Privacy Policy

01Who we are & how to reach us

The OneLifeLog service (the "Service") is operated by [COMPANY LEGAL NAME], a [ENTITY TYPE, e.g. Delaware corporation / sole proprietorship] with its address at [REGISTERED ADDRESS] ("OneLifeLog", "we", "us"). For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described in this policy.

• Privacy contact: [PRIVACY CONTACT EMAIL, e.g. privacy@yourdomain.com]
• EU / UK representative (if we are required to appoint one under GDPR Art. 27): [EU/UK REPRESENTATIVE NAME & ADDRESS — or remove this line after legal review]
• Data protection officer: we have not appointed a DPO. [Confirm with counsel whether one is required given the scale of health-data processing (GDPR Art. 37)]

02What this policy covers

This policy covers the OneLifeLog web application, its API, its SMS assistant, and emails we send. It does not cover third-party services you reach through links from OneLifeLog, which have their own policies.

OneLifeLog is not a healthcare provider. We are not a "covered entity" or "business associate" under HIPAA, and the data you store in OneLifeLog is not an official medical record. We do not claim HIPAA compliance, SOC 2, ISO 27001, or any other certification. What we actually do to protect data is described honestly in section 14.

03The data we collect

3.1 Account data

• Email address, name, and profile picture. When you sign in with Google, we receive your email, name, and avatar from your Google account. When you register with email and password, authentication (including password storage) is handled by our own authentication system; passwords are stored only as salted bcrypt hashes — we never see or store your plaintext password.
• Google sign-in scopes. Our Google sign-in currently requests an additional Google Drive permission ("drive.file") that the Service does not presently use. We do not read your Google Drive. [This scope is slated for removal; delete this sentence once it is removed]

3.2 Health & self-tracking content you create

This is the heart of the Service, and almost all of it is health data — a "special category" of personal data under GDPR Art. 9 and "sensitive personal information" / "consumer health data" under US state laws. It includes, when you choose to provide it:

• Video and audio recordings of your log entries, and their duration and file size.
• Transcripts of those recordings, produced by AI speech-to-text.
• AI-extracted structured data: metrics (e.g. weight, sleep, HRV), experiments and protocols (which can include medications, hormones, peptides, and supplements with doses and schedules), diet entries, habits, and tags.
• Mental-health screener responses: your answers and scores on the GAD-7 (anxiety) and PHQ-9 (depression) questionnaires, and mood entries. These are screening tools, not diagnoses.
• Menstrual cycle data: period dates, cycle length, symptoms, and your cycle-tracking profile, if you enable cycle tracking. We also store a gender field if you choose to set one.
• Bloodwork and lab values you enter or that AI extracts from lab documents you upload.
• Progress photos and any weight or notes attached to them, and food photos attached to diet entries.
• Documents you upload to your drive (e.g. lab PDFs, insurance paperwork), including text and summaries the AI extracts from documents you individually opt in to AI processing.
• Free-form context you write: your bio, goals, recording script, and notes — used to personalize the AI.
• Conversations with AI features: the AI coach, the AI workspace, the live recording interviewer, and the SMS assistant thread.

You are never required to provide any specific category above; each exists only if you choose to log it.

3.3 Phone number & SMS (optional)

If you enable the SMS assistant, we collect your phone number, a verification code exchange, your check-in schedule and time zone, and the content of SMS messages between you and the Service (both directions are stored so the assistant has memory and we can audit costs).

3.4 Payments

Paid subscriptions are processed by Stripe. Stripe collects your payment card details directly — card numbers never touch our servers. We store your Stripe customer ID, subscription plan and status, and billing events. Your email is shared with Stripe to create your customer record.

3.5 Technical & usage data

• Authentication cookies (see section 13) and session state.
• AI usage records: which AI feature ran, the model, token counts, and estimated cost — kept to enforce fair usage budgets and track our costs. These records do not contain your content.
• Diagnostic logs: errors and operational events, which can include your user ID, request IDs, and error details.
• Storage usage: how many bytes your media uses.
• Server logs at our hosting provider (Vercel), which — like virtually all web hosting — record IP addresses and request metadata at the infrastructure level. We do not build profiles from them.

