Elpis (“we,” “our,” “the app”) is a personal health record and AI health-triage application. This policy explains what health and personal data we collect, why, how it's protected, who else can ever see it, and what control you have over it. We wrote this to describe what the app actually does, not as generic boilerplate — every claim below reflects how Elpis is built.
Elpis is not a medical device. AI-generated content in the app is informational only and does not constitute medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional for medical decisions.
1. What data we collect
Account & profile
- Email address and authentication credentials (or your Google account identifier, if you sign in with Google).
- Profile details you choose to provide: name, date of birth, biological sex, blood type, allergies, chronic conditions, current medications.
- Subscription/billing tier (we do not store your card details — payments are handled entirely by Razorpay; see §4).
Health data
- Health events you log or that our AI extracts from a conversation: symptoms, medications, lab results, procedures, visits, meals, workouts, mood, and similar entries, each with a timestamp and, where relevant, severity and body system.
- Triage chat conversations with the Elpis AI assistant, and any voice recordings you provide for transcription (the audio itself is discarded immediately after transcription — only the text is kept).
- Photos of prescriptions and lab reports you upload for OCR extraction. The photo itself is processed and then discarded — we retain only the structured data extracted from it (medication names, dosages, lab values, etc.), never the original image. This applies uniformly across every document-upload feature in the app.
- If you connect a wearable device (currently Ultrahuman) or Google Fit-style fitness tracking, the fitness/health metrics that integration provides.
- If you link your Ayushman Bharat Health Account (ABHA), the health ID and associated identifiers you explicitly choose to link.
Usage & device data
- Basic technical data needed to operate the service: IP address (used transiently for rate-limiting and abuse prevention, not stored long-term against your identity), device/browser type, and app crash/error logs.
- If you enable push notifications for reminders, a device push subscription token.
2. How we use your data
- To provide the core service — storing your health timeline, powering the AI triage assistant's conversational memory, generating Health Intelligence analyses (pattern detection, trend summaries) from your own recorded history.
- To keep you safe — our triage assistant screens for language indicating a medical emergency and displays an urgent-care prompt; this runs on your conversation text and does not involve any external notification to us or anyone else.
- To improve reliability — aggregate, de-identified usage patterns (e.g. which features error out) may be reviewed to fix bugs. We do not use your personal health data to train AI models, ours or any third party's.
- To bill you, if you're on a paid plan, via Razorpay.
- To communicate with you — reminders you've set, account/security notices, and (only if you opt in) product updates.
We do not sell your data. We do not share your health data with advertisers or data brokers, under any circumstances.
3. The Data Sovereignty model — how sharing with a doctor or clinic actually works
Elpis includes a partner network of clinics, labs, and doctors. By default, no one at a partner organization can see any of your health data. Access only happens through an explicit, patient-controlled consent grant:
- You decide whether to grant a specific partner access, what category of data they can see (e.g. only cardiac-related events, or a specific date range), and for how long. Grants expire automatically and can be revoked by you at any time.
- Within a grant, you can exclude specific individual records even if they'd otherwise match the granted category — a per-event override.
- Every single access to your data by a partner is written to an append-only audit log that you can view. This log cannot be edited or deleted, including by us.
- If a doctor wants access beyond what you've already granted, they can submit a request, which you must explicitly approve before anything is disclosed — nothing is shared automatically.
- You can export your full health record (as structured data or PDF) or permanently delete your account and all associated data at any time from your account settings.
4. Who we share data with (third-party processors)
We use a small number of infrastructure and AI providers to operate Elpis. Each processes only what's necessary for its specific function, under a data-processing relationship — none of them are permitted to use your data for their own purposes, such as training their general-purpose models on your health information.
- Supabase — our database, authentication, and file storage provider. All of your account and health data is stored here.
- Anthropic (Claude) and OpenAI (GPT-family models) — power the AI triage assistant, health-pattern analysis, and document field-extraction. Conversation and health-event text is sent to these providers to generate responses; per their respective enterprise/API terms, this data is not used to train their models.
- Mistral — provides OCR (text extraction) for prescription and lab-report photos. Only the photo is sent, transiently, for text extraction; see §1 on why the photo itself isn't retained afterward.
- Voyage AI — generates the embeddings (a numerical representation of text) used to power semantic search over your health history and relevant medical literature. It does not receive your identity, only the text content being embedded.
- Razorpay — processes subscription payments. Elpis never receives or stores your card/payment credentials directly; Razorpay handles that exchange under its own PCI-DSS-compliant systems.
We may also disclose data if legally required to do so (e.g. a valid court order), or to protect against imminent harm to you or others — this is a narrow exception, not a general practice, and we're not aware of ever having needed to use it.
5. Data retention
- Your health data is retained for as long as your account is active.
- Source documents are never retained — voice recordings, prescription photos, and lab report images are processed and then discarded; only the structured, extracted data persists.
- If you delete your account, your health data is permanently deleted from our production systems. Residual copies in encrypted backups are purged on our standard backup-rotation schedule.
- The audit log of partner access to your data (§3) is retained even after a consent grant expires or is revoked, since its purpose is a permanent record of who saw what and when — this is not personal content, it's an access record.
6. Security
- Data is encrypted in transit (TLS/HTTPS) between your device, our servers, and every third-party processor listed above.
- Data is encrypted at rest in our database and file storage.
- Access to production data by Elpis staff is restricted to what's operationally necessary and is itself logged.
- Row-level security is enforced at the database level so that, by default, only you (or a partner you've explicitly granted access to, per §3) can query your own records — this isn't just an application-layer rule, it's enforced by the database itself.
7. Your rights
Regardless of where you live, you can, at any time, from within the app:
- View, correct, or delete any individual health record you've logged.
- Export your complete health history.
- Revoke any partner's access to your data.
- Permanently delete your account and all associated data.
If you're in the EEA/UK, these map onto your GDPR rights of access, rectification, erasure, and portability. If you're in India, they map onto your rights under the Digital Personal Data Protection Act. We built these controls to be usable directly in the product rather than requiring you to email us and wait.
8. Children's privacy
Elpis is not directed at children under 18 and we do not knowingly collect data from them. A parent or guardian may log a dependent child's health information as part of the app's Family & Pets feature under their own account.
9. Changes to this policy
If we make a material change to how we handle your data, we'll update the date at the top of this page and, for significant changes, notify you directly (e.g. via email or an in-app notice) before the change takes effect.