Selfsense

Not yet reviewed by a lawyer. This describes what Selfsense actually does as of the date below, checked against the running system. It is the draft a privacy lawyer will review before Selfsense opens to the public. The short version is What happens to your data.

Privacy policy

What we hold, where it is, who handles it, and how it is locked, shared and deleted.

Version 2026-11-03 · in effect from Nov 3, 2026

1. Who we are

Selfsense is a small service, run from British Columbia, Canada, that keeps one person’s health record in one place: lab results, medications and supplements, documents, and readings from wearables and medical devices. It lets you chart that record, ask questions about it, and share parts of it.

Questions, requests and complaints about your information go to privacy@selfsense.ca. The person who reads that address is the one responsible for privacy here. We answer within 30 days.

Which privacy law applies follows where you live, not where the servers are: Quebec’s Law 25 for Quebec residents, British Columbia’s Personal Information Protection Act for people in BC, and the federal PIPEDA elsewhere in Canada. We build to Law 25, the strictest of the three, so one standard covers everyone.

2. What we hold

Your account

  • Your email address, and your password if you set one (stored by Supabase as a one-way hash, never readable).
  • If you sign in with Google: the link between the two accounts, and what Google sends with it (Section 8).
  • If you add a passkey: its public key, a name such as “iCloud Keychain”, and when it was last used. The private key never leaves your device or password manager.
  • If you turn on two-step sign-in: the authenticator factor Supabase needs to check your codes.

Your profile

Your names (preferred and legal), date of birth, sex, height, weight, blood type, country and province, time zone, unit system, and your AI choice (Section 5). Your legal names and date of birth are there so that identifiers can be found and masked in what you share (Section 6).

Your record

Whatever you add or import: lab results, medications, supplements and doses, protocols and their changes, immunizations, procedures, conditions, allergies, food sensitivities, insurance plans and benefits, goals, night logs, notes, and the questions and symptoms you keep for your next visit. Family history is information about other people(a parent’s condition, a sibling’s age at onset). Add it only where you are comfortable doing so.

Documents you upload

The original file (a lab report, a scan, a photo of a label), kept sealed (Section 3), and what was read out of it into your record. For many PDFs we also keep a sealed copy of the file’s own text layer, with your names, birth date, email addresses, phone numbers, postal codes and long numbers taken out, so the record can be searched.

Readings from devices and services

From what you connect or import: sleep, heart rate and heart-rate variability, oxygen, breathing, steps and activity, workouts, body composition, CPAP use, glucose and, on Android, any cycle-tracking data you choose to grant. Section 7 says what each connector reads.

What the app writes for you

Coach conversations, explanations of lab reports, notes on a new lab panel, questions from housekeeping (a missing dose, a possible duplicate), the short descriptions of medications and supplements, and the stories on your overview. These are kept with your account so you can come back to them, and go when it does.

Records of use

  • The audit trail (Section 10).
  • The time of each sign-in. Not your IP address, location or device.
  • AI usage counts: which feature asked, which model answered, how many tokens and how long. A meter, not a transcript.
  • From the Android app, crash reports if you turn them on: the error, the app and Android version and the phone model.
  • Messages you send us through the feedback form.

3. How it is locked

Everything sits behind your sign-in, and the database enforces that each account reads and writes only its own rows. On top of that, the parts that say who you are and what you wrote are encrypted with keys that are yours alone.

Documents

Every file you upload is sealed with its own random key (AES-256-GCM), and that key is sealed by your account’s own key in Google Cloud KMS, in Montreal. Only one program can use those keys: the gatekeeper, a small service on Google Cloud Run in Montreal. The website never holds a key and never sees a sealed file. To open a document, the website asks the gatekeeper, which checks who is asking (your own sign-in, or a named background job working for you), writes the opening into your audit trail, and only then unseals it. A sealed file copied into another account will not open.

The database

The database is Supabase, on Amazon’s servers in Montreal. Your names, date of birth, notes, coach conversations, document titles and file names, family history, insurance plan numbers, visit questions and the app’s written explanations are encrypted inside it with a record key that belongs to your account. That key is itself sealed by your KMS key, and the gatekeeper releases it for one request at a time, logging each release.

What is not encrypted, and why. Numbers, dates and the names of things stay readable inside the database: lab values and test names, medication, supplement, condition, procedure, vaccine and allergen names, workout names, readings, doses, and your sex, blood type, country and province. Charts, search and the coach filter and average them in the database, which encrypted values would prevent. So would some summaries the app writes about your record, the names of paired phones, and the shape of each file name inside its storage address. Your email address sits in Supabase’s sign-in table and is not encrypted. A copy of the database alone would therefore show numbers and the names of things tied to an account, and the account to an email address, but not your name, your notes or your documents.

