Privacy
Exactly where your data goes
What you record here can be deeply personal. This page describes what the code actually does, stage by stage, including what we haven't confirmed yet. We don't claim HIPAA compliance or any certification.
The path, stage by stage
Every connection uses TLS (HTTPS). Stages 4 and 5 happen only when you use those features and have turned them on.
Stage 1
Your browser
Your device
You type your story, answers and messages, or upload a document.
No analytics or trackers run on PelvIQ pages, and the Content-Security-Policy only allows our own scripts — with one optional exception: if the sign-up bot check is switched on, Cloudflare Turnstile runs on the sign-in page only, to tell people from bots. It never sees anything you write in PelvIQ.
Stage 2
Our server
PelvIQ app, hosted on Vercel
Checks you're signed in, runs the safety screen on what you wrote, and decides what (if anything) an AI feature needs.
Doesn't log what you write.
Stage 3
Database & file storage
Supabase (Postgres, Auth, Storage)
Everything you save lives here. Every table is locked to your account by row-level security.
Documents go to a private bucket and open only through a link that expires in 60 seconds.
Stage 4
Claude API
Anthropic — only with “AI processing” on
Sent: task instructions; the text you wrote for that feature (story, answers, appointment notes, chat messages); and your structured history as labeled context, using short reference codes instead of database IDs.
Not sent: your email address or account or database IDs. An uploaded document is sent only when you choose “Read it” for that document; you check the text it reads before anything is suggested for your history. Anything you type — including names or places — is sent as written, so consider not using real names.
There are no separate chat modes: PelvIQ reads from your message whether you want support, research or reasoning about your own history, and shapes the reply to fit. Each chat reply is written with the same access to your saved history described above. Conversations started in the older “I need to talk” mode sent only a short outline of your history to a smaller model.
Stage 5
Research sources
PubMed (US), Europe PMC (UK), ClinicalTrials.gov (US), Crossref (US) — only with “Literature searches” on
Sent: a few generic medical search terms, checked by an identifier filter before sending. For a question you follow, the same terms are re-sent on its schedule. Europe PMC and Crossref also get the IDs of papers found, to check licences, open full text and retractions. ClinicalTrials.gov only accepts searches in the request address.
Not sent: your words, name, email, dates, age, or any ID. Opening a citation link takes your browser to that source; we send no referrer.
The Journal
What's stored: your words exactly as you said or typed them, the day they describe, a one-line summary, what PelvIQ picked out (a number you gave, sleep, stress, what you did, whether a flare started or ended, possible milestones) and any corrections you make. Each item is marked as something you said, PelvIQ's reading, or a possible link; anything you didn't mention is left unknown, never guessed.
No audio: when you talk, the iPhone app uses Apple's speech recognition (on the device where iOS supports it) and browsers use their own speech service. PelvIQ never receives or keeps a recording, only the words you see in the box.
How AI reads entries: with AI processing on, each spoken or typed entry is sent to Anthropic once, with the date you wrote it and nothing else from your record, to write the summary and reading. The red-flag screen runs first, in code. You check the result before it's saved, and a milestone only reaches My Story if you tap “Add to your timeline”. Quick numbers and the flare log use no AI. Ask's replies include a short, fixed-size summary of your last 90 days (daily numbers, flare episodes, your latest 10 entries). Trends and the recovery numbers on Home are computed in code, never by AI, and unlogged days are never counted as good days.
Deleting: each entry has Delete on its page; Erase my story and Delete my account remove all of them, and your export includes them.
How long it stays
| Where | What | How long | When you delete |
|---|---|---|---|
| Your browser | A login session cookie. A small cookie with your timezone's name (e.g. "America/Chicago"), so the Journal's "today" is yours. An unsent story draft (only while you're writing it). | Session cookie: renewed while you use the app, ending after 30 days unused (90 at most); httpOnly (page scripts can't read it). Settings can sign you out everywhere. Story draft: sessionStorage, gone when the tab closes. | Signing out removes the session cookie and clears story drafts. Chat messages are not stored in the browser. |
| Treatment map without an account (/try-map) | The text you pasted or dictated and what PelvIQ's AI read from it (sent to Anthropic like any story). A random key in an httpOnly cookie is the only way to open it. For the daily limits: a keyed hash of your IP that changes every day, and the run's cost. Never the IP itself. | 24 hours, then deleted (by the daily job and whenever a new map is made). The limit records are deleted after 2 days. | "Delete it now and start over" deletes it at once. Saving it to an account moves it into your story and deletes the draft. |
| Our server (Vercel) | Your requests, processed in memory while they're handled. | Our application logs contain only event names, status codes, timings, token counts and error codes — never what you wrote. Vercel's platform request logs (URL paths with opaque IDs, IP address, status) are kept for the period set by our Vercel plan. | Nothing you write is kept on the server. Platform logs expire on Vercel's schedule. |
| Database & files (Supabase) | Your history, story, answers, conversations, AI-generated content (labeled), uploaded documents, consent log, activity log, AI cost records. Your email and password hash (Supabase Auth). | Until you delete it. | Deletion is immediate in the live database and file storage (Settings → Delete). Supabase backups may still contain deleted data until they expire at the end of our plan's backup window. Supabase keeps its own platform and sign-in logs (which include IP addresses) for a limited period. |
