Plain English. No dark patterns. This describes what the software actually does, not what we intend it to do — last revised August 30, 2026.
On secured infrastructure in Singapore. Compute runs on a Vultr VPS in their Singapore region; the Postgres database is Supabase Singapore. TLS termination via Let's Encrypt. As the beta grows we'll add regional residency options so members can pick the data centre closest to where they live.
The parsed values from your lab panels, wearable summaries from any providers you connect, the DNA variants our catalogue covers, your supplement, nutrition, blood-pressure and workout logs, any health conditions and notes you add, and the conversational history of your AI sessions.
We do keep your original lab reports, and any other medical document you add. This changed in August 2026. Until then a report was read and the file discarded; members reasonably expected a health record to hold their records, so uploaded documents are now stored and you can download them again from Medical records under My Health.
Files live in private storage that only your account can read. They are not public, not shared, not indexed, and not sent to any AI provider — only the values read out of a lab report are used that way, exactly as before. You can delete any document individually, and deleting it removes the stored file itself, not just the listing.
When you upload a raw consumer-DNA export (23andMe, AncestryDNA, MyHeritage), the whole file is sent to our server, parsed in memory, and only the variants in the Lumenai catalogue are written to the database. Everything else is discarded and never stored.
To be precise about the part people care about: the file does leave your device. It is not stored after parsing, but it is transmitted, and we would rather say so than let you assume otherwise.
Raw DNA files are the one document we still do not keep, and that is deliberate. Storing lab reports is worth the trade because you need them back; a raw genotype file is the most re-identifying thing you could hand us, and the catalogue variants we extract are all the product actually uses.
Three companies other than us touch your record, all as processors working on our instructions:
Anthropic's Claude is used in development and internal evaluation, not for member-facing features. If that changes, this page changes with it.
Each request carries the context your account contains — panels, DNA variants, supplements, nutrition, wearable summaries, your conditions and notes, and the conversation so far.
When you upload a lab panel, the page images go to the model as images. We do not redact them first, so anything printed on the report — your name, date of birth, the ordering clinic, a patient number — goes along with the results. If that matters to you, cover it before you photograph or upload the page.
We never sell, license, or trade your data. We never train models on your record without your explicit opt-in. No advertiser, marketing partner or data broker receives your health data in any form, individual or aggregate. Advertisers are not customers — members are.
Wearable API keys and OAuth tokens are encrypted at rest with AES-256-GCM, the key held in environment configuration on the host. TLS in transit.
Row-level security is enabled in Postgres on every member-owned table. In practice most of the application reads through a privileged server-side connection that scopes every query to the signed-in member, with row-level security as the backstop rather than the first line. Both are real; we would rather describe the arrangement accurately than claim the database alone is what stands between two members' records.
Export gives you a single JSON file containing every member-owned table we hold for you — profile, panels and biomarkers, wearables, workouts, nutrition, supplements, vitals, DNA, AI history, and the rest — plus the paths of any meal thumbnails and of any medical documents you have stored. The export is a JSON file and does not embed the documents themselves; download those from Medical records under My Health.
Deletion is immediate and irreversible. When you confirm it, your member record and every row that references it are deleted, your sign-in is destroyed, and your meal photos and every stored medical document are removed from storage — the files, not just the rows pointing at them. There is no thirty-day grace period and no soft-delete we could restore from, so export first if you want a copy. Revoking Lumenai's access inside Withings or intervals.icu is a separate step you should also take — our copy of the token is gone, but they still list us as authorised.
Auth cookies for sign-in (Supabase). No advertising trackers, no third-party analytics — there is no analytics SDK in the application at all. Server logs retain request metadata for two weeks for debugging. We keep an audit log of significant actions on your account, which records the action, your account, the IP address and the browser it came from.
Email jimmy.sess@gmail.com and a human will get back to you. There is no chat bot, no ticket queue.