What this does not do

This is not end-to-end encryption. Selfsense opens your record to show it to you and to run the features you use, and the operator controls the Google project that holds the keys. What sealing changes is that every opening goes through one door that writes it down, and that a stolen copy of the files or the database is not your record. The keys are software-protected in Cloud KMS, not held in dedicated hardware.

4. Where it is, and who handles it

Every company below is American, including the ones running in Montreal. So this is Canadian residency (where the data is stored and processed), not sovereignty (whose law can reach it).

  • Supabase: the database, sign-in, file storage and Supabase Vault (where connector tokens are kept). Amazon Web Services, Montreal (ca-central-1). Your browser and the phone app also talk to Supabase directly, for signing in, two-step codes and fitness-file imports. Supabase’s address is served through Cloudflare, which opens the encrypted connection at its location nearest you before passing it on to Montreal: from British Columbia that is Vancouver (measured on Nov 3, 2026), and from elsewhere it is wherever is nearest you. What passes through is decrypted there in transit; nothing is stored there. The website’s own requests to Supabase leave from Montreal.
  • Google Cloud: the gatekeeper, your KMS key, the masker (Section 6), the AI (Section 5) and the nightly backup (Section 11). Montreal (northamerica-northeast1). The project is locked by policy so that nothing can be created outside Montreal.
  • Vercel: runs the website, in Montreal (yul1). Your connection is routed to Vercel’s nearest region, and the encrypted connection is opened there before going on to Montreal. From western Canada that region is Portland, in the United States (measured from Vancouver on Nov 3, 2026), so what you send and see passes through the US in transit, decrypted, though nothing is stored there. From central and eastern Canada the nearest region is normally Montreal itself. Vercel offers no way to choose the region. Closing this gap means paying for a connection point of our own in Montreal, and that is not done today.
  • Anthropic: Claude, in the United States, only for an account that has chosen it and agreed to processing outside Canada (Section 5).
  • Resend: email, in the United States. No health information is emailed (Section 9).
  • Google, Oura, Garmin, ResMed: only if you sign in with Google or connect one of them (Sections 7 and 8).

We do not sell your information, rent it, use it for advertising, or give it to anyone to train AI. There are no advertising or analytics trackers on the site.

5. AI: in Canada unless you choose otherwise

Every AI feature runs on Gemini (Google’s Vertex AI, on its Montreal endpoint, for processing in Canada). That is the default for every account, and every existing account was moved to it on Nov 3, 2026. It handles all of these:

  • reading documents you import (lab reports, CPAP and glucose reports, immunization records, labels, procedure reports, medication histories, insurance booklets, food-sensitivity reports), and telling what kind of document a file is;
  • the coach;
  • explanations of a lab report (the model is given the report’s findings in words, not its numbers) and the note on a new panel;
  • housekeeping, the descriptions of medications and supplements, and the words on some stories.

What is sent. To read a document, the whole file goes to the model, unsealed: it has to see the page. The coach and the other features send a summary drawn from your record, and before it leaves we take out your names, birth date, email addresses, phone numbers, postal codes and long numbers. That scrubbing finds what it was told to look for; a name it does not know (a doctor’s, a clinic’s) can go out.

Choosing Claude instead. Profile lets you move every AI feature to Claude (Anthropic, in the United States). Because that sends the files and summaries above out of Canada, the database itself refuses the change unless you tick a consent naming what will leave, have signed in within the last 15 minutes, and, if your account uses two-step sign-in, entered your code in that sign-in. Nothing else can make the change: not the phone, not a connected assistant, not a background job, and not us. The change, with the consent you gave, is written into your audit trail, and moving back to Gemini withdraws the consent at once.

Never the other way by accident. The masking of shared documents always runs on Gemini in Montreal (Section 6). If an account on Claude hits a Claude failure because our Anthropic account has run out of credit, that request is retried on Gemini in Montreal. Nothing ever sends a Gemini account’s data to Claude.

What the providers keep. Both are used under their business terms, which exclude training on what we send. Gemini’s prompt caching is set to memory only. Each provider keeps its own short-lived records under its own terms. Every request is in your audit trail with the feature, the provider and what kind of data went.

An assistant you connect. If you connect an AI assistant (such as Claude) to your record from Profile, it can read it through tools that scrub the same identifiers before answering, and can propose changes you approve. What the assistant does with what it reads is governed by your own agreement with its maker. Disconnecting it ends its access.

You can make a link that shows chosen parts of your record to someone else, such as a doctor. You pick the sections, an optional password, and when it stops working (a date, or a time after it is first opened). You can revoke it at any time, and every view is in your audit trail.