| Journal | Your entries in your own words, the day each is about, PelvIQ's one-line summary and structured reading (labelled "you said" or "PelvIQ's read"), and your corrections, kept separately. Never audio: speech becomes text on your device or in your browser's or Apple's speech service, and only the words are sent. | Until you delete them. Check-ins from before the Journal were copied into it; the old check-in table is kept read-only for one release, then removed. | Delete an entry from its page. Erase my story and Delete my account remove every entry. Exports include them. |
| Claude API (Anthropic) | Only when you use an AI feature with AI processing turned on: the text you wrote for that feature and the parts of your structured history it needs. | Governed by Anthropic's commercial terms and data-retention policy at the time of use. We have not yet confirmed the exact retention period for our account or whether zero-data-retention applies — this is an open item before public launch. | Deleting data in PelvIQ does not delete copies Anthropic may hold under its terms. Turning AI processing off stops all new sends immediately. |
| WHOOP (only if you connect it) | PelvIQ asks WHOOP for read-only daily summaries (sleep, recovery, HRV, resting heart rate, strain, steps). Nothing from PelvIQ is sent to WHOOP. Access tokens are stored encrypted and never leave our server. | Daily summaries stay in PelvIQ until you delete them. WHOOP's own data is governed by WHOOP's terms. | Disconnecting revokes PelvIQ's access at WHOOP and deletes the tokens; you can also delete the WHOOP days (Settings → Connected devices). |
| Apple Health (only if you import) | Your export file is read in your browser, on your device. Only per-day sleep, resting heart rate, HRV and steps — shown to you first — are sent to PelvIQ. | Until you delete them. The export file itself never leaves your device. | Settings → Connected devices → Delete imported Apple Health data. |
| PubMed (US National Library of Medicine) | Only when you run a literature search with literature searches turned on: short, generic medical search terms. Never your words, name, dates, age or any ID. | Under NCBI's own policies (like any website request). | Search terms are not linked to your account at NCBI. |
Who processes your data
- Vercel — hosts the PelvIQ app and runs our server code.
- Supabase — database, login (Auth), file storage, and account emails (address confirmation and sign-in links).
- Anthropic — the Claude API, only for AI features you use with AI processing on.
- Research sources — NCBI PubMed, Europe PMC (EMBL-EBI), ClinicalTrials.gov and Crossref receive de-identified search terms or paper IDs only, when you run a literature search.
- WHOOP — only if you connect it: PelvIQ reads your daily summaries; nothing is sent to WHOOP. Device data is never sent to the AI.
- Stripe — only if you buy credits or leave a tip: the amount and an opaque account number. The card details and email you type go to Stripe's checkout page, not to PelvIQ. Never any health information.
- Resend — only if you turn on email reminders: your email address and a generic message (a generic message (“something is waiting for you”), never health details.ldquo;Something new in your notebooka generic message (“something is waiting for you”), never health details.rdquo;), never health details.
- The PelvIQ team — only if you flag an AI answer for review: that answer and, if you choose to include it, the context around it, so it can be checked.
No analytics, advertising, session replay or tracking services. We don't sell your data, and it goes to no one beyond the services listed on this page.
Your controls
- Turn AI processing or literature searches off at any time (Settings → Privacy). Turning AI off cancels unfinished AI jobs, and you can delete AI-generated content.
- Every consent change is recorded as a new entry; nothing is overwritten.
- Download everything as one JSON file (Settings → Your data). Once downloaded, that file is on your device and outside our control.
- Delete a document, a conversation, your whole case, or your account. Account deletion asks for your password.
- See what each AI action cost and a log of security-relevant actions (downloads, deletions, consent changes).
Worth knowing
- Data is encrypted in transit (TLS). Encryption at rest is provided by Supabase's infrastructure; we don't add extra field-level encryption.
- The Community is opt-in and separate from your notebook. Posts, replies and doctor referrals you write there are readable by other signed-in members under your community name. Nothing from your private records goes into it unless you choose to share a treatment result (one tap when you record it, or automatic sharing, which is off by default and needs your recorded consent). A shared result carries structured facts only (the Community list name, whether it helped, a duration range, whether it was a fair trial, and who guided it and your floor tone if known), never your words, dates, doses, clinicians' names or documents, and it appears after a random 1 to 3 days. The link back to your record stays private to you. Reports you make are visible only to you. You can delete what you post at any time; it's included in your export and deleted with your account.
- If you choose to be counted in “You're not the only one”, only the symptoms you tick from a fixed list are stored, visible to you alone. Other members see totals only, and only once at least 5 people share a symptom. Untick to stop being counted.
- AI-generated content is always labeled and can be wrong. Nothing an AI suggests enters your history until you confirm it — including anything from chat.
- Deleting a case keeps your account, consent log, activity log and AI cost records (which contain no health content). Deleting your account removes those too.
- PelvIQ is for adults (18+), is not a medical service, and is not for emergencies.