved to your account until you delete it.
• Housekeeping questions and flags, if you run (or schedule) the housekeeping feature: a summary of your data is reviewed to surface data-quality questions (a missing dose, a possible duplicate), which are saved until you answer or dismiss them.
• Sign-in records: the date and time of each sign-in attempt on your account, successful or failed. This is kept so that unusual account activity is visible to you and to us (a run of failed attempts is exactly what an audit trail should make visible), and so the operator can tell an active account from a dormant one. We record the fact and time of the attempt only — not your IP address, location, or device. An attempt against an email address with no account here records nothing at all.
• AI usage counts: for each AI-assisted request, which feature made it, which backend handled it (Anthropic or the Canadian server), how many tokens it used, and how long it took. This is a meter, not a transcript — the content of the request is not part of it.
• Order information, if you make a purchase: products ordered, order status, and — once payments are enabled — payment processing is handled entirely by our payment provider; we do not store your card details ourselves.

3. How we use your information

We use your information to operate your account, display your own health data and order history back to you, fulfill orders, and communicate with you about your account (e.g. password resets, order confirmations). We do not sell your data, and we do not use your health data for advertising.

4. Health data — how it's protected

Your health entries, documents, and fitness data are private to your account by default: our database enforces row-level security so that only you (and systems acting on your explicit request) can read or write your own records. Uploaded documents are stored in a private file store, not a public one, and are only ever accessed via short-lived, per-request links.

5. De-identification and data minimization

De-identification runs automatically on every document import — it is not optional. Known identifying fields (provider names, facility names, insurance policy/group numbers) are stripped from the structured records extracted from your documents, and identifying content is redacted (visually blacked out) in the stored copy of the uploaded file itself. Redaction permanently overwrites the stored file — no copy of the original is kept once redaction completes (see the one narrow, time-limited exception below). You can also run it retroactively over previously uploaded documents from the Documents page.

What gets redacted: any person's name (yours, a doctor's, a technician's), dates of birth in any printed format, phone and fax numbers, email addresses, mailing and facility addresses, government health identifiers (e.g. a BC Personal Health Number or MSP number), and photographs of people. Detection uses an AI model (see Section 7 for which one and where); the redaction boxes are then positioned using the document's own text or local optical character recognition that runs entirely on our own server — no additional third party is involved in positioning. This works on scanned and photographed pages, not just typed ones, and covers photo uploads as well as PDFs.

This is thorough but still best-effort, not a guarantee. When the system cannot confirm a page was fully checked (for example, a page it couldn't read, or a photo processed by the smaller Canadian model described in Section 7), the document is flagged "needs review" in your Documents list so you know to look at it yourself rather than being silently told it's clean.

Diagnostic exception: to investigate a reported redaction failure, a developer can temporarily opt a specific account into a debug capture that keeps a copy of a document's pre-redaction bytes for up to 24 hours before automatic deletion. This is off for every account by default, is only ever enabled for a named account during an active investigation, and the captured copy is readable only by the server itself — not through any user-facing session, including the account owner's.

This is separate from, and does not require, "Canadian Data Residency" (Section 7) — de-identification reduces what identifying detail is stored in your account at rest, while Canadian Data Residency controls where AI processing happens.

6. Audit logging

We keep an internal, append-only record of security-relevant events on your account. It covers four things: who read your data, who changed it, where it was sent, and who signed in.

• Access — viewing or downloading a stored document; creating, viewing, or revoking a share link (including views by whoever you shared the link with).
• Changes — each time a health record (a lab result, medication or supplement, immunization, procedure, condition, allergy, or family history entry) is created, updated, or deleted. We record which fields changed, never the values: an audit log holding the before-and-after of your health data would just be a second copy of it, kept for longer. An import is recorded as a single entry naming the source file and how many records it added, rather than one entry per record — a 400-result lab import would otherwise bury everything else in your log without telling you anything more.
• Disclosures to AI — every single request this app sends to an AI model on your behalf, whether to Anthropic or to the Canadian server (Sections 7 and 8). Each entry records which feature made the request, which backend received it, what kind of data went (a document, a summary of your health data, or plain text), which of your records it referred to, and whether the data had been de-identified before it left. A failed request is logged the same way a successful one is — the data still left. This is the log that answers "what has actually been sent about me, and was it redacted first?"
• De-identification and deletion — running the de-identification feature described in Section 5, and deleting your data or your whole account (including a count of what was removed from each table).
• Authentication and administration— successful and failed sign-ins, turning two-factor authentication on or off, and any time an operator opens an admin screen that shows other people's accounts.

We do not log routine, automatic reads the app itself performs to render a page.

It cannot be rewritten. The database itself refuses any edit to an audit entry and refuses deletion of one, including by us and including by the administrative key that bypasses every other permission in the system. The single exception is the scheduled retention purge described in Section 11, which can only remove entries by age and which writes an entry of its own recording that it ran and how much it removed.

You can read your own. Everything logged about your account is shown to you in plain language under Privacy & Activity in the app — you do not have to ask us for it. That includes operator access: when someone administering this app opens a screen that includes your account, the event is written into your trail as well as theirs, so "did anyone look at my data?" is a question you can answer yourself rather than one only we can answer on your behalf.

