Privacy Policy

1. Who we are

Healthesis.AI (“we”, “us”) provides the Healthesis.AI website and application (the “Service”). We are responsible for the personal data described in this policy. You can contact us about privacy at support@healthesis.ai.

2. Please do not upload patient data

The Service is designed to analyse company documents such as pitch decks, meeting notes and data-room files. Do not upload personal health information, patient-identifiable data or other sensitive personal data. Remove or anonymise such data before uploading. Company documents can still contain ordinary business personal data, such as the names and roles of founders and team members; you are responsible for having the right to share it with us.

3. What we collect

Account data

Your name, email address and a hash of your password (we never store your password itself), your workspace memberships, email verification status and the version of the Terms you accepted.

Content you upload and the outputs we generate

Documents you upload, company websites you ask us to read, notes and diligence information you enter, and the analyses and reports generated from them.

Billing data

Payments are handled by Stripe. We receive and store your subscription status, plan, report balance, billing history and limited customer details from Stripe. Card details are entered directly with Stripe; we never see or store full card numbers.

Email

We send transactional emails (for example verification, password reset and billing notices) through Resend, which processes your email address and the message content to deliver them.

Usage and analytics

We use our own cookieless, first-party page-view analytics to understand how the website is used. Visits are counted using an anonymous visitor hash that rotates daily, so a visitor cannot be followed from one day to the next. We do not store IP addresses for analytics, and we do not record a page view when your browser sends a Do Not Track or Global Privacy Control signal. We do not use third-party analytics or advertising trackers.

Security logs

To protect the Service, we keep records such as sign-in attempts used for rate limiting, session records and an audit log of changes to workspace data. Our hosting infrastructure may also keep short-lived technical logs, which can include IP addresses, to operate and secure the Service.

4. How we use data and our legal bases

• To provide the Service under our contract with you: creating and securing your account, processing your documents, generating analyses and reports, managing your subscription and report allowance, and providing support.
• For our legitimate interests: keeping the Service secure and preventing abuse, understanding aggregate usage to improve the Service, and communicating with you about important changes. We balance these interests against your rights and keep the data involved to a minimum.
• To meet legal obligations: for example keeping billing and tax records and responding to lawful requests.

We do not sell personal data, use it for advertising, or use your documents to train AI models.

5. AI processing

To generate analyses, the text of your documents and related research is sent to OpenAI's API. Under OpenAI's API terms, data sent through the API is not used by OpenAI to train its models. OpenAI may retain API data for a limited period to monitor for abuse, after which it is deleted, as described in OpenAI's own policies. The Service also queries public sources (for example openFDA, ClinicalTrials.gov, Europe PMC and patent records) and searches the web using company, product and technology terms derived from your documents.

6. Service providers (sub-processors)

We share personal data only with service providers who process it on our behalf to run the Service, under contractual confidentiality and data protection obligations:

• OpenAI — AI processing of document content and research to generate analyses
• Stripe — Subscription payments and invoicing
• Resend — Transactional email, such as verification, password reset and billing messages
• Our hosting provider — Infrastructure: servers, database, file storage and backups

We may also disclose data where required by law, to protect the rights and safety of our users or the Service, or to a successor in a reorganisation, merger or sale of the Service, in which case this policy will continue to apply to your data.

7. International transfers

Our service providers may process data in countries other than your own, including the United States, where data protection laws may differ. Where required, we rely on appropriate safeguards for these transfers, such as standard contractual clauses offered by our providers.

8. How long we keep data

• Account data: for as long as your account exists.
• Documents and reports: until you delete your account, or until we delete specific documents at your request. Removing a document from a company in the app excludes it from future analyses, but earlier report versions keep their citations to it.
• Backups: deleted data remains in backups until they rotate, within 14 days.
• Billing records: for as long as required by tax and accounting law.
• Security logs: for as long as needed for security purposes; sign-in attempt records are kept only briefly for rate limiting.

9. Security

We protect your data with measures including encryption in transit (TLS), scrypt password hashing, server-side sessions, rate limiting, database-level separation between workspaces (Postgres row-level security), private file storage, daily backups and least-privilege access. No system is perfectly secure, but we work to protect your data and will notify you of a breach affecting it where the law requires. See our Security page for details.

10. Your rights

Depending on where you are, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data (you can delete your account in the Service at any time);
• receive a copy of your data in a portable format (you can also export reports as PDF or Word);
• object to or ask us to restrict processing based on our legitimate interests; and
• complain to your local data protection authority.

To exercise these rights, email support@healthesis.ai from the address associated with your account. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law.

11. Cookies and similar technologies

We use only strictly necessary cookies and browser storage, which do not require consent:

• Session: keeps you signed in securely.
• Workspace selection: remembers which workspace you are working in.
• Sidebar width: remembers your preferred layout.

We do not use advertising cookies or third-party tracking cookies.

12. Children

The Service is for professional use and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it last changed. If we make material changes, we will notify you by email or in the Service before they take effect.

14. Contact

Questions or requests about privacy? Email support@healthesis.ai.