Documents are never shown to a share link as uploaded. A link can see only a masked copy: identifiers are found by Gemini in Montreal, page by page, together with fixed rules for your own names and birth date, health numbers, phone numbers, postal codes, email addresses and long numbers, and blacked out. The page is then flattened to an image, so nothing underneath can be recovered. A page is withheld instead when it will not render, the model fails, a scan cannot be read, or an identifier cannot be placed. The mask is made the first time a document is shared and stored sealed under your key.

This is careful, not perfect: an identifier both layers miss stays visible. Your stored documents are not changed by any of this; you and the AI you chose see the original. Who you send a link to is your decision (see the terms).

7. Connectors and imports

Each is off until you turn it on, and each import is in your audit trail (one summary row a day for the nightly ones). Disconnecting stops it and deletes its token; deleting your account removes its tokens.

Oura

Connecting sends you to Oura’s own page; Selfsense never sees your Oura password. Oura learns that you authorised “Selfsense” and which data, and then sees our servers (Vercel, Montreal) fetch it with your token twice a day. We ask for daily summaries (sleep, readiness, activity), stress, oxygen, workouts, heart health (cardiovascular age, VO2 max) and heart rate; not your email, age, sex, height, weight, tags or sessions. We store the numbers we map, your workouts (type, label, start, length, calories, distance, intensity), each night’s heart-rate, HRV and sleep-stage traces, and the all-day heart-rate stream with Oura’s label for each reading, plus one refresh token and the granted scopes, encrypted in Supabase Vault and readable only by the import. Oura, a Finnish company, keeps the originals on its own servers. Disconnecting also ends the grant at Oura.

Garmin Connect

Garmin offers no sign-in page for individual apps, so Garmin is connected with a one-time sign-in run outside the website, using Garmin’s own code by text message. Only the resulting token is stored, encrypted in Supabase Vault; never a Garmin password. The import runs twice a day and reads sleep, heart rate, HRV, oxygen, breathing, stress, activity, workouts and body composition.

ResMed myAir

ResMed offers no sign-in page for other apps, so you enter your myAir email and password in Profile. They are used once and never stored: our server signs in to ResMed with them, the way the myAir app does, and keeps only the refresh token ResMed returns (and your country), encrypted in Supabase Vault. If ResMed does not return a token, nothing is saved. The import uses and renews that token twice a day; if it ever stops working, you reconnect. It reads each night’s usage, AHI, leak, mask seal, mask on and off events, and myAir score.

Health Connect (Android app)

The Android app reads what you grant it in Health Connect (sleep, heart rate, steps, workouts, weight and body composition, oxygen, glucose, nutrition, cycle tracking and similar) and sends it to Selfsense with the phone’s time zone. It holds a pairing token, stored encrypted on the phone, that you can revoke from Profile. This includes glucose readings another app (such as Juggluco) wrote to Health Connect: we receive each reading’s time and value, and nothing from Abbott.

Files you drop on the site

  • Wearable exports (Garmin, Google, Apple Health, Oura): read in your browser, and only the readings are sent. The export file is not uploaded.
  • LibreView glucose CSV: read on the server and not kept. Its first line carries the patient’s name, which is never stored; only times and values are. A LibreView report PDF is kept as a document like any other, and its figures are read by the AI you chose.
  • Health Gateway CSVs: read on the server, not kept, no AI. Medications keep the drug, DIN, first and last dispense dates, quantity, strength and form. The prescriber’s name is in the file and is read, but nothing stores it or sends it anywhere. The laboratory list is read to compare dates and then discarded. Health Gateway itself is never contacted: you download the file.

8. Signing in

Sign-in is Supabase’s, in Montreal. You can use an email and password, Google, a passkey, or several; two-step sign-in with an authenticator app works with all of them.

Google sees that you signed in to Selfsense, and when, never your record. We ask Google only for the basics (your Google account id, name, email address and profile picture link), and Supabase keeps them with the link between the two accounts. Signing in with Google when an account already has that email address joins the two. You can remove Google from Profile as long as another way in remains. Google’s own sign-in servers are Google’s, wherever Google runs them.

Passkeys work on selfsense.ca. The private key never leaves your device or password manager; we keep its public key, its name and when it was last used.

Every sign-in, failed attempt, and way in added or removed is in your audit trail.

9. Email

Email goes through Resend, in the United States: the sign-in emails (confirming your address, resetting a password), the download link for the Android app, and a link to your visit page if you ask for one. We do not email health information, not even in a subject line. The visit email carries only a link; the page behind it opens after you sign in, with your two-step code if you use one, and the PDF is a button there. Emails go only to your own address. Resend keeps its own logs under its own retention, which we cannot delete; visit emails sent before Nov 3, 2026 attached the PDF itself, and those copies are in them. We send no newsletters or marketing.

