Privacy Policy

ByoMap Health (“ByoMap,” “we,” “us,” or “our”) operates the website byomap.com and associated services. This Privacy Policy explains how we collect, use, store, and protect your personal and health information.

By using ByoMap, you agree to this policy. If you disagree, please do not use our services.

1. Information We Collect

Account Information

• •Email address (for authentication and communication)
• •Password (hashed with bcrypt, never stored in plaintext)
• •Date of birth, gender, ethnicity (for personalized health ranges)
• •Timezone and display preferences

Health Data (User-Provided)

• •Blood biomarker results (uploaded via CSV, PDF, or manual entry)
• •DNA analysis results (from Nutrigenomix, 23andMe, AncestryDNA, SelfDecode)
• •Gut microbiome test results (from Gut Function.io, BugSpeaks, Viome, Sun Genomics)
• •Supplement and medication information
• •Apple Health data (if imported)

Important: All health data is self-uploaded by you. We do not pull data from medical providers, hospitals, or labs without your explicit action. You decide what data enters ByoMap.

Automatically Collected

• •IP address and approximate location (for rate limiting and security)
• •Browser type, device type, operating system
• •Pages visited, features used, session duration (via PostHog product analytics — identified by your account email when you are signed in; session recording is disabled)
• •Website analytics and advertising measurement (via Google Analytics 4 and Google Ads cookies — see Cookies & Tracking below)
• •Error reports and performance data (via Sentry, hosted in the EU/Germany; may include a replay of the page state when an error occurs)

2. How We Use Your Information

• •Provide personalized health scores, ranges, and recommendations based on your data
• •Power the AI Chat feature — your health data is sent to Anthropic Claude for analysis on each query
• •Calculate clinical scores (HOMA-IR, FIB-4, etc.) and biological age estimates
• •Send transactional emails (verification, password reset, billing receipts)
• •Improve the product through anonymous usage analytics
• •Detect and prevent fraud, abuse, and security threats

3. AI Processing

When you use the AI Chat feature, your biomarker data, DNA results, gut microbiome data, and supplement information are sent to Anthropic's Claude API for analysis. This is necessary to provide personalized, context-aware responses. Anthropic processes this data in the United States.

Anthropic does not use API inputs to train their models (per their API data usage policy). Your health data is processed to answer your query and is subject to Anthropic's API retention terms.

Guest Preview (“/try”)

If you use our no-signup preview at /try, the report you upload is sent to Anthropic's API (United States) to extract your biomarker results. We do not store your report or the extracted results on our servers — the parsed results live only in your own browser storage (for up to 7 days) and everything else is discarded after your preview. Per Anthropic's API data usage policy, API inputs are not used to train their models. Do not use the guest preview if you do not want your report processed this way.

4. Data Storage & Security

• •Database: Neon PostgreSQL, hosted in Singapore (ap-southeast-1) with AES-256 encryption at rest
• •Application: Hosted on Vercel's edge network with TLS 1.3 encryption in transit
• •Passwords: Hashed with bcrypt (12 salt rounds), never stored or logged in plaintext
• •Backups: Automated, encrypted database backups
• •Access: Role-based access controls, admin health data access requires justification and is audit-logged

5. Data Sharing

We share your information only with the following sub-processors:

• •Anthropic (United States) — AI processing of health data you choose to analyze (per-query via their API; API inputs are not used for model training per their data usage policy)
• •Neon (Singapore) — PostgreSQL database hosting, where your account and health data are stored
• •Vercel (global edge network) — application hosting and content delivery
• •Google (United States / global) — sign-in with Google (OAuth), Google Analytics 4 website analytics, and Google Ads conversion measurement (see Cookies & Tracking below)
• •PostHog (United States) — product analytics (pages visited, features used; identified by your account email; session recording disabled; health values are not intentionally collected)
• •Sentry (European Union / Germany) — error tracking and performance monitoring (may include error-time page replays)
• •Resend (United States) — transactional and product email delivery (email address only)
• •Razorpay / Stripe — payment processing, if and when paid plans are enabled (billing info only, no health data)

We never sell your data to advertisers, data brokers, or any third party. We never use your health data for advertising purposes.

6. Cookies & Tracking

• •Essential cookies: NextAuth session token (authentication). Cannot be disabled.
• •Analytics & advertising cookies (Google): We use Google Analytics 4 and Google Ads (including conversion measurement) on this website. For visitors in the EU, EEA, and UK, these load in a restricted, cookieless mode until you accept analytics cookies in the consent banner (Google Consent Mode v2); declining keeps them off. Elsewhere they are enabled by default and you can opt out via the banner or your browser settings.
• •Product analytics (PostHog): Usage tracking to improve the product. For EU/EEA/UK visitors it only loads after you accept in the consent banner.
• •Theme preference: localStorage key for dark/light mode. Not a cookie, not sent to server.

We do not run third-party advertising networks or retargeting pixels on pages that display your health data. Advertising measurement is limited to aggregate signup/upload conversion events.

7. Your Rights

For All Users

• •Access all data we hold about you (Settings → Export Data)
• •Correct inaccurate personal information
• •Delete your account and all associated data permanently
• •Download your data in machine-readable format (Settings → Download my data)
• •Opt out of weekly and product emails at any time (unsubscribe link in every email, or Settings → Email preferences). Transactional emails such as verification and password reset are not affected.

GDPR (EU/EEA Users)

• •Right to erasure (“right to be forgotten”)
• •Right to data portability
• •Right to restrict processing
• •Right to object to processing
• •Right to withdraw consent at any time

CCPA (California Users)

• •Right to know what personal information we collect
• •Right to delete personal information
• •Right to opt out of sale of personal information (we don't sell data)
• •Right to non-discrimination for exercising your rights

8. Data Retention

• •Account data: Retained while your account is active
• •Health data: Retained while your account is active
• •Audit logs: Retained for 2 years for compliance
• •After deletion: Your account and all associated personal and health data in our database are deleted immediately and cannot be recovered. Records held by third-party sub-processors (for example, error-tracking logs) expire under their own retention schedules. Anonymized aggregate statistics may be retained.

9. Children

ByoMap is not intended for users under 18 years of age, and you must be 18 or older to create an account. We do not knowingly collect information from children. If you believe a child has provided us with data, contact us and we will delete it.

10. International Transfers

ByoMap processes data in several countries. Your account and health data are stored in Singapore (Neon). AI analysis is performed in the United States (Anthropic). Product analytics are processed in the United States (PostHog), error tracking in the European Union (Sentry, Germany), email delivery in the United States (Resend), and Google services (OAuth, Analytics, Ads) process data in the United States and other Google locations. Our application is served through Vercel's global edge network, so requests may be processed in the region nearest to you.

If you are located outside these regions, using ByoMap involves transferring your data to them. By using ByoMap — and, for health data, by giving the consent recorded at signup — you consent to these transfers. We ensure appropriate safeguards are in place per applicable data protection laws.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use after changes constitutes acceptance.

12. Contact

For privacy-related questions or to exercise your rights:
Email: privacy@byomap.com
Company: ByoMap Health