Privacy Policy

1. What this covers

PuraGene is a personal health tracking application. This policy explains what we collect, how it is protected, who can see it, and how you remove it. It applies to puragene.com and the PuraGene web app.

2. Information we hold

• Account details: name, email, mobile number, invite code used, profile photo.
• Health information you enter: regimen items, doses taken or skipped, weight, blood pressure, lab values and lab report files, food entries, notes, photos, goals, appointments and expenses.
• Security and access logs: sign-in events, multi-factor changes, exports and report sends, with IP address, device/browser and timestamp.
• Consent records: which policy version you accepted and when.

3. How it is used

Your data is used only to operate the product for you: showing your schedule, doing your dose and inventory math, charting your trends, generating your reports, and — when you ask for it — answering questions in AI chat using your own records. We do not sell your data, and we do not use your health data for advertising.

4. Safeguards

• Encryption in transit (TLS) and at rest for the database and file storage.
• Row-level database security so every record is readable only by the account that owns it, enforced by the database itself rather than by app code.
• Lab report files live in a private bucket reachable only through short-lived signed links.
• Optional multi-factor authentication (authenticator app) on your account.
• Automatic sign-out after inactivity, configurable in Privacy & security.
• An append-only audit log of security-relevant events that you can review.
• Third-party API keys you supply are encrypted at rest before storage.

5. Who else processes data

We use subprocessors to run the service: cloud hosting and database/storage infrastructure, an email/SMS delivery provider for reports and account mail, and — only if you enable AI features — an AI model provider that receives the specific context needed to answer your question. We do not share your records with anyone else, and no clinician can log into your account.

5a. AI processing

When you use an AI feature we send a third-party AI provider only the context that answer needs: your profile basics, active regimen, recent metrics, food and notes, goals, lab values and the text of lab reports you uploaded. It is processed to return your answer and is not used to train public models or shown to other users. AI processing is a separate opt-in during setup, and the AI coach additionally requires a signed acknowledgment that it is a resource for ideas only, gives no dosing guidance and is not medical advice. Decline either and every non-AI feature still works.

5b. Retention

Your records are kept as long as your account exists. Deleting your account removes your profile, health entries, files, reports and AI threads immediately; encrypted backups age out within 30 days. Security and consent logs are retained for six years in line with HIPAA documentation practice, unlinked from deleted health content.

6. Sharing with your doctor

Reports leave PuraGene only when you send them. You save a doctor as a contact and choose the delivery method (email, text or saved PDF). Each send is recorded in your security log.

7. Your rights

You can view, correct and delete your data at any time in the app. From Privacy & security you can export a full copy of your records, review your access log, and permanently delete your account and all data. Deletion is immediate and irreversible; backups age out within 30 days.

8. HIPAA

PuraGene is a consumer tool you use for your own records, so it is generally not a HIPAA covered entity. We nevertheless build to the HIPAA Security Rule's technical safeguards — access control, unique user identification, automatic logoff, audit controls, integrity controls and transmission security — so the product is ready for covered-entity use. Nothing here is medical advice; always discuss your protocol with your doctor.

9. Contact

Questions or a data request? Email privacy@puragene.com. See also our Terms of Service.