Who else can see it: an operator of this app can view the audit log and the account list (email address, sign-up date, sign-in times, and which settings you have on) across all accounts, which is what makes the log useful for investigating a problem. Doing so is itself logged, on both sides. An operator viewing that log sees that a document was accessed or a record changed — not the contents of your health records, documents, or Coach conversations, which are not part of it.

7. Who we share information with

We use a small number of service providers ("subprocessors") to operate this app. Each only receives the data it needs to perform its function:

• Supabase — database, authentication, and file storage. All of it — every table, every uploaded document — is hosted in Canada (Montreal region, ca-central-1), deliberately chosen for Canadian data residency. This is where your data lives at rest.
• Vercel— hosts and runs the application code itself (what serves you this website and processes your requests). As of July 2026, this runs on Vercel's Montreal region (ca-central-1) — the same region Supabase uses. In practice this means: both where your data is stored at rest and where every page/action you take is processed are now in Canada.
• Anthropic (Claude API)— powers every AI-assisted feature in this app: all document/photo imports (lab reports, CGM/glucose, CPAP, immunization records, supplement/medication labels, procedure/pathology/imaging reports, medication + immunization history, insurance booklets, food sensitivity reports), the Import page's auto-detect classifier, the automatic de-identification described in Section 5 (finding the identifying content to redact requires reading the document), AI Insights, the Coach chat, Doctor Visit Prep, and Housekeeping. Each sends the relevant data to Anthropic — the uploaded file itself for document processing, or a summary of your health data for the generation features. By default ("Canadian Data Residency" off), that data is processed by Anthropic outside of Canada — Anthropic's API has no Canada-specific residency option and may process data on infrastructure in any country it operates in. Anthropic states it does not use API data to train its models by default. Turning the setting on removes Anthropic from the picture entirely — see Section 8, which sets out what that setting does and what it costs you. Manual entry never involves Anthropic or any AI model, regardless of this setting.
• [Email provider, e.g. Resend] — sends account-related emails (password resets, confirmations).
• [Payment provider, e.g. Stripe] — processes payments, once enabled. We do not receive or store your full card details.

We do not sell or rent your personal information to third parties, and we do not share your health data with advertisers.

8. Canadian Data Residency — what it does, and what it costs

Where your data lives is already Canadian and is not a setting: the database, your uploaded documents, and the servers running this app are all in Montreal (Section 7). The one thing that leaves the country by default is AI processing, and the Canadian Data Residency toggle in your Profile is what controls it.

Off (the default): AI work goes to Anthropic's Claude API, which may process it on infrastructure outside Canada.

On: every AI-assisted feature — imports, the auto-detect classifier, the de-identification described in Section 5, Insights, Coach, Visit Prep, and Housekeeping — is instead run on a small server we host in British Columbia. No health data is sent to Anthropic at all.

We think you should know the tradeoff rather than discover it, so: this setting is not strictly better in one direction. Turning it on costs you real capability.

• Imports take substantially longer. Measured on a 120-page compiled lab history: roughly 20 minutes with it on versus roughly 2 minutes off.
• Imports find somewhat less. On that same document the Canadian server extracted about 80% as many results, mostly by skipping panels on the densest pages. What it did report agreed with the Anthropic run on 99% of shared values — it is not less accurate so much as less complete.
• Redaction gets more cautious rather than better. The same setting decides which model finds the identifying content to black out of your stored files. The Canadian server is weaker at that on scanned and photographed pages. Rather than trusting it silently, those documents are marked "needs review" in your Documents list — so choosing residency means more of that checking falls to you.
• It can be unavailable. It is a single self-hosted machine, not redundant infrastructure. When it can't be reached, the affected feature reports the failure and stops — it does not silently fall back to Anthropic, because doing so would violate the choice you made.

If you are in Quebec, note that Law 25 imposes stricter requirements on sending personal information outside the province than the rest of Canada does; the app says so on your Profile page and we suggest turning this on.

9. Cookies

We use only essential cookies required to keep you signed in. We do not currently use advertising or third-party tracking cookies.

10. Your rights and choices

You can view, edit, or delete your health entries and documents directly in your account at any time, and you can read the full audit trail for your own account under Privacy & Activity without asking us for it (Section 6). To request a full export or deletion of your account and associated data, contact us at [privacy@yourdomain.com]; we will respond within [30] days.

11. Data retention

We retain your data for as long as your account is active. If you delete specific entries or documents, they are removed immediately. If you request account deletion, we will delete your data within [30] days, except where retention is required by law (e.g. financial records related to completed orders).

The audit log described in Section 6 is the one thing that is not deleted with your account: entries tied to a deleted account are kept intact, since a record of who accessed your data that disappears the moment an account is deleted would defeat its purpose. It is not kept forever either — a scheduled job runs daily and enforces these limits:

• Deletion and de-identification entries: kept indefinitely. The record that an erasure happened is the one record that must not be erased — it is the proof your request was honoured.
• Everything else in the audit log: 7 years, then permanently removed. Long enough to investigate an incident years after the fact, short enough not to be hoarding.
• AI usage counts (Section 2): 13 months. That is operational metering, not a compliance record, so it gets a much shorter life.

The purge can only ever remove entries by age — it cannot be pointed at a particular account, person, or kind of event — and it records its own run in the log it just pruned.

12. Children's privacy

This service is not directed at children, and we do not knowingly collect information from anyone under [16].

13. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, notify you directly.