3.6 Optional weather location

If you set a weather location for your dashboard, you type a city name and we store the city and its coordinates. Our server asks the Open-Meteo weather service for the forecast at those coordinates. We do not use GPS and never collect precise device location.

3.7 Referral attribution

If you arrive via a referral link, a first-party cookie stores the referral code for 30 days so the referrer can be credited if you sign up.

3.8 What we do not collect

• No third-party advertising trackers or ad-tech SDKs.
• No third-party analytics (no Google Analytics, no session recording, no fingerprinting).
• No precise geolocation, contacts, or background sensor data.
• No biometric identification: recordings are transcribed for their words, not used to identify you by voice or face.

04Why we process your data & our legal bases

Under GDPR we need a legal basis for each purpose. For health data we rely on your explicit consent (GDPR Art. 9(2)(a)): the Service's entire purpose is processing the health information you deliberately record in it, and you can withdraw that consent at any time by deleting content or your account (see sections 10–11). Withdrawal does not affect processing that happened before it.

We do not use your data for advertising, and we do not sell it — see section 12.

05How AI is used (AI transparency)

OneLifeLog is AI-assisted by design, and we want you to understand exactly what that means. This section is written with the transparency aims of the EU AI Act in mind.

5.1 What the AI does

• Transcribes your audio/video recordings to text.
• Extracts structure from transcripts and text: suggested metrics, experiments/protocols, diet entries, habits, categories, and possible transcription errors of medical terms.
• Analyzes images and documents you submit for that purpose: estimating macros from food photos, and reading values out of lab/bloodwork documents.
• Summarizes and coaches: weekly insights, review suggestions, the AI coach, the AI workspace, the live recording interviewer, and the SMS assistant.
• Speaks: interviewer questions can be converted to audio (text-to-speech).

5.2 Who runs the models

AI runs on third-party model providers acting as our processors: OpenAI (chat models, Whisper speech-to-text, vision, text-to-speech) and xAI (Grok chat models, speech-to-text, and text-to-speech — depending on configuration, xAI may be the default transcription provider). When an AI feature runs, the relevant content — a recording's audio, a transcript, a photo, a document, or your question and its surrounding context — is sent to the provider to generate the result, then the result is stored in your account. We use these providers' API services; under the provider terms applicable to API usage, this content is not used to train their models. [Counsel: confirm current OpenAI and xAI API data-usage terms and execute DPAs before publishing]

5.3 You review the AI's work

AI-extracted suggestions (metrics, experiments, diet entries) go through confirm/ignore review flows before they become confirmed records, and you can edit or delete AI-derived entries. Suggestions you ignore are remembered so they are not re-suggested.

5.4 Limitations — read this part

• AI output can be wrong. Transcription mishears things (especially drug and supplement names — the Service flags likely mishearings, but not all of them), extraction mis-estimates values, and generated text can be confidently incorrect.
• Nothing the AI produces is medical advice, a diagnosis, or a treatment recommendation — including GAD-7/PHQ-9 scores, which are screening tools only. See the medical disclaimer in our Terms.
• No automated decision-making with legal or similarly significant effects is performed on you (GDPR Art. 22). The AI organizes and summarizes your own journal; it does not decide anything about your access to services, pricing, or rights.
• We do not use AI for emotion recognition or biometric categorization of your recordings.

06Service providers who process your data

We use a small set of infrastructure providers (processors / service providers) to run OneLifeLog. Each receives only what its job requires:

We require processors to protect your data and use it only on our instructions. [Data-processing agreements with each provider must be executed/verified before launch — see report to counsel]

We may also disclose data if required by law, to protect the rights and safety of users or others, or as part of a merger, acquisition, or sale of assets — in which case this policy would continue to apply to your data and we would notify you of any successor.

