Overview

Topos Health (“we,” “us,” or “our”) is a personal health platform that helps you understand your health data through genomic analysis, medical record organization, wearable device integration, and AI-powered insights. We take your privacy seriously and are committed to protecting your personal and health information.

Beta service notice: Topos Health is currently in beta. During this period, features may change and a small founding team has administrative access to the platform to ensure quality and resolve issues. All team members are bound by the same data protection commitments described in this policy. We will update this policy as the platform evolves toward general availability.

Information We Collect

We collect the following categories of information when you use Topos Health:

Account information: your email address and authentication credentials, used to create and secure your account.

Profile information: date of birth, biological sex, health goals, and family medical history that you voluntarily provide to personalize your experience.

Health records: medical documents, lab results, and clinical reports you upload for organization and analysis.

Genomic data: genetic information from sequencing services you choose to connect, used to generate personalized health insights.

Wearable and activity data: health metrics from connected devices including Garmin, Oura, Whoop, and Withings. This includes activity data (steps, calories, workouts), cardiac data (heart rate, HRV), sleep data (duration, sleep stages), body measurements (weight), recovery scores, and blood pressure readings. We access this data through OAuth-authorized connections that you explicitly initiate. If you connect Garmin and choose to share it there, this also includes your menstrual cycle schedule (period dates, cycle length and phase) and, if you are pregnant, the pregnancy details you entered in Garmin Connect, such as your due date.

Cycle and pregnancy information: if you turn on cycle tracking in Topos, or share your cycle from Garmin, we keep your cycle length, last period start, life stage (for example, trying to conceive, pregnant, or perimenopause), and whether you use hormonal birth control, and use them to make your plans and answers cycle-aware.

Apple Health data: if you import Apple Health data, we receive metrics you choose to share including activity, heart rate, sleep, weight, and blood pressure readings. This data is imported directly from files you provide and is stored with the same protections as other health data.

Voice: if you choose to talk to Topos instead of typing, we capture your microphone audio only while the microphone is on, send it to a transcription service to turn it into text, and keep the text as part of your conversation, the same as a typed message. When Topos speaks its replies aloud, the reply text is sent to a speech service to make the audio. Spoken messages are not stored as audio.

Usage data: interactions with the platform to improve functionality. We do not track you across other websites or apps.

How We Process Your Data

Your data is used exclusively to provide and improve the Topos Health service:

To generate personalized health insights and recommendations by analyzing your health records, genomic data, and wearable metrics together. To display your health trends and patterns over time. To send you health digests and notifications you've opted into. To maintain and improve the platform's functionality and accuracy.

We do not use your health data for advertising, marketing to third parties, or any purpose unrelated to your personal health experience on Topos Health.

AI processing: your health data, including conversation content, biomarker values, medical record text, and health screenshots, is processed by Anthropic's Claude AI to generate personalized health insights, practice plans, and coaching. This processing occurs in real-time when you use the app. Anthropic retains data for up to 30 days for safety and abuse prevention, then deletes it, longer only where their automated safety systems have flagged the content, or where the law requires them to keep it. Your health data is never used for model training.

Email delivery: your daily digest emails are delivered through Resend, our email service provider. These emails may contain health metrics, practice plan summaries, and personalized insights. Resend processes this data solely for email delivery and does not retain health data beyond what is necessary for delivery and compliance.

Image analysis: when you upload photos of health documents or screenshots, these images are processed by Anthropic's Claude Vision model to extract health metrics and biomarker values. Photos you upload are stored with your record so you can see the original. Anthropic processes them to read the values and keeps them up to 30 days.

Background extraction: after you interact with your health coach, a secondary AI process may run to extract health details you mentioned (such as medications, symptoms, or goals) so they can be saved to your profile for future reference. This uses the same Anthropic processing and retention terms described above.

Health trends in emails: your daily digest emails may include high-level health trends, practice plan summaries, relevant research articles, and action items. These emails do not contain specific biomarker values or raw health data, only general trends and recommendations. Emails are delivered through Resend and you can disable digest emails at any time from Settings → Notifications.

Third-Party Services

Topos uses the following third-party services to provide our health platform:

Anthropic (AI processing): generates personalized health insights, practice plans, and coaching from your health data. Anthropic retains data for up to 30 days for safety purposes, then deletes it, except where the content has been flagged by their safety systems or the law requires otherwise. Your health data is never used for model training.

