Privacy

This policy applies to Anistratenco websites, direct-to-user accounts, HealthOS, chat, research, projects, voice, files, billing, shared plans, and support. Anistratenco Platform, LLC, a Delaware limited liability company, is the controller that determines the purposes and means of processing for those direct services, unless a separate signed agreement identifies a different controller or processor relationship.

A payment processor, connected service, app store, model provider, or other independent service may process information under its own notice when you choose that service. A feature-specific disclosure shown at collection supplements this policy and controls if it gives you a more specific choice.

We receive information directly from you, from the device and browser you use, from people who invite you to a shared plan, from services you connect, from payment and identity providers, and from security or anti-abuse signals generated when the Service is used.

• Account, contact, age-confirmation, authentication, profile, support, and shared-plan details.
• Health context you choose to provide, including symptoms, routines, medications, biomarkers, laboratory results, family history, or genetic context.
• Prompts, conversations, projects, feedback, files, images, audio, documents, generated outputs, and tool instructions.
• Plan, invoice, transaction, gift, balance, tax, and usage records. Raw payment credentials are handled by the payment processor.
• Device, browser, session, security, quota, route, model, tool, latency, cost, consent, and fault metadata.

The consumer health data practices below are part of this Privacy Policy and explain how Health Assistant protects, processes, discloses, and deletes health information when you choose a feature that needs it.

If we introduce a separately identified regulated clinical offering, its activation will include feature-specific privacy notices and disclosures describing purpose, legal basis, clinical or professional recipients, retention, consent, and applicable rights. Unless and until you activate such an available mode, the current consumer-mode practices described in this Policy apply; product plans or prototypes do not imply that a regulated offering is active.

We process information to provide requested features, authenticate users, preserve user settings, enforce plan limits, process confirmed transactions, answer support requests, prevent abuse, maintain reliability, investigate incidents, satisfy legal duties, and establish or defend claims.

The legal basis depends on the activity and jurisdiction. It may be performance of a contract, steps you request before a contract, legitimate interests in operating and securing the Service, consent, vital interests, or a legal obligation. When we rely on legitimate interests, we assess necessity and the effect on your rights. When we rely on consent, you may withdraw it for future processing without affecting earlier lawful processing.

In the EEA and United Kingdom, health or genetic information may be special-category data and requires both an ordinary processing basis and an applicable special-category condition. A feature-specific notice will identify that condition at collection. Accepting the Terms or acknowledging this Policy is not treated as consent to every health-data practice. Where explicit consent is the applicable condition, managed processing must not begin until a separate, specific choice is recorded.

Supported health-profile fields, memory, and conversation history are sealed with AES-GCM keys created and kept by the browser. Clearing browser storage, using private browsing, changing profiles, or losing a device can remove local information; keep an encrypted local backup when continuity matters.

Synchronized files are encrypted and decrypted by trusted browsers. Managed storage receives ciphertext plus the minimum metadata needed to locate, meter, and delete it—not the plaintext file or its device-held vault key.

A file deliberately sent for analysis follows a separate path. It stays encrypted at rest but may be decrypted briefly in bounded request memory or an isolated sandbox for scanning, preview, extraction, analysis, recovery, or export. Plaintext is not written to the database or object store.

A request can be processed by model, search, speech, extraction, or tool providers. We limit transmitted content to what the selected feature needs and request no storage where the provider supports that option. Other providers process requests under their published retention and training terms; we do not describe those routes as zero-data-retention or contractually no-training.

Different rules can apply to a user-selected integration, a separately disclosed workflow, de-identified operational measurement, or feedback you voluntarily submit. Anistratenco does not currently use raw health conversations or files to train its own models. Any materially different use requires a specific disclosure and a separate affirmative choice where required.

Private health content is not exposed through ordinary staff, support, or monitoring tools. If you intentionally include information in a support message, feedback submission, or abuse report, authorized personnel can read that separate submission to respond to it.

We use categories of providers for hosting, storage, model inference, search, speech, document extraction, payments, email, authentication, security, analytics, observability, and support. They receive only information reasonably necessary for their assigned purpose and are subject to contractual or equivalent restrictions appropriate to their role.

Source cards may request a site icon through an Anistratenco same-origin favicon route. For source domains without a prepared local icon, that route sends a fixed favicon lookup containing the normalized source hostname to Google's favicon service as a universal fallback. The only source-specific URL information in that lookup is that normalized hostname; the original page path and query, browser credentials, and chat content are not forwarded. For the restricted trusted-source set, it may then try conventional favicon paths on the source origin.

We may also disclose information to professional advisers; to a shared-plan owner only for billing, seats, and plan administration; to a recipient you choose; to authorities or other parties when reasonably necessary for law, safety, fraud, or security; and in a financing, merger, reorganization, or asset transfer subject to applicable notice and safeguards. Shared-plan membership does not authorize access to another member’s private content.

We do not sell personal information or share raw health content for targeted or cross-context behavioral advertising. If a future practice would create a right to opt out of sale, sharing, targeted advertising, or qualifying profiling, we will provide the required notice and control before or when that practice begins.

HealthOS answers, plan admission, routing, quotas, and abuse controls use automated processing. They are not intended to make decisions that produce legal or similarly significant effects about employment, credit, housing, insurance, education, eligibility, or medical care. Do not use HealthOS as the sole basis for such a decision about another person.

Information may be processed in countries other than the one where you live. Where law requires a transfer mechanism, we use an approved mechanism, contractual protections, and supplementary measures appropriate to the information and route. No transfer mechanism eliminates every jurisdictional, provider, or government-access risk.

Operational telemetry does not create analytics cookies, persist telemetry state in localStorage, sessionStorage, or IndexedDB, or assign a persistent telemetry identity. Native error-replay cleanup may remove an existing session-storage key. Essential authentication and security cookies remain separate and are never repurposed for analytics. Browser events use a credential-free request to a first-party same-origin endpoint; the browser does not send telemetry directly to Grafana or PostHog.

User-interface friction counters are limited to explicitly registered controls. Short-lived in-memory counters can identify a dead click, repeated attempt, slow action, validation-code count, empty result, or abandonment. These counters do not record text or field values, enable blanket analytics autocapture, or build heatmaps.

Error diagnostics can automatically buffer a redacted structural view of page elements and interaction coordinates in the current browser document. An eligible browser error triggers forwarding of the preceding activity and subsequent bounded recording to Sentry in the EU; healthy sessions are not routinely uploaded. Text, field values, arbitrary DOM attributes, styling, media, console output, network contents, and original URLs are removed independently in the browser and at our first-party relay. Error replay creates no cookie or browser storage. Reload and account changes start a separate recording, and the native SDK limits session length and processing of large interface changes. Already sent diagnostics remain subject to Sentry retention. This diagnostic is separate from authentication cookies and aggregate page measurement.

Anonymous aggregate measurement of pages, page views, referrers, and Core Web Vitals performance data, runs through our hosting platform's first-party, same-origin intake. It sets no cookie, uses no local or session storage, assigns no cross-page visitor identity, and discards its visitor session within 24 hours. Query strings and fragments are removed before any measurement is reported, so a gift token, attachment handle, or sign-in challenge is never recorded. No other interaction signal is sent to a remote analytics provider unless the route's purpose, terms, destination, retention, and legal basis have been approved.

• Operational telemetry records exclude raw URLs, query strings, referrers, DOM text, prompts, messages, filenames, profiles, memory, audio, uploads, provider payloads, tokens, email addresses, IP addresses, exact user agents, and raw exception messages.
• Allowed records use static route, surface, action, and control identifiers with bounded outcome, severity, duration, error-class, release, deployment, request, trace, span, and anonymous aggregate fields.

