1 · Data we collect

The system stores only data you provide or explicitly connect:

• Account basics — email address and account timestamps.
• Biometric readings from sources you connect (WHOOP; Apple Health and Epic integrations as they land), normalized into per-observation records.
• Protocol entries you type in — supplements, medications, practices — recorded descriptively, exactly as you entered them.
• Memory entries — observations and stated preferences the assistant retains across sessions, encrypted before storage.
• Consent records — each grant or revocation you make, with the policy version it referred to.
• Operational records — an audit trail of access events. Raw IP addresses are never stored; only a SHA-256 hash is kept.

2 · Purposes

Data is used to display your readings, describe patterns and trends in them, and maintain continuity between sessions. The system is descriptive only: it does not diagnose, prescribe, or recommend. Each purpose is tied to a consent scope you control:

• Biometric data ingestion — Read and store biometric readings from connected sources (WHOOP, Apple Health, Epic).
• Health data interpretation — Describe patterns and trends in stored readings. Descriptive only — the system does not prescribe or recommend.
• Memory persistence — Retain encrypted memory entries about observed patterns and stated preferences across sessions.
• De-identified research — Optional sharing of de-identified data for research. Off by default.

3 · Storage and encryption

• Data is stored in a Postgres database (Supabase) with row-level security policies restricting each row to its owner.
• Integration tokens and memory content are encrypted at the application layer with AES-256-GCM before they reach the database.
• Connections to the database and to integrated providers use TLS in transit.
• Every authenticated read or write of health data is recorded in an append-only audit log with PHI-free metadata.
• There is no public signup. Access is limited to explicitly authorized accounts, protected by authenticated sessions with step-up re-verification for sensitive actions.

4 · Retention

Health records are corrected by ending or superseding them, never by silent deletion, so the history of what the system knew and when remains auditable. Deleting an account removes the data rows that belong to it via database-level cascade.

[TO BE COMPLETED BY LEGAL] — binding retention periods per data category, and backup / archival retention terms.

5 · Your rights

• Access / export — you can download your data as JSON at any time (profile, consent history, signal summaries, protocol entries, memory entries) via the account export endpoint.
• Consent control — every scope above can be granted or revoked at any time; revocations take effect immediately and are recorded in the consent ledger.
• Correction — entries you created can be ended or superseded; the correction chain is preserved.

[TO BE COMPLETED BY LEGAL] — jurisdiction-specific rights (GDPR / CCPA / HIPAA applicability), response timelines, and the formal DSAR process.

6 · Contact

Questions about this draft or requests concerning your data:

[TO BE COMPLETED BY LEGAL] — designated privacy contact, controller identity, and postal address.