Supabase (database and authentication): stores your health data with encryption at rest and in transit.

Vercel (hosting): hosts the Topos application. Vercel keeps the log our servers write while they work. A log line says what happened and names your account by its internal ID. We do not write what Topos generated for you, your results, or your email address to that log. An error's own message is kept in it, and an error message can include a word from the information it failed on. Separately, a page address can name a lab test, such as when you open one of your results from search, but never its value, what Topos wrote, or a person's name, and every address passes through Vercel's servers.

Sentry (error monitoring): receives a report when something goes wrong, or when one of our checks catches a mistake in something Topos wrote. A report says what failed and where, and carries your account's internal ID. Before a report is sent we remove what Topos wrote, the names and values of your results, and the kind of any safety concern, and we keep that detail in our own records instead. A report keeps the software's own error message, shortened, and an error message can include a word from the information it failed on. Earlier reports could include health information, and Sentry keeps those until its retention period ends. When an error happens in your browser, Sentry also receives a recording of the screen around it, with text masked and images left out. It receives timing records for a sample of ordinary requests.

Resend (email): delivers your daily digest and lifecycle emails. Processes email content for delivery only. It also carries notices to our own team when something needs a person's attention. A notice can name you and say what kind of matter it is, and it can include a detail of the matter: what a check found wrong in something written for you, or what you wrote when you sent us feedback. Three notices are different: the one sent when a conversation reaches a safety screen, the one sent when a check holds back a plan made for you, and the one sent when a check keeps holding back your daily brief. Each carries your account's internal ID, and none carries your name, the kind of concern, or what the check found.

AssemblyAI (speech to text) and OpenAI (text to speech): AssemblyAI turns your spoken words into text; OpenAI turns Topos's written replies into spoken audio when you use voice. Neither uses your audio or text to train their models. AssemblyAI receives your audio and, so that it hears them correctly, a list of names from your own record, as your record writes them: your medications, supplements, conditions and allergies, your lab tests and other results (genetic ones included), and your doctors and family members. It does not keep the audio or the text of what it hears live. When your words reach it as a short recording instead, it deletes the recording, its text and the names sent with it within a few days. OpenAI receives the text of the reply being spoken and no other part of your record. It keeps that text, and may keep the audio made from it, for up to 30 days to monitor for abuse, then deletes them, except where the law requires it to keep them longer or it needs them to protect its services or another person from harm.

We do not sell, share, or provide your health data to advertisers, data brokers, or any other third parties beyond those listed above.

Wearable Device Data

When you connect a wearable device (Garmin, Oura, Whoop, or Withings), we request only the permissions necessary to retrieve your health and activity data. You can review these permissions during the connection process. For Garmin, you choose on Garmin's own screen which kinds of data to share, including whether to share your cycle schedule, and you can change that in Garmin Connect at any time.

We store your wearable data in our secure database associated with your account. This data is used solely to provide you with health insights and trend analysis within Topos Health. We do not share your wearable data with any third parties beyond those listed in the Third-Party Services section above. Before you connect Garmin, we ask for your explicit agreement that Topos may use AI, provided by Anthropic, to read your Garmin data, and we use it only to personalize your own plans and answers, for example adjusting a plan to your sleep, recovery, workouts, or cycle phase. Garmin data, including cycle and pregnancy information, is never sold, never used for advertising, and never used to train AI models. We treat cycle and pregnancy information as sensitive health data.

You can disconnect any wearable device at any time from Settings → Data, or by asking Topos in the chat. Disconnecting a device removes the OAuth connection and all associated data from our systems, and for Garmin it also withdraws your agreement to AI processing and tells Garmin you have left. Data you uploaded yourself, such as an export file, stays until you delete it. Cycle details you set yourself in cycle tracking stay as your own settings, which you can change or turn off at any time.

Family Data Sharing

When you participate in a Family Circle, your shared family health history (information about relatives' health conditions) is used to enrich the health risk profiles of connected family members. Your personal health data, including your biomarker values, practice plans, conversations with Topos, and uploaded documents, is never visible to other Family Circle members.

Family Circle members can see: health risk patterns derived from shared family history, that you are a member of the circle, and your name and relationship.

Family Circle members cannot see: your personal biomarker values or lab results, your conversations with Topos, your practice plans or completion history, your uploaded medical records, or your genetic data.

