Privacy Policy

1. The short version

Your Vault (your stack, dosing, daily check-ins, symptoms, goals, experiments, decoded labs, saved protocols, and your questions to our assistant) is encrypted at rest under a key envelope-wrapped per member. We do not sell your personal information, we do not show it to advertisers, and we do not use it to train third-party AI models. If you choose to connect an AI assistant to your account, what you allow it to read goes to the company that operates that assistant and is then governed by their policy, not ours — Section 9 sets out exactly what can and cannot be sent, and how to disconnect. You can export or permanently delete your account and Vault at any time from Settings. Anything that contributes to our aggregate community or measured-outcomes data is strictly opt-in and de-identified.

2. Who we are (data controller)

The controller responsible for your personal information is SelfAssay. You can reach us at hi@selfassay.com.

3. Information we collect

Information you provide

• Account data: your email address and authentication credentials; if you sign in with a third-party provider (e.g. Google), basic profile information they share with us.
• Vault content: the personal log you choose to add: the compounds in your stack and their dose, schedule, and timing; daily check-ins (energy, focus, mood, sleep); free-text symptoms, notes, goals, and decisions; medications you record; reconstitution calculations; saved and composed protocols; n-of-1 experiments and their outcomes; and your questions to our assistant.
• Optional profile/demographic data: if you provide it (e.g. age band, sex), used to personalize relevant context. You are not required to provide it.
• Lab reports (Decoder): when you upload a lab/blood report for decoding, the file is processed in memory for that session and is not stored; the structured marker values are saved to your Vault only if and when you choose to save the result.
• Communications: messages you send us (e.g. via our contact form or by email) and your support history.

Information collected automatically

• Device & log data: IP address, browser/device type, timestamps, and request metadata, used for security, abuse prevention, rate-limiting, and debugging.
• Product analytics:first-party usage signals linked to your account — which features you use and how often, quota/limit events, and the compute cost your requests incur. These record actions and counts only; they never include the contents of your encrypted Vault. We use them to operate, secure, and improve the product, and may view them at an individual-account level for support, abuse prevention, and product decisions.
• Feature inputs (operational logs): when you run a Formulary build, the goal text you enter is logged for reliability and product analytics. This log is not linked to your account identifier and we surface goals internally only when several members enter the same phrasing; still, avoid putting information you consider sensitive in free-text goals.
• Connected-assistant records:if you connect an AI assistant to your account, we record the connection, the permissions you granted, the assistant it was granted to, when you approved it, the version of the wording you were shown, a one-way hash of the IP address the approval came from, and the browser user-agent string it came with — so that both of us can tell later what you agreed to. We also record each call that connection makes as a tool name, a time and an outcome, never its content.
• Cookies & local storage: see Section 13.

Payment information

Subscription payments are processed by our payment processor, Dodo Payments, under their own terms and privacy policy. We do not receive or store your full card number; we receive subscription status and limited transaction metadata needed to provide and manage your plan.

4. How and why we use your information

We use personal information to:

• provide, maintain, and secure the Service and your account;
• generate the features you request: grades, dossiers, interaction checks, protocol composition, lab decoding, n-of-1 verdicts, and answers from our assistant;
• personalize relevant context to your own stack and entries;
• process payments and administer subscriptions;
• communicate with you about the Service and respond to support requests;
• prevent fraud and abuse, enforce our Terms, and comply with law;
• with your opt-in consent, contribute de-identified data to our aggregate community and measured-outcomes datasets (Section 7).

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you sign up for); our legitimate interests (to secure, improve, and protect the Service, balanced against your rights); your consent (for processing health/sensitive data, optional cohort contributions, and any non-essential cookies, which you may withdraw at any time); and compliance with legal obligations.

5. Health and other sensitive data

Some information you choose to provide (the compounds and medications you take, symptoms, goals, and lab markers) may relate to your physical or mental health or wellness. We treat this as sensitive information and apply heightened protections.

We are not a healthcare provider, and SelfAssay is not a covered entity or business associate under HIPAA. The Service is a personal-research and decision-support tool, not a medical record. See our Terms of Service for the wellness/not-medical-advice disclaimer.

Consumer health data.Where laws such as the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and similar state laws apply, certain information you provide may be “consumer health data.” We collect it only when you enter it yourself in order to use a feature you have asked for, and we use it only to provide that feature. We rely on your consent, and we ask for it separately for each use that needs it: the information you choose to enter; a specific opt-in before anything is shared into our aggregate datasets (Section 7); and a specific approval on the connection screen before anything is shared with an AI assistant you connect (Section 9). Accepting our Terms, or continuing to use the Service, is not how we treat any of those consents as given. We do not sell consumer health data, and we receive no payment or other consideration in exchange for disclosing it to anyone. We share it with the service providers in Section 9 to operate the Service, or with a recipient you have separately and specifically directed us to share it with. Connecting an AI assistant to your account is such a direction, and the operator of an assistant you connect is the only category of third party we share consumer health data with outside those service providers and the unlisted links you choose to publish yourself (Section 9): we ask for that direction separately from our Terms and from every other permission, before anything is shared, naming the categories of information involved, the purpose, and the application receiving them — or, for a key you create yourself, the name you give it — and you can withdraw it at any time (Section 9). You may withdraw consent and delete this data at any time (Sections 7, 11, and 12).