10. The audit trail

Selfsense keeps an append-only record of what happens to your account, and you can read all of it under Privacy & activity without asking us. It covers:

  • every time a document is unsealed or your record key is released, and who or what asked (you, a named background job, or a share link);
  • every change to your record, from any door (the website, the phone, the coach, a connected assistant, a scheduled job), naming the fields that changed but not their values;
  • every request sent to an AI on your behalf, and what kind of data went;
  • share links made, viewed and revoked, and masks made for them;
  • sign-ins, failed attempts, two-step and sign-in methods added or removed, phones paired and revoked, connectors connected and disconnected;
  • any time an operator opens an admin screen that includes your account, written into your trail as well as theirs;
  • exports and deletions.

Nobody can edit or remove an entry, including us: the database refuses it. The two exceptions are the age-based purge in Section 13, which records its own run, and the scrub after an account is deleted (Section 12).

11. Backups

Each night a full copy of the database and the stored files is made on the operator’s own computer, in British Columbia, and mirrored to a private Google Cloud Storage bucket in Montreal (locked to Montreal by policy, no public access): seven daily copies, four weekly and six monthly, so up to six months back. In those copies your documents and your encrypted words stay sealed under your key. Numbers, dates, the names of things and your email address are readable in them, as they are in the database (Section 3). Until Nov 3, 2026 the copies were kept in the operator’s Google Drive instead, which Google may store outside Canada; those older copies are being deleted.

12. Deleting

You can delete any entry or document yourself, at once. Profile also has “Delete all my data”, which empties the record and keeps the account, and “Delete my account”, which ends it. In order, deleting an account:

  1. Schedules your KMS key for destruction. After seven days it is gone, and nothing ever sealed under it (your documents, your encrypted words, in any copy, backups included) can be opened again. Within those seven days the account can be restored if you ask. If this step fails, nothing is deleted and you are told so.
  2. Deletes your connector tokens, every stored file, the account and every row of your record, your record key and your sign-in times.
  3. Scrubs your audit trail: the entries stay (type, time and ids), but your email, file names, labels and any other words are removed.
  4. At the next nightly backup, removes the account from every kept copy.

What survives. The scrubbed audit entries, including the one recording the deletion and how many rows went from each table. AI usage counts, with your account removed from them. Copies outside our reach: emails in Resend’s logs, and whatever each AI provider and connected service keeps under its own terms. Request logs at Vercel and Google Cloud, which carry an account id and no words, and expire on their own within about 30 days. If you want your account restored, say so within the seven days.

13. How long things are kept

  • Your record and documents: until you delete them or your account.
  • The audit trail: 7 years, then removed by a daily job that works only by age. Records of deletion and de-identification are kept indefinitely: they are the proof an erasure happened.
  • AI usage counts: 13 months.
  • Backups: up to six months, minus deleted accounts (Sections 11 and 12).

14. Your rights

You can see everything we hold about you in the app, correct it, download your whole record from Profile (“Download my record”), read your own audit trail, change your AI choice, disconnect any connector, revoke any share link, phone or assistant, and delete your account. For anything the app does not let you do yourself, such as asking what a provider received, write to privacy@selfsense.ca.

If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, the Commission d’accès à l’information du Québec, or the Office of the Privacy Commissioner of Canada, depending on where you live.

15. Cookies

Only the ones the site needs to work: the cookies that keep you signed in, and one that remembers a share link you unlocked with its password. Your light or dark choice is kept in your browser, not sent to us. No advertising or tracking cookies.

16. Children

Selfsense is not meant for children, and we do not knowingly hold the record of anyone under 16.

17. If something goes wrong

If we learn of a breach of your information that creates a real risk of significant harm, we will tell you and the privacy commissioner that the law requires, as soon as we can, and keep a record of every breach. The written breach plan behind that promise is being prepared with the lawyer’s review (Section 19).

18. Changes

When this policy changes in substance, its version date above changes, and the version each account accepted is recorded. Existing accounts see a notice at the top of every page of their record, naming the change and linking here, until they agree to the new version; if you do not agree, you can delete your account instead.

19. Not yet in place

We would rather say this than let you assume otherwise. Before Selfsense opens to the public, these are still to be done:

  • a privacy lawyer’s review of this policy and the terms;
  • a privacy officer named on this page;
  • separate consent for each remaining purpose (storing your record, AI processing in Canada, share links), rather than one acceptance at sign-up; processing outside Canada already has its own consent (Section 5);
  • a written breach plan and register;
  • a data processing agreement reviewed with each provider;
  • a privacy impact assessment, which Law 25 requires.