07When your data is shared with other people

By default, nothing you record is visible to anyone but you. Sharing exists only through features you deliberately use:

• Friends (buddies). Adding a friend is mutual: you add them by email, and metric sharing only works between accounts that have each other. You choose which metrics are shared. Shared metrics expose their values and trends only — never your recordings, transcripts, notes, or the log context behind a value, and a metric you have not shared is indistinguishable from one you do not track.
• Coaches. A coaching connection starts with an invitation that must be accepted. Coaches can see only the metrics permitted for them — never your logs, recordings, transcripts, or AI summaries of them. Per-metric permissions can be changed or revoked at any time. [Depending on the administrator's configuration, metric visibility for a newly connected coach may default to on; confirm the default-off setting before launch] Messages you exchange with a coach are visible to that coach.
• Social share drafts. You can ask the AI to draft a share-worthy text summary of your week. Nothing is posted anywhere by us — you copy it and decide where it goes.
• Administrators. A small number of service administrators can access operational data (account list, diagnostic logs, AI usage and cost records) to run and support the Service, and can delete accounts. Administrative access is restricted to designated admin accounts.

We never share your data with advertisers or data brokers.

08Where data lives & international transfers

OneLifeLog is operated from the United States, and our providers store and process data primarily in the United States (our database is hosted on AWS US-East infrastructure). If you use the Service from the EEA, UK, or Switzerland, your personal data — including health data — is transferred to and processed in the United States.

Where GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss equivalents) with our processors, and on processor certifications under the EU–US Data Privacy Framework where available. [Counsel: verify SCC/DPF coverage for each processor in section 6 and complete transfer impact assessments]

09How long we keep data

• Your content (recordings, transcripts, metrics, photos, documents, messages) is kept for as long as your account exists, so your longitudinal history works. Items you delete are removed from the live systems when you delete them (media files are deleted from storage along with the database record).
• Account deletion removes your user record and cascades deletion across your content. Two things survive in de-identified or minimal form: AI usage/cost records are retained with the link to your user removed, and diagnostic log lines may retain your former user ID string for a limited period [SET a concrete diagnostic-log retention window, e.g. 90 days].
• Billing records are kept as long as tax and accounting law requires.
• SMS verification codes expire shortly after they are issued.
• Backups maintained by our infrastructure providers age out on their standard schedules; deleted data can persist in encrypted backups until then.

10Controls you have today

We would rather tell you exactly what the product can do today than promise tooling that does not exist yet:

• In-app deletion of individual items: logs (including the underlying media file), documents, diet entries, metric records, assessments, habits, experiments/protocols, and friend connections can each be deleted in the app.
• Feature-level switches: SMS on/off and schedule, email digests on/off, cycle tracking on/off, the live interviewer on/off, per-document AI opt-in, per-metric sharing for friends and coaches, and nudges on/off.
• Full account deletion and full data export are not yet self-serve. Until they are, email [PRIVACY CONTACT EMAIL] from your account email and we will delete your account (a hard delete that cascades across your data) or provide an export of your data. We aim to complete verified requests within 30 days, as the GDPR and US state laws require.

11Your rights — EEA, UK & Switzerland

If GDPR / UK GDPR applies to you, you have the right to:

• Access your personal data and get a copy (Art. 15).
• Rectify inaccurate data (Art. 16) — most content is directly editable in the app.
• Erasure ("right to be forgotten", Art. 17) — via in-app deletion for individual items and by request for the whole account (section 10).
• Restrict processing (Art. 18) and object to processing based on legitimate interests (Art. 21).
• Data portability (Art. 20) — a machine-readable copy of data you provided, currently fulfilled by request.
• Withdraw consent at any time, without affecting prior processing — stop using a feature, delete the data, or request account deletion.
• Complain to your supervisory authority (Art. 77). We would appreciate the chance to address concerns first, but you can go straight to your authority.

To exercise any right, email [PRIVACY CONTACT EMAIL] from the address on your account. We verify requests against your authenticated account email and respond within one month (extendable as GDPR allows for complex requests).

12Your rights — US states

12.1 We do not sell or share your data

We do not sell personal information and do not "share" it for cross-context behavioral advertising (as the California Consumer Privacy Act, as amended by the CPRA, defines those terms), and we have not done so in the preceding 12 months. There is no advertising or analytics tracking in the product to opt out of; because we do not sell or share data, opt-out signals such as Global Privacy Control do not change anything for OneLifeLog accounts — there is nothing to opt out of.

12.2 California (CCPA/CPRA)

California residents have the rights to know/access, correct, delete, and port their personal information; the right to limit use of sensitive personal information; and the right not to be discriminated against for exercising rights. The categories we collect are described in section 3 (identifiers; health/sensitive information; audio/visual information; commercial information; internet activity limited to service logs; inferences limited to the AI-derived entries in your own journal). We collect them from you, use them for the purposes in section 4, disclose them only to the service providers in section 6, and retain them per section 9. We use sensitive personal information only to provide the Service you asked for — never to infer characteristics for advertising.

12.3 Washington & Nevada consumer health data

For residents of Washington (My Health My Data Act) and Nevada (SB 370): the health-tracking content in section 3.2 is "consumer health data." We collect it only with your consent (you create it in your journal), use it only to provide the Service, share it only with the processors in section 6 and the people you choose in section 7, and never sell it. You may withdraw consent, request access to it, request a list of the third parties it was shared with, and request deletion by emailing [PRIVACY CONTACT EMAIL]. [Counsel: confirm whether a separate standalone Consumer Health Data Privacy Policy page and homepage link are required for WA]

12.4 Other states

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and port data, and to opt out of targeted advertising, sales, and significant-effect profiling — none of which we do. Exercise any right via [PRIVACY CONTACT EMAIL]. If we refuse a request, you may appeal by replying to our decision and we will escalate the review [DESCRIBE APPEAL PROCESS AFTER LEGAL REVIEW].

13Cookies & local storage

OneLifeLog uses no advertising cookies and no third-party analytics cookies. The complete list:

Because we set no non-essential third-party cookies, we do not show a cookie consent banner. One third-party note: the public marketing homepage loads its display fonts from Google's font CDN, which receives your IP address as part of serving the font files; pages inside the app do not — their fonts are served from our own deployment.

14Security — what we actually do

No internet service can promise perfect security, and we will not pretend otherwise. Concretely, today:

• All traffic is encrypted in transit (HTTPS/TLS).
• Our storage providers state that data is encrypted at rest on their platforms.
• Every data query is scoped to the authenticated account — per-user isolation is enforced at the API layer, and media requests are refused unless the file belongs to the signed-in user.
• Media in cloud storage is accessed through signed, time-limited URLs rather than public links.
• Passwords are stored only as salted bcrypt hashes on our servers; plaintext passwords are never stored or logged.
• Inbound SMS webhooks are cryptographically verified as coming from Twilio, and phone-verification codes are short-lived with attempt limits to block brute-forcing.
• Administrative functions require designated admin accounts.

We do not currently hold SOC 2, ISO 27001, or HIPAA attestations, and we say so plainly rather than imply otherwise.

15If something goes wrong

If a personal data breach affects you, we will notify you and the relevant authorities as applicable law requires — including the 72-hour supervisory-authority notification under GDPR Art. 33 and US state breach-notification statutes — and we will tell you what happened, what data was involved, and what we are doing about it.

16Children

OneLifeLog is not directed to children. You must be at least 16 (or older where local law sets a higher age of digital consent) to use the Service, and it is not intended for anyone under 13 in any case (COPPA). We do not knowingly collect data from children; if we learn we have, we will delete it. If you believe a child is using the Service, contact [PRIVACY CONTACT EMAIL].

17Changes to this policy

When we change this policy, we will update the date at the top and, for material changes — especially anything that expands how health data is used — we will give you prominent advance notice in the app or by email before the change takes effect. Continued use after the effective date means the updated policy applies; where law requires fresh consent, we will ask for it rather than assume it.

18Contact & complaints

Questions, requests, or complaints: [PRIVACY CONTACT EMAIL] · [POSTAL ADDRESS]. EEA/UK users can also contact their supervisory authority (section 11). See also our Terms of Service and the legal hub.