Privacy Policy

1. Who we are

Protocol Health Ltd. is a Wyoming, United States company. We are the controller responsible for the personal information described in this policy. The Service is intended for users located in the United States and for individuals who are 18 years of age or older.

2. Information we collect

We collect the following categories of personal information:

• Account and identity information — your name and email address, collected through our authentication provider (Clerk) when you create an account.
• Self-reported health information— the goals, conditions, lifestyle details, and current regimen you enter during intake about the “Research Subject.” This is sensitive personal informationand is also “consumer health data.”
• Generated protocol content — the educational protocol produced for you, which is derived from your inputs.
• Payment information — when you purchase a protocol, payment is processed by Stripe. We receive transaction confirmation and limited billing details; we do not store full card numbers.
• Usage and device information — basic technical data such as IP address, browser type, and interaction logs collected to operate and secure the Service.

We collect this information directly from you, automatically through your use of the Service, and from our service providers (for example, payment status from Stripe).

3. How we use your information

We use personal information to:

• generate your personalized educational protocol;
• create and manage your account and authenticate you;
• process your one-time payment;
• send you transactional email (such as your protocol and receipts);
• operate, maintain, secure, and improve the Service; and
• comply with legal obligations and enforce our terms.

We do not use your sensitive health information for targeted advertising, and we do not sell it. We process sensitive personal information only with your consent and only for the purposes described here.

4. Artificial intelligence and subprocessors

Protocol Health uses artificial intelligence to generate protocols. The self-reported health information you enter during intake is transmitted to Anthropic, PBC (the provider of the Claude AI model), which processes it to generate your protocol. We engage Anthropic under commercial terms intended to keep your inputs from being used to train its models; the precise data-handling and retention terms are being confirmed with the provider (see the note below).

We rely on the following service providers (subprocessors), each of which may process personal information to perform services for us:

• Anthropic — AI generation of protocol content.
• Stripe — payment processing.
• Clerk — account authentication.
• Resend — transactional email delivery.
• Neon — database / data storage.
• Google Cloud — application hosting (Cloud Run).

We require our subprocessors to protect personal information and to use it only to provide services to us. We may update this list as our providers change; material changes will be reflected in this policy.

5. How we disclose information

We disclose personal information to the subprocessors listed above to provide the Service, to professional advisors and authorities where required by law, and in connection with a business transaction such as a merger or acquisition. We do not sell your personal information and we do not share it for cross-context behavioral advertising.

6. Your privacy rights

Depending on where you live, you may have some or all of the following rights under California (CCPA/CPRA), Virginia, Colorado, Texas, and other U.S. state privacy laws:

• Right to know / access the personal information we hold about you and how we use and disclose it.
• Right to delete the personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to data portability — to obtain a copy of your information in a usable format.
• Right to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information or use it for targeted advertising, so there is nothing to opt out of; we honor recognized opt-out preference signals where applicable.
• Right to limit the use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination for exercising your rights.
• Right to appeala decision on your request, where applicable under your state’s law.

Because health information is sensitive, we collect and process it only with your opt-in consent, which you provide during intake. You may withdraw your consent at any time.

How to exercise your rights

To exercise any of these rights, contact us at support@myprotocol.health. We will verify your request using the information associated with your account and respond within the timeframe required by applicable law (generally 45 days, which may be extended where permitted). You may use an authorized agent to submit a request on your behalf where the law allows. If we decline your request, you may appeal by replying to our decision; we will inform you of the outcome of any appeal.

7. Breach notification

Protocol Health is subject to the U.S. Federal Trade Commission’s Health Breach Notification Rule. In the event of a breach of unsecured identifiable health information, we are committed to notifying affected individuals, the Federal Trade Commission, and, where required, the media, in accordance with that Rule.

8. Cookies and tracking

We use cookies and similar technologies that are necessary to operate the Service, keep you signed in, and maintain security. We do not use third-party advertising cookies or sell information collected through cookies. You can control cookies through your browser settings, though disabling necessary cookies may affect how the Service works.

9. Data retention

We retain personal information only for as long as needed to provide the Service, deliver and make available your protocol, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it. Specific retention periods are being finalized as part of our records and data-minimization program.

10. How we protect your information

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction, and we limit access to those who need it to perform the purposes described in this policy. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children’s privacy

The Service is intended solely for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and the Service is not directed to children under 13. See our Age Policy for details.

12. HIPAA does not apply

Protocol Health is not a HIPAA covered entity or business associate, and HIPAA does not govern the information you submit. Your information is instead protected under this policy, our Consumer Health Data Privacy Policy, and applicable law. See our HIPAA Notice for more.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

14. Contact us

If you have questions about this Privacy Policy or our handling of your information, contact us at support@myprotocol.health or by mail at the address in the footer below.