Where the GDPR/UK GDPR applies, we process special-category (health) data on the basis of your explicit consent, which you can withdraw at any time without affecting prior processing. Where you connect an AI assistant to your account, sharing your health data with the company operating it relies on your separate explicit consent to that sharing, given on the connection screen before anything is sent; where that company is outside the UK, the EEA or Switzerland, the transfer relies on that same explicit consent (Section 10). Withdrawing it stops all further sharing, but it does not make the sharing that already happened unlawful and it does not reach what that company already holds (Section 9).

6. How your data is stored and secured

Each Vault section is encrypted at rest with a per-member data key, which is itself wrapped under a server-managed master key (envelope encryption). Embeddings derived from your free-text entries (used for your own semantic search, e.g. “when else have I felt like this?”) are stored separately, tagged to your member id, and are not shared with other members.

How access works. SelfAssay is not a zero-knowledge service. To deliver server-side features (search, AI assistance, lab decoding, and opt-in aggregation), our systems process your Vault contents to perform the operations you request. That access is restricted, logged, and limited to what those features require and to what the law requires of us; we do not access your content for any other purpose. Where you have connected an AI assistant to your account, the permissions you granted also let that assistant read the specific categories described in Section 9; apart from the unlisted links you choose to publish yourself (Section 9), that is the only route by which anything in your Vault leaves us at your direction.

We use administrative, technical, and organizational safeguards appropriate to the risk. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We will notify affected users and regulators of a personal-data breach where required by law.

7. Opt-in community and measured-outcomes data

By default, your entries are not contributed to any shared dataset. Two separate, optional contributions exist, each off by default and each independently withdrawable:

Community signal

If you opt in, the classified content of certain entries (e.g. effects and side-effects mentioned in your notes) is routed into aggregate, de-identified community counts and patterns. We never present verbatim user text or attribute it to you. Because these contributions are de-identified on entry, aggregate rows already contributed may not be individually retrievable after opt-out.

Measured-outcomes ledger

If you opt in, when you conclude an n-of-1 experiment we add a de-identified, structured outcome (the compound, what you tracked, the result and effect size, your adherence, and how long you tracked) to an aggregate “people like you, measured” dataset. It is keyed by a salted, one-way hash rather than your account id; aggregate results are only shown above a minimum group size (k-anonymity); and we never include your name, free-text notes, or raw lab values. Turning this off purges the rows you contributed.

You can change either choice at any time in Settings.

8. AI processing

To answer your questions, decode lab reports, and optionally select emphasis for an Assay explanation, we send the specific request and minimum necessary context to our AI processors. For a scored Assay, that limited context can include compound names, the headline purpose and report count, the fixed score, and allowed fact identifiers. It excludes your identity, doses, medication history, and free-text Vault content; the processor selects identifiers only and does not calculate or write the score. A provenance gate is designed to send only the relevant request, never your entire Vault. We do not permit our AI processors to use your content to train their general models, and we do not use your Vault to train third-party models. That commitment covers the processors we engage; it cannot cover an AI assistant you connect to your account yourself, whose own policy governs what it does with what it receives (Section 9). AI outputs are generated automatically and may be incomplete or inaccurate; they are decision support, not a determination with legal or similarly significant effect, and a human (you) remains in control of all decisions.

9. How we share information

We do not sell your personal information. Apart from what you choose to publish or send yourself — an unlisted share card or protocol link, or information you direct us to send to an AI assistant you connect to your account, all described below in this section — and the limited cases at the end of this section, we share it only with service providers who process it on our behalf under contract, and only as needed to run the Service:

• Supabase: database, authentication, and storage.
• Vercel: application hosting and delivery.
• OpenRouter and Google: AI model inference and embeddings for the requests you make.
• Dodo Payments: subscription billing.
• Resend: transactional and support email.
• Sentry: error monitoring and diagnostics.

Information you choose to publish.Stack Assays are private by default. If you select “Create share card,” we create an unlisted public link containing the compound names and Assay result. It excludes your account identity, doses, source-health diagnostics, and private explanation. You can remove that public snapshot with “Make private,” and owned Assay cards are deleted with your account.