You can leave a Family Circle at any time from Settings. Your personal data remains unaffected.

Genomic Data

If you import genetic data (from 23andMe, AncestryDNA, or clinical sequencing), this data is stored with the same encryption and access controls as your other health data. Genetic data is processed by Anthropic's AI to generate personalized insights about caffeine metabolism, nutrient processing, exercise response, and health risk factors.

Genetic data is never shared with other users, including Family Circle members, unless you explicitly choose to share specific insights.

Data Storage and Security

Your data is stored in secure, encrypted databases hosted by Supabase with row-level security policies ensuring that only you can access your own data. All data transmission occurs over HTTPS/TLS encryption.

Authentication is handled through Supabase Auth with support for multi-factor authentication (MFA) for additional account security. OAuth tokens for connected wearable devices are stored encrypted using AES-256-GCM and are never exposed to client-side code.

Data Retention

Your account data: health records, biomarker values, conversations, practice plans, and all other personal data are retained in our database for as long as your account is active. You can delete specific data categories or your entire account at any time.

Anthropic (AI processing): data sent to Anthropic for AI processing is retained for up to 30 days for safety and abuse monitoring, then deleted. Content that their automated safety systems flag, or that they are legally required to keep, can be retained for longer. Your data is never used to train AI models.

Resend (email delivery): email content is retained by Resend in accordance with their standard retention policies for delivery, compliance, and troubleshooting purposes.

Voice: spoken messages are never stored as audio by Topos. The text of what you said, and of what Topos said back, is kept with your conversation like any typed message, and goes when you delete the conversation or your account.

Transient platform data: rate-limiting records are automatically purged after 24 hours. Administrative logs are purged after 30–90 days depending on type: activity records after 30 days, error reports and the alerts sent to our team after 90 at the latest. Error reports and alerts can include health information: a piece of what Topos wrote, or the name and value of a result. An older alert can also say what kind of safety concern was involved. Records of which AI requests ran and what they cost are kept.

Your Rights and Controls

You have full control over your data on Topos Health:

Access and export: you can view all data we hold about you directly within the app.

Disconnect devices: remove any connected wearable device and its associated data at any time.

Revoke shared links: manage and revoke any shared Health Portrait links from Settings → Data.

Delete your account: you can delete your account at any time from Settings, in The Careful Corner, under Delete My Account. This removes your conversations and message history, your biomarker values and medical records, your practice plans and completion history, your uploaded files and documents, your genetic data, your insights, action items and goals, and your profile and preferences. It also removes you from any Family Circle you belong to, health history you contributed about relatives you share with other members stays with them, because it is their family history too.

Deletion is not reversible. We cannot restore an account or its data once you have confirmed it. Copies held in routine database backups are overwritten on our hosting provider’s rolling schedule and are never restored into the product.

What we keep, and why: we retain a record of the consents you gave and withdrew. The consent record holds no health data. We keep it because a consent record that could be deleted would not be evidence of anything. Where a parent gave consent for a child or teen, we retain that record on the same basis. Our log of the corrections you made and of changes to what you shared with family, and the record of any safety intervention, are deleted with your account. Records of AI requests are kept with your identity removed rather than deleted. Error reports that name your account are deleted. An error report that never named an account is kept for up to 90 days, and can hold a piece of generated text with nothing to say whose it was. A notice already sent to our team about your account is kept for up to 90 days and can name you.

Notification preferences: control what communications you receive through Settings.

Children's Privacy

Topos Health is designed for adults, and anyone under 18 reaches Topos only through a parent or legal guardian, never by signing up on their own.

Teens aged 13–17 may have a supervised account. A parent or legal guardian creates it, consents on the teen's behalf, and can revoke the teen's access at any time. We record that consent, including the exact text the parent agreed to and when.

Children under 13 do not have accounts and cannot log in. A parent may keep a health profile for their child inside their own Family Circle. The child has no credentials, no email from us, and no direct interaction with our AI. The parent can view, correct or delete the profile at any time.

We do not knowingly create an account for anyone under 18 without a parent's or guardian's recorded consent. If you believe a minor has an account without that consent, email privacy@topos.health and we will delete it.

Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you through the app or via email. Your continued use of Topos Health after changes take effect constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or your data, contact us at info@topos.health.