Legal

Privacy Policy

Last updated: October 31, 2026 · Version 1.1

1. Introduction

92health ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our platform.

By creating an account, you consent to the practices described in this policy. You may withdraw your consent at any time by deleting your account.

2. Data We Collect

Account Information

Name, email address, password (hashed), profile picture, and location (city, state, country) if provided.

Health & Fitness Data (Voluntary)

Activities (runs, workouts), body measurements (height, weight, waist, hip, neck), biomarker lab reports, health conditions, diet entries, and training plans. All health data is provided voluntarily and is not required to use the platform.

Integration Data

If you connect third-party services (Strava, Garmin, Fitbit), we sync activity data from those platforms. OAuth tokens are encrypted at rest using AES-256-GCM.

WhatsApp Messages

Clinics, hospitals, pharmacies and labs that use 92health can message their patients on WhatsApp, from their own WhatsApp number, through Meta's WhatsApp Business Platform. These messages include appointment reminders. When a clinic does this, we store the patient's phone number, the messages sent and received on the clinic's number, their delivery status, and any answer the patient gives (such as Confirm or Can't come), so that the clinic's staff can read and reply to them in 92health.

We use these messages only to provide this service to the clinic. We do not sell them or use them for advertising. A patient can turn off WhatsApp reminders in Settings, or ask their clinic to stop them.

Usage Data

Error logs and performance metrics via Sentry for debugging and reliability purposes.

3. How We Use Your Data

  • To provide the 92health service: tracking activities, displaying stats, social features
  • To power AI features (goal coaching, diet analysis, biomarker insights) using Google Vertex AI — you can opt out of AI processing in Settings
  • To send email notifications you have opted into (race results, account alerts)
  • To improve platform reliability and fix bugs

4. AI & LLM Data Processing

92health uses AI (Google Vertex AI / Gemini) for features like goal coaching, food photo analysis, training plan generation, and biomarker report parsing. When these features are used:

  • Your relevant data is sent to the AI provider for processing
  • A PII-stripping layer removes emails, phone numbers, and names before sending data to the AI
  • AI responses are not stored by the AI provider beyond the request lifecycle
  • You can disable AI data processing in Settings > Privacy & Safety at any time

5. Data Sharing

We do not sell your personal data. We share data only with:

  • AI providers (Google Vertex AI) — for AI features, with PII stripped
  • Email service (SMTP) — for transactional emails only
  • Meta (WhatsApp Business Platform) — to deliver a clinic's WhatsApp messages to its patients
  • Error tracking (Sentry) — anonymized error reports
  • Other members — only your public profile information (name, profile picture, activities) based on your privacy settings

6. Data Security

  • Passwords are hashed with bcrypt (10 rounds)
  • OAuth tokens and sensitive secrets are encrypted with AES-256-GCM
  • Optional two-factor authentication (TOTP)
  • HTTPS enforced in production
  • Rate limiting on authentication endpoints

7. Your Rights

You have the right to:

  • Access your data — download all your data in JSON format via Settings
  • Delete your account — permanently remove all your data via Settings
  • Export your data — portable format for transfer to another service
  • Opt out of AI processing — disable AI features while keeping your account
  • Control visibility — set your profile to private/locked, hide email
  • Withdraw consent — delete your account at any time

8. Data Retention

We retain your data for as long as your account is active. When you delete your account, all personal data is permanently removed from our databases immediately. Anonymized aggregate statistics may be retained.

9. Breach Notification

In the event of a data breach affecting your personal information, we will notify you via email within 60 days (as required by the FTC Health Breach Notification Rule) and within 72 hours where required by applicable law (India DPDPA 2023).

10. Children's Privacy

92health is not intended for users under 16 years of age. We do not knowingly collect data from children.

11. International Users

United States

We comply with the FTC Health Breach Notification Rule and applicable state laws including CCPA (California) and MHMDA (Washington).

India

We comply with the Digital Personal Data Protection Act 2023 (DPDPA). You may contact our Grievance Officer for any data protection concerns.

12. Contact & Grievance Officer

For privacy concerns, data requests, or complaints:

Email: [email protected]
Grievance Officer (India DPDPA): [email protected]

13. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use after changes constitutes acceptance.