Formulary protocol links are also opt-in, unlisted public links. A protocol link contains your goal exactly as entered plus the compound names, roles, doses, and units in the shared composition. It does not include your account identity, saved client fields, or private rationale, but free text or an unusual composition may still identify you or another person. After creating a link, you can make it private while its current page session remains open. We do not currently keep a persistent in-product registry of protocol links; if you lose the link after leaving or reloading, contact SelfAssay for removal. Owned protocol links are deleted when you delete your account.

API, MCP and AI-assistant connectors

We operate a public, read-only interface (an API and an MCP endpoint) that lets AI assistants and other software look up the same summary-level compound information we publish on selfassay.com. Used without a SelfAssay credential it serves nothing else: it cannot read a Vault, a stack, a notebook, a protocol, a lab result, or any other member information, and a caller using it this way is not linked to any SelfAssay account. Connecting your own account is a separate, opt-in step described below.

When an assistant calls us this way, we receive only what it sends in the request — typically a compound, goal, or target name — and the network information that comes with any web request, such as an IP address, user agent, and timestamp. We keep two separate records of a call like that, and neither is linked to a SelfAssay account. The first is a request log, written without the arguments of the call: the time, the tool called, the outcome, how long it took, and the name of the calling application where it uses a key we issued. Our hosting provider holds that log for a limited period under their standard settings. The second is the record we keep to enforce rate limits: the caller’s address — or the name of that key — which of our interfaces was called, and the time. It holds nothing about what was asked, and it is deleted after about 25 hours. We do not receive the identity of the person the assistant is answering, we do not ask for it, and we do not attempt to work it out.

Because the public interface carries no member information, the assistant platforms that call it this way are not our sub-processors and are not listed above. Separately, you can choose to connect an assistant to your own account — that is a different thing, and it is described next.

Connecting an AI assistant to your account

You can choose to connect an AI assistant — for example one operated by another company — to your SelfAssay account. This is off unless you turn it on. Nothing is shared until you approve a specific list of permissions on a SelfAssay screen, and you can take that approval back at any time. Connecting an assistant opens to all members thirty days after we notify members by email and in the app — we will publish the date here when that notice is sent. Until then it runs as a limited preview open only to accounts we enable ourselves — our own testing accounts, and reviewers at the platforms that list us — each of which goes through the same approval screen. No other account can connect anything before that date.

This is a disclosure at your direction, not a sub-processing arrangement. The recipient is whoever operates the assistant you connect — an AI-assistant or agent provider, chosen by you. It may be a company we have never dealt with: anyone can register an application with us and choose the name it displays, and the connection screen tells you when we have not checked who operates one. That company is a separate, independent controller of the information it receives. It is not one of our service providers, it is not listed above, it does not act on our behalf or under our contract, and we do not decide what it does with the information. We disclose your information to it because you told us to.

What can be sent.Two things, and nothing else. The first is whatever the permissions you grant cover: the compounds in your stack with the dose, unit, schedule, timing, route and start date you recorded; which of a day’s doses you have already logged; research items we have matched to the compounds in your stack, on a paid plan; and the fuller compound dossiers your plan includes. Permissions are granted individually, and the screen tells you what each one covers before you approve it. The second does not depend on what you granted: any connection can ask which SelfAssay plan you are on and how much of a free allowance is left, so an assistant can tell you it has reached a plan limit instead of simply failing. That answer contains no health information and nothing from your Vault. A connected assistant can only read.It cannot add, change, or delete anything you have recorded — not your stack, not your dose log, not your notes. Opening a full dossier through a connection does count against a free plan’s dossier allowance, exactly as opening one on the website does. If we ever offer a permission that writes, it will be a new permission we ask you for separately, and we will update this Policy before it is available.

What is never sent.Your private entries never leave SelfAssay through a connected assistant: your reasons for taking something, notes, symptoms, goals, decisions, notebook, your questions to our assistant, lab results, demographic details, and any client records in a Practitioner account — that last exclusion follows where you store the information, so anything you put in your own stack, intake log, or medications is treated as your own even if it relates to a client (Section 8 of our Terms). The one place your own words do travel is the dose and schedule boxes themselves: what you typed into dose, unit, frequency, timing and route is sent back as you wrote it, shortened if it is long, so keep anything you consider private out of those boxes. The names of medications you have recorded are never sent either.If you allow your medications to be used for interaction checking, they are used inside that check and the result says only that a flag involves “a medication on file” — never which one. An assistant can be told how many of your recorded medications took part in a check and how many fell outside the drug classes it covers, never which they are.

What happens after it leaves.Once information reaches the assistant, that company’s own privacy policy governs it, including how long it keeps it and what it may use it for. We cannot control that, and we cannot recall information that has already been sent.In particular, our commitment in Section 8 that we do not permit our AI processors to use your content to train their general models binds our processors; it does not bind an assistant you connect. We do not show you that policy and cannot vouch for it: find it on that company’s own site and read it before you connect. Any request to see, correct or delete what that company holds has to be made to that company — we cannot make it for you, and deleting your SelfAssay account does not delete anything it already has.

