“Are you HIPAA compliant?”

The short answer

We are not a HIPAA business associate, and that is by design rather than by oversight.

HIPAA attaches to who the software works for. It does not attach to how sensitive the data is, and it does not attach to a clinician happening to read something.

We are the first row and intend to stay there.

What that means for you

Nothing to negotiate, no BAA, no vendor review. You are not disclosing protected health information to us, because you are not sending us anything — your patient is telling their own app about their own body.

It also means there is no practitioner dashboard and no roster of your patients. We cannot build one without becoming a business associate, and we would tell you before we did.

One thing to keep clean: please do not send us patient information — not by email, not in a support request. Recommend the app and let the patient sign themselves up. That is what keeps the boundary above true.

What is actually stored

Identity: an email address. That is the only identifying thing held.

Content: their plan, phases, challenges, food log, symptom ratings and coach conversations — keyed to an opaque id, holding no name, no address, no date of birth, and no insurance, payment or government identifiers.

The two live separately, and joining them is a deliberate act rather than the default view. It is the same architecture at fifteen patients as at five thousand; there is no temporary beta arrangement to unwind later.

Why collect an email at all? Because breach notification cannot be discharged without a way to contact people. Software built unable to reach anyone has not reduced its exposure, it has guaranteed failure in the one situation where contact is the whole point. It is also how a patient recovers months of their own records after clearing a cookie.

Where it goes

Hosting and database: Vercel and Neon, in the United States.

The language model is Google Gemini on the paid tier, which does not train on submitted data, allows no human review of it, and retains briefly for abuse detection only. The free tier does the opposite and its own terms say not to send personal information. Because the tier cannot be read back from an API key, the application refuses to start unless the paid tier has been explicitly confirmed in its configuration — a deliberate tripwire rather than an assumption.

Nothing is sold and nothing is shared with advertisers, data brokers, employers or insurers. There is no advertising in the product and none planned.

What a patient can do

See everything held about them, and delete their account — which removes the user, the plan, the log, the coach conversations and the session through the database’s own cascades rather than a best-effort sweep.

What we do not claim

We would rather be dull and accurate here than impressive and vague.

No SOC 2, no HITRUST and no third-party security audit. One person wrote this.

Not a medical device and not attempting to be. It does not diagnose, does not interpret symptoms, and does not alter anything you have prescribed.

Two things are in progress rather than done, and are listed here rather than left for you to discover: automatic deletion of accounts inactive for twelve months, where the policy is written and the routine exists but is not yet scheduled; and a formal legal review of our terms and privacy documentation, which will be complete before we ask you to refer a patient.