How we protect your health data
AliveNow handles sensitive health information. Here's exactly what we've shipped, what's still in progress, and how to exercise your rights - in plain English.
What counts as PHI on AliveNow
Protected Health Information is anything that links a person to a health detail. On AliveNow that means:
Lab & blood work results
Uploaded PDFs, parsed biomarkers, and AI-generated protocols.
Health context shared with AI
Dosha profile, symptoms, mood, and journal entries you opt into AI assistance for.
Wearable & biometric data
Steps, HRV, sleep, and any device-linked health metric.
Identifiers
Email, name, and account identifiers when paired with the above.
Safeguards we've shipped
6 controls · live in productionThese are running today. Every one is code-shipped, tested, and verifiable.
Encrypted at rest and in transit
AES-256 storage encryption and TLS 1.2+ for every request.
§164.312(a)(2)(iv) · 164.312(e)PHI access audit log
Every view, export, and admin lookup of health data is recorded.
§164.312(b)AI gateway PHI redactor
Names, emails, and direct identifiers are stripped before any model call.
§164.514Automatic logoff
30 minutes idle or 4 hours maximum session - your screen never stays open.
§164.312(a)(2)(iii)Breach detection alerts
Cross-account access, after-hours admin views, and mass exports trigger alerts.
§164.400Right to export and erase
One-click export of your full record and one-click erasure from Settings → Privacy.
§164.524 · 164.528What's still in progress
We'd rather tell you what isn't done than imply we're further along than we are. HIPAA is part technology, part paperwork - paperwork lives here.
BAA with Supabase
Required to move to a HIPAA-eligible plan tier.
BAA with AI inference provider
Required before processing identifiable PHI through the gateway.
BAA with email provider
Required if PHI is ever included in transactional email.
Formal Risk Analysis document
§164.308(a)(1)(ii)(A)Template drafted; vendor review pending.
Designated Privacy Officer
§164.530(a)Named at incorporation milestone.
Workforce training program
§164.530(b)Curriculum scoped; rollout tied to first hire.
Full control-by-control mapping against 45 CFR Part 164.
Subprocessors
Vendors who touch any part of the platform - and whether a Business Associate Agreement is in place.
| Vendor | Purpose | Region | BAA |
|---|---|---|---|
| Supabase | Database, auth, storage | EU/US | BAA required |
| AI inference provider | AI inference (redacted inputs) | US | BAA required |
| Perplexity AI | Research synthesis (de-identified only) | US | No PHI shared |
| Resend | Transactional email (no PHI in body) | US | BAA pending |
| Stripe | Payments (no PHI transmitted) | Global | No PHI shared |
Your rights, one click away
You can export everything we hold on you, or delete it entirely. No tickets, no waiting.
Export your data
Download a complete JSON bundle of your profile, lab results, protocols, and history.
Open Privacy SettingsErase your account
Permanently remove your record. Audit logs retain hashed IDs for legal compliance.
Open Privacy SettingsContact our Privacy Officer
Questions, concerns, or formal requests about your health data. We respond within 72 hours.