Privacy Policy

1. Overview

This Privacy Policy explains how Enhanced AI (“we,” “us”) collects, uses, and shares information when you use the Service operated by Enhanced AI.

Some preferences and session flags may be stored in your browser (for example localStorage or sessionStorage) in addition to account data we store on our servers.

2. Information we may collect

Account information: name, email, and credentials when authentication is enabled.

Usage data: pages visited, feature use, device/browser type, and approximate location derived from IP when hosted.

Health-adjacent data you choose to provide: protocol logs, compound notes, lab values/uploads, chat messages, goals, and forum content. Treat this as sensitive.

Age confirmation: a local preference that you confirmed you are 18 or older.

Communications: messages you send to support through the Service.

Payment data: processed by third-party processors when real billing is enabled; we typically do not store full card numbers.

3. How we use information

To operate and improve the Service (chat, protocol, labs, forum, subscriptions).

To enforce Terms, Acceptable Use, age requirements, and security.

To process payments when real billing is enabled.

To comply with law when required.

To create de-identified or aggregated insights that do not identify you.

4. AI processing

When a live AI provider is connected, chat prompts and conversation history may be sent to third-party model providers under their terms and privacy policies. Protocol journal entries and onboarding profile fields are not included.

Do not submit information you are not willing to share with those processors. Avoid including identifiers or unnecessary personal details in prompts.

Enhanced AI is not a HIPAA covered entity or business associate. Information you submit is not treated as protected health information under HIPAA.

5. Sharing

We do not sell your personal information for money.

We may share data with service providers (hosting, analytics, payment, AI APIs) who process data on our behalf.

Advertising measurement: on public pages, signup, login, pricing, and checkout confirmation pages only, we may use advertising pixels from TikTok and Reddit, and send them server-side signup and purchase events. These include identifiers such as a hashed (SHA-256) email address, a hashed account ID, ad click IDs, IP address, browser user agent, and purchase value. We use this only to measure and optimize our own ads. Under some US state laws, including California’s, this may be considered “sharing” personal information for cross-context behavioral advertising.

We never send chat messages, protocol journal entries, lab data, forum content, onboarding profile answers, or any other health-related content to advertising platforms, and ad pixels do not load on those pages.

You can opt out of advertising sharing at any time on the Your Privacy Choices page (/privacy-choices). We also honor the Global Privacy Control (GPC) browser signal as an opt-out. When you opt out while signed in, we stop sending server-side advertising events for your account.

We may disclose information if required by law or to protect rights, safety, and the integrity of the Service.

Forum content you post is visible to other users as designed.

Business transfers: information may transfer as described in the Terms.

5a. Cookies and similar technologies

Essential: browser storage (localStorage, sessionStorage, and cookies) for sign-in, security, onboarding acknowledgments, theme, consent choices, and a coarse privacy region (for example EU/UK) used to decide which choices to show. These are required for the Service to work.

Analytics (optional): PostHog product analytics to understand feature use and fix problems. If you decline analytics, PostHog runs in a cookieless mode that does not store identifiers on your device.

Advertising (optional): TikTok and Reddit pixels on public and signup/checkout pages, and their first-party cookies (such as _ttp and _rdt_uuid), to measure ad performance. We also store the most recent ad click ID (for example ttclid or rdt_cid) for up to 7 days to attribute signups and purchases.

If you are in the European Economic Area, the United Kingdom, Switzerland, or Canada, optional analytics and advertising technologies run only after you consent (the legal basis is your consent). Elsewhere they are on by default and you can opt out. You can change or withdraw your choice at any time on the Your Privacy Choices page (/privacy-choices); withdrawal does not affect processing that already happened.

6. Retention and security

We retain information as long as needed to provide the Service and meet legal obligations. Prototype/local data may clear when you clear browser storage or refresh in-memory state.

We use reasonable safeguards appropriate to the stage of the product. No method of transmission or storage is 100% secure.

7. Children

The Service is for users 18+. We do not knowingly collect personal information from anyone under 18.

8. Your choices and rights

You can delete your account in Settings → Delete account (password or Google sign-in, plus typing DELETE). That removes your Firebase Auth user, journal entries, chats, lab files stored for the account, and cancels active Stripe subscriptions when Stripe is configured. Public forum threads and replies you authored are anonymized (display name and content replaced with a deleted placeholder) rather than erased, so other users’ discussion can remain. Some local browser flags can also be cleared via browser storage settings.

Where required by law, you may have additional rights to access, correct, or delete personal data.

9. Changes and contact

We may update this Policy and will revise the “Last updated” date.