Privacy Policy

Praneya (“we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Praneya cardiac wellness application and related services (collectively, the “Service”). By using the Service you agree to the practices described here.

Praneya is a wellness application, not a Software as a Medical Device (SaMD). Nothing in this policy or the Service constitutes medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider for medical decisions.

1. Information We Collect

Account & Profile Data

When you create an account we collect your email address, chosen display name, and authentication credentials managed by Supabase Auth. If you sign in via a third-party provider (e.g., Apple, Google) we receive only the profile fields you authorize that provider to share.

Health Profile

To power risk scoring and personalized insights we collect demographic and lifestyle information you voluntarily provide, including age, biological sex, height, weight, smoking status, family cardiac history, and any existing diagnoses you choose to enter.

Lab & Imaging Results

You may upload blood panel reports and imaging summaries (PDF, image, or structured data). We extract biomarker values from these files using AI-assisted parsing and store the structured results in your health record. Original uploaded files are stored in Supabase Storage.

Wearable & Biometric Data

With your explicit permission, Praneya connects to health platforms (e.g., Apple Health, Google Fit) to import metrics such as resting heart rate, heart rate variability, blood pressure readings, step count, sleep duration, and SpO₂. We pull only the metric types you authorize at the time of connection.

Wellness Diary

You may log daily entries covering mood, stress level, dietary notes, exercise activity, alcohol intake, and sleep quality. These entries are stored and used to personalize your wellness insights.

AI Chat History

When you use the AI wellness chat feature, your conversation messages and the AI-generated responses are stored so you can review them later and so the AI can maintain context within a session.

Usage & Technical Data

We automatically collect standard technical information including your IP address, device type, operating system, browser type, pages visited, feature interactions, and error logs. This data is used solely for service reliability and improvement and does not contain protected health information (PHI).

2. How We Use Your Information

• Risk scoring & trending: We compute validated cardiac risk scores (e.g., Framingham, ASCVD) and track biomarker trends over time using your lab results, biometrics, and health profile.
• Personalized wellness tips: Your profile, diary entries, and wearable data inform lifestyle suggestions tailored to your patterns.
• AI wellness chat: Your conversation history and relevant health data are sent to the Claude API (see Section 3) to generate contextually aware responses.
• Doctor report sharing: When you initiate a share, we generate a time-limited, token-protected report for your chosen healthcare provider.
• Lab request cards: We format your historical results into practitioner-friendly summaries at your request.
• Service operation & security: Account management, authentication, fraud prevention, abuse detection, and debugging.
• Product improvement: Aggregate, de-identified analytics to improve algorithms and user experience. We do not sell or share identifiable health data for advertising.

3. AI Processing (Anthropic Claude)

Praneya uses the Anthropic Claude API for two purposes: extracting structured biomarker data from uploaded lab reports, and powering the AI wellness chat.

When a request is sent to the Claude API, relevant portions of your data (e.g., document text, chat messages, and selected health context) are transmitted to Anthropic’s servers for inference. Anthropic processes this data under their Privacy Policy. Importantly, Anthropic does not use API-submitted data to train its models under their standard API terms.

We minimize data sent to the API to what is necessary for the specific task. We do not send your full health record in every request.

4. Storage & Security

• Database: All structured health data is stored in Supabase PostgreSQL, which encrypts data at rest using AES-256.
• File storage: Uploaded documents and images are stored in Supabase Storage with server-side encryption.
• Transit encryption: All data in transit is protected by TLS 1.2+ with HSTS enforced.
• Row-Level Security (RLS): Database access is governed by Supabase RLS policies so that each user can only read and write their own data at the database layer — not just the application layer.
• Session caching: Short-lived session data (e.g., rate-limit counters) is stored in Upstash Redis with TTL-based expiration. No PHI is stored in Redis.
• No PHI in logs: Our logging pipelines are configured to exclude personally identifiable health values. Error logs contain only anonymized identifiers and stack traces.

Despite these measures, no internet-based service is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@praneya.com.

5. Data Sharing & Disclosure

We do not sell your personal health data. We share data only in the following circumstances:

• At your explicit direction: Doctor sharing via a time-limited, revocable token or lab request cards generated and shared by you.
• Service providers (sub-processors): Supabase (database, auth, storage), Anthropic (AI inference), RevenueCat (subscription management), and Upstash (session caching). Each receives only the minimum data required for their function. See Section 8 for details.
• Legal obligations: If required by law, court order, or to protect the rights, property, or safety of Praneya, our users, or the public.
• Business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a materially different privacy policy.

6. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Export: Request a machine-readable copy of your health data. You will receive a download link by email once the export is ready.
• Correction: Update inaccurate data directly in the app or by contacting us.
• Deletion: Request deletion of your account and all associated data. See Section 7 for retention details.
• Restriction & objection: In certain circumstances, request that we restrict processing or object to specific uses.
• Portability: Receive your data in a structured, commonly used format.

To exercise any of these rights, contact us at privacy@praneya.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. When you request account deletion:

• Your account is deactivated immediately and your data is no longer accessible through the Service.
• All personally identifiable health data is permanently deleted from our production systems within 30 days of a verified deletion request.
• Encrypted backups may retain data for up to an additional 90 days before they are rotated out, after which deletion is complete across all systems.
• Aggregate, de-identified analytics derived from your data are not deleted as they cannot be re-associated with you.

8. Third-Party Services

Supabase

Provides our PostgreSQL database, authentication, and file storage. Supabase receives all structured health data and uploaded files. Data is hosted on infrastructure compliant with SOC 2 Type II. Supabase Privacy Policy.

Anthropic

Provides the Claude AI API for document parsing and wellness chat. Anthropic receives text content from uploaded documents and chat messages required for inference. Anthropic does not retain API data for model training under standard API terms. Anthropic Privacy Policy.

RevenueCat

Manages subscription state and purchase verification. RevenueCat receives your app user identifier, subscription product identifiers, and purchase receipts from the App Store or Google Play. RevenueCat does not receive your health data. RevenueCat Privacy Policy.

Upstash Redis

Provides serverless Redis for rate limiting and short-lived session caching. Upstash receives only anonymous session tokens and counter values — no health data or personally identifiable information is stored in Redis. Upstash Privacy Policy.

9. Children’s Privacy

Praneya is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a minor, we will delete it promptly. If you believe a minor has provided data to us, contact privacy@praneya.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification or email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact Us

For privacy-related questions, requests, or concerns, please contact our Privacy Team:

Email: privacy@praneya.com
Subject line: Privacy Request — [your request type]

We aim to respond to all inquiries within 30 calendar days. If you are located in the European Economic Area and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority.