Privacy Policy

We collect information that you provide directly to us and information gathered automatically through your use of the Service. The categories of data we process include:

• Account information. When you create an account we collect your name, email address, and a password (stored as a one-way hash). This is used to identify you, communicate with you, and secure your account.
• Research history. The questions you ask, the answer modes you select, your saved research, workspaces, notes, reports, and collections are associated with your account so you can revisit and manage them.
• Preferences. Explanation style, research preferences, onboarding interests, and display settings that personalize your experience.
• Optional context. You may optionally share general context such as age range or health goals. HealthSageAI does not require personal medical records and you are never obligated to provide them.
• Usage and technical data. Device type, browser, approximate location (country/region), and interaction logs used for security, reliability, and product improvement.
• Billing information. If you purchase a subscription we process payment through our payment provider. We do not store full card numbers on our servers.

We use the data we collect to:

• Provide, maintain, and improve the Service and its features.
• Generate AI-assisted answers, summaries, and research briefs in response to your questions.
• Retrieve and present source citations and evidence context alongside responses.
• Save your research history, workspaces, notes, and collections so you can return to them.
• Authenticate you, secure your account, and prevent fraud or abuse.
• Process subscription payments and manage your membership.
• Send service-related communications such as receipts, security notices, and support replies.
• Analyze aggregated, de-identified usage patterns to improve product quality.
• Comply with legal obligations and enforce our Terms of Use.

Your data is stored in a managed PostgreSQL database hosted on Supabase. Access to data is governed by row-level security (RLS), which ensures that your research history, workspaces, notes, saved items, and preferences are scoped to your account and cannot be read or modified by other users. Sensitive operations such as privileged mutations are handled through server-side functions with restricted execution permissions.

We use encryption in transit (TLS) and at rest. Payment processing is handled by our payment provider, which maintains its own PCI-DSS compliance; we do not store full card numbers. Despite these safeguards, no system can be guaranteed perfectly secure. You share information at your own risk.

User-scoped data is protected by database-level row-level security policies. This means the database itself enforces that only the account owner can read or write their own research, workspaces, saved items, and personal preferences. Even if an application-level bug were to issue an unintended query, the database policy prevents cross-user access.

HealthSageAI does not sell, rent, or share your personal data with third parties for their advertising or marketing purposes. We do not monetize your health questions or research history by selling it to data brokers, insurers, or pharmaceutical companies.

We share data only with service providers who process data on our behalf to operate the Service (for example, our database host, payment provider, and AI model provider), and only as necessary to provide the features you use. These providers are bound by contractual obligations to protect your data and to use it only for the purposes we specify.

You have the right to access, export, correct, and delete your personal data. Specifically:

• Export. You can export your research history, notes, and saved items from your account settings at any time.
• Deletion. You can delete your account from settings, which removes your personal data from the Service. Certain records may be retained in de-identified or aggregated form or as required by law.
• Correction. You can update your profile information and preferences at any time.
• Opt-out of communications. You can unsubscribe from non-essential emails using the link in each message or from your settings.

To exercise any of these rights or to submit a data request, contact us at privacy@healthsageai.com. Depending on your jurisdiction, additional rights may apply under applicable data protection laws.

We use cookies and similar technologies to maintain your session, remember preferences, and understand how the Service is used. Essential cookies are required for the Service to function and cannot be disabled. Analytics and preference cookies are optional. You can manage cookies through your browser settings. For more detail, see our Cookie Policy.

When you ask a question, your prompt and relevant context are sent to our AI model provider to generate a response. The provider processes this data to return an answer and may retain inputs and outputs according to its own policies for a limited period. We do not knowingly send sensitive personal health records to AI providers. We select providers that offer data-processing agreements and limit retention where available.

AI-generated content may be inaccurate. You should not rely on it for medical decisions. See our AI Disclosure and Medical Disclaimer for important limitations.

HealthSageAI is not directed to children under the age of 13 (or the minimum age required by applicable law in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at privacy@healthsageai.com and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will provide a more prominent notice such as an in-app banner or email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.