How to disconnect.Go to Settings → Connected assistants, where each connection is listed with what you granted it, when you connected it, and when it was last used. Revoking takes effect immediately for everything that follows; it does not retrieve what was already sent. Deleting your account disconnects everything.

What we record. For each connected assistant we keep the connection itself, the permissions you granted, when you granted them, and a record of the approval you gave. For each call we keep the connection it came from, the name of the tool it used, the time, and whether it succeeded. We do not record what was asked or what was returned. This is what lets you audit your own connections. We keep these call records for 12 months and then delete them, and we delete them sooner if you delete your account. Section 11 covers the one record that outlives the rest.

We may also disclose information to comply with law or valid legal process, to enforce our Terms, to protect the rights, safety, and security of users or the public, or in connection with a merger, acquisition, or sale of assets (with notice as required by law).

10. International data transfers

We and our service providers may process your information in countries other than your own, including the United States. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. Those safeguards cover transfers to our own service providers. They do not cover an AI assistant you connect to your account: the company operating it may be anywhere, including outside the UK, the EEA and Switzerland, and we have no contract and no standard contractual clauses with it. That disclosure is made on the basis of your explicit consent to that specific sharing, given on the connection screen. It may mean your information is sent to a country whose data-protection laws give you less protection than your own, where a public authority may be able to reach it and where your rights may be harder to enforce, and we cannot get it back once it has been sent. If you would rather not accept that, do not connect an assistant.

11. Data retention

We retain your account and Vault for as long as your account is active. When you delete your account, we permanently delete your encrypted records and the derived embeddings, and purge your opt-in measured-outcomes rows, within 365 days, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements. Backups are cycled out on our normal rotation schedule. De-identified aggregate data that no longer identifies you may be retained. Connections to AI assistants, and the tokens and call records behind them, are deleted with your account; a call record is in any case deleted twelve months after the call. We keep a minimal record that you gave, or withdrew, a connection permission — the permissions, the wording version, the dates, and the one-way hash of the IP address and the browser user-agent string recorded with the approval (Section 3) — because we are required to be able to demonstrate that consent was given. When you delete your account we remove your account identifier from that record; the record itself is kept for up to six years after the decision, the period in which a claim under our Terms could still be brought.

12. Your rights and choices

From Settings you can, at any time, view and export your Vault, disconnect any AI assistant you have connected, and permanently delete your account. That export covers your Vault; your connected assistants, the permissions you gave each one and the dates are shown in Settings → Connected assistants, and you can ask us at any time for a copy of those records and of the consent receipts we hold. The rights below are rights against us: anything an assistant you connected has already received is held by the company that operates it, so a request to see, correct, or delete that has to be made to that company (Section 9). Depending on where you live, you may also have rights to:

• access, correct, or delete your personal information;
• port a copy of your data;
• object to or restrict certain processing, and withdraw consent;
• opt out of any “sale” or “sharing” of personal information and limit use of sensitive information (we do not sell or share personal information for cross-context behavioral advertising);
• not be discriminated against for exercising your rights.

EEA/UK (GDPR/UK GDPR): you have the rights above and may lodge a complaint with your supervisory authority (in the UK, the ICO). California (CCPA/CPRA):you have rights to know, delete, correct, and limit the use of sensitive personal information; we have not sold or shared personal information in the preceding 12 months. Sending information to an AI assistant you have connected is a disclosure you intentionally direct, which is not a “sale” or a “share” under that law; disconnecting the assistant is how you stop it. Washington, Nevada, and similar consumer-health-data laws: you may withdraw consent, delete consumer health data, and (where provided by law) appeal a decision. To exercise any right, contact hi@selfassay.com; we will verify and respond within the time required by applicable law. You may use an authorized agent where the law permits.

13. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember preferences, and secure the Service. We do not use third-party advertising or cross-site tracking cookies. Where required, we will request consent for any non-essential cookies and honor recognized opt-out signals (such as Global Privacy Control).

14. Children

The Service is intended for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “last updated” date. For a material change — including any change to what we share, who we share it with, or how long we keep it — we will give you at least 30 days’ notice before it takes effect, both in the app and by email to the address on your account, and the updated Policy will say when the change takes effect. A change may take effect sooner only where it is needed to comply with the law or a regulator, to address a security risk, or where it describes an optional new feature that takes nothing away from you and that you do not have to use; in those cases we will still tell you as soon as we reasonably can. That last exception never covers a change that would send your information to a new kind of recipient: a change like that always gets the full 30 days, as this one did.

16. Contact us

Questions or requests about this Policy or your data: hi@selfassay.com.