Retention follows the artifact’s purpose and control class, not one period for everything. Browser-local content remains until you delete it, clear the browser, or use a local wipe. Managed attachments follow their workflow expiry or deletion state. Provider requests follow the approved route and provider deletion cycle. Account, authentication, support, billing, tax, security, and audit records remain only for the period or criteria reasonably required for their stated purpose.

Anonymous guest access is not part of the current plan set. Anonymous daily-message evidence already recorded is retained for 48 hours after its UTC day, and anonymous identities expire after 14 inactive days. Where a signed claim followed sign-in, that day’s dispatched guest message units transferred into the usage ledger for quota continuity and audit, the browser identity was marked claimed for that UTC day, and no account ID was stored on the anonymous identity record.

The telemetry configuration targets seven days for development metadata, three days for preview metadata, fourteen days for production logs and traces, thirty days for grouped errors, and thirteen months for anonymous aggregate metrics. Full-fidelity development traces remain local for no more than twenty-four hours. These are operating targets. When authenticated readback is unavailable, we do not claim that provider-managed deletion matches them.

Deletion can be delayed by secure backup rotation, fraud prevention, payment and tax rules, active disputes, legal holds, safety investigations, or technical isolation. Backups are not restored for ordinary use after deletion and age out through their protected cycle. De-identified information that can no longer reasonably identify you may be retained for statistics, reliability, and security.

Depending on your location, you may request access, correction, deletion, restriction, objection, consent withdrawal, or portability; opt out of covered sale, sharing, targeted advertising, or profiling; appeal an eligible denial; and complain to a competent authority. We do not unlawfully discriminate against a person for exercising a privacy right.

Signed-in users can use account privacy controls for supported access, export, correction, and deletion workflows. On a trusted browser, the account export also downloads and locally decrypts synchronized files. You may also email hello@anistratenco.com. We may verify identity, account ownership, jurisdiction, and an authorized agent’s authority. We respond within the period required by applicable law and explain any permitted refusal, extension, or appeal route. An account export cannot recover information that remains solely in another browser or raw payment credentials held by the payment processor.

You must be at least 13, or the higher minimum age required in your country to consent to the Service. A person under 18 must have permission from a parent or legal guardian, who should review the Service terms and relevant notices and supervise use. The Service is not directed to a child who cannot lawfully consent, and it must not be used to evade parental-consent requirements.

Contact us if you believe a child submitted information without valid authorization. We may verify the report, restrict the account, delete information where required, and preserve only what law, safety, or a documented investigation permits.

We use safeguards designed for the information and Service, including minimization, encrypted boundaries, scoped authorization, authentication controls, route evidence, monitoring, retention jobs, and recovery procedures. No internet service, provider, browser, device, or encryption method is guaranteed secure.

We assess suspected unauthorized access, acquisition, use, or disclosure under applicable privacy, consumer-health, payment, contractual, and breach-notification rules. When notification is legally required, we will notify affected people, regulators, service providers, or other parties in the required manner and timeframe. Contract wording does not remove that duty.

We may update this policy as the Service, providers, law, or data practices change. A new version will show a new effective date, and material changes receive additional notice or consent where required. A revision does not waive a mandatory right or retroactively authorize a materially different use without a lawful basis.

The controller is Anistratenco Platform, LLC, a Delaware limited liability company, with its registered address at 131 Continental Dr, Suite 305, Newark, DE 19713, United States. That address is the entity’s registered address, not an operating location. Where the Service is offered in a jurisdiction that requires an EEA or UK representative or a data-protection contact, those particulars are displayed before the Service is offered there. Anistratenco does not treat a product or trading name alone as a substitute for legally required controller identification.

Send privacy questions, rights requests, or complaints to hello@anistratenco.com. Include the account email and enough context to identify the relevant system, but do not send unnecessary health information, passwords, payment credentials, recovery codes, or API keys. You may also complain directly to a competent privacy or consumer-protection authority where that right applies.