Privacy Policy
Effective date: 2026-10-13 · Version: 2026-10-13
Who we are
Baymax is a private, AI-augmented personal-health companion operated by Baymax (operated by the project owner) (India). For the personal data we process, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
Grievance Officer: to be appointed (privacy@baymaxos.example).
Baymax is not a medical service. It organises your own health data and produces observational summaries to help you and your doctor. It does not diagnose, prescribe, or provide treatment advice.
What we collect
You give us this data directly, or connect a source you control:
- Account: email, password (stored hashed by our auth provider), display name, optional avatar.
- Profile: date of birth, sex, and optional health context you choose to enter.
- Health records you upload: lab reports, prescriptions, scans, discharge summaries, genetic/DNA reports, and mental-health assessments (files and the structured data extracted from them).
- Biomarkers & body composition extracted from your uploads, trended over time.
- Daily check-ins, meals, medications & supplements you log.
- Wearable & activity data, if you connect Google Health (Fitbit, Pixel Watch, or an Android wearable via Health Connect) or Withings.
- Approximate location: only a coarsened coordinate (~1 km) + city, for local air-quality context. We do not store precise location.
- Group accountability (optional): members see only summary signals (who checked in / worked out), never your raw weights, notes, clinical values, or records.
- Usage signals (optional, consented): product-improvement analytics with no record content and no third-party ad SDKs; opt out anytime in Settings.
We do not sell your data, run advertising, or take affiliate payments that influence any recommendation.
How we use it
To store and organise your records; extract structured data from uploads; produce your longitudinal health synthesis and daily reads; answer your own questions over your own data; and operate, secure, and improve the service. Mental-health records are excluded from the AI analysis by default, and you control per-record whether anything is included.
Who processes your data
To run the service we share data with the processors below. We remain responsible for them under DPDP s.8; none may use your data for its own purposes.
| Who | Role | Data it receives | Region | Notes |
|---|---|---|---|---|
| Supabase | Database + file storage | All stored health data | India (Mumbai, ap-south-1) | Disk-level encryption at rest (AES-256); row-level security isolates each user. |
| Vercel | App hosting / server-side processing | Processes health data in memory to render pages; stores none of it | Mumbai (bom1) | TLS in transit. Functions are pinned to the Mumbai region so processing stays in India. |
| Anthropic (Claude) | Longitudinal AI analysis; reading lab reports, DNA reports, health summaries, medicine photos and body-composition scans; answering questions about your data (Ask); the plain-language genetics read; reading meals you log, product and grocery labels, new-record details and medicine names; food verdicts, meal plans, plain-language reads and follow-up questions on an analysis | Structured history + seed documents for the analysis; the document, photo or text being read; the records an Ask question draws on | United States | Commercial API. Not used to train models; minimal retention. |
| OpenAI (API) | The analysis audit: a second read of your analysis against its source documents, run only when you ask for it | The analysis and the source documents it was built from | United States | Commercial API. Not used to train models; kept for up to 30 days for abuse monitoring, then deleted. |
| Google Cloud (Cloud Run) | Pharmacogenomic calling from an uploaded genome (only if you upload one) | Your raw genome / VCF file, transiently: read, called with PharmCAT, then discarded | India (Mumbai, asia-south1) | Processed in memory (this region gives the container no disk) and never stored; covered by Google's Cloud Data Processing Addendum. |
| Open-Meteo | Air-quality lookup | Coarse coordinate + city only. No identity, no health data | EU | |
| Google Health API (Fitbit / Health Connect) | Wearable sync (only if you connect) | Your activity / sleep / heart metrics | United States | |
| Withings | Wearable sync (only if you connect) | Your activity / sleep / heart metrics | EU | |
| Open Food Facts | Barcode lookup (only if you scan) | Product barcode only | EU | |
| Swiggy | Grocery / food catalog + cart (only if you connect) | Search query + delivery address | India |
Some processors are in the United States. Indian law currently permits these transfers (DPDP follows a negative-list model and the US is not restricted). If that changes, we will move the affected processing into India.
Your rights
At any time you can:
- Access / export a full copy of your data (Settings → Data export), including download links for your files.
- Correct or update your records in the app.
- Delete your account. This permanently removes your data and uploaded files. Deletion is irreversible.
- Withdraw consent for any processing purpose, as easily as you gave it.
- Raise a grievance with our Grievance Officer (above); we respond within 30 days. You may also complain to the Data Protection Board of India.
Consent
At signup, and when each sensitive data class is added, we ask for specific, informed consent to store your records (including genetic and mental-health data) and process them with the AI providers named above (including transfer to the United States). You can review and withdraw consent in Settings.
Family & caregiving
Every account holds one adult's own records. You can also let another adult you choose read your record: a partner, an adult child, a parent. It only happens if both of you act: you create a single-use code that expires in 72 hours, and they enter it on their own account. Naming someone is not enough, so nobody becomes your caregiver without doing something themselves.
What a caregiver can read: your health records, the lab results read from them, your medicines and supplements, your daily check-ins, whether doses were taken, your meals, your wearable activity and sleep, your generated reports, a summary of your doctor's sheet, and six basics from your profile: name, date of birth, sex, and whether you smoke, have diabetes, or are treated for blood pressure.
What stays yours alone: any record you tag mental health, the lab results extracted from those records, and any record you hide. These are withheld by the database itself, not merely left off a screen. Your Ask conversations are never shared, and neither is the full data snapshot behind a doctor's sheet.
Two limits we would rather state plainly than blur. Your medicines list is not filtered, so a caregiver can see a psychiatric prescription and may draw conclusions from it. And your reports are shared as written, so if you have chosen to include a mental-health record in your analysis, the report may discuss it, even though the record itself stays hidden. The control that opts a record into your analysis says so at the point you use it.
Reading and adding are two separate permissions. Sharing your record gives a caregiver read access only. If you also want them to help keep it up to date, you can allow that separately, from your own Caregiving page. They cannot give it to themselves, and you can withdraw it without ending the sharing. When it is on, they can file records, add medicines, and log doses. They can never change or delete anything you put there, never file a record tagged mental health, and never decide what feeds your analysis. Everything they add is stamped with their name and appears in your access log. They cannot reach your files directly either. A file opens only through a link that lasts one minute and re-checks their access first.
Recorded activity and ending access. Your activity log shows selected caregiver actions, including shared-page visits, file-link requests and assistant questions through Baymax. Logging for these reads is best-effort; authorized direct API reads are not recorded here, so this is not a complete access history. Caregiver additions and shared-report retrievals are logged by their database operations. Either side can end access at any moment. New reads and file-link requests then stop; a file link already issued can remain usable for up to one minute.
Children
Accounts are for adults only. We ask for your date of birth at signup, we do not allow anyone under 18 to create an account, and the caregiving feature above is adults-only on both sides. We do not process children's data yet. Please do not upload the records of anyone under 18.
When family profiles for children launch, we will obtain verifiable consent from a parent or legal guardian before storing a child's data, as India's data-protection law requires. We will store and organise a child's records and produce a doctor-visit summary, but we will not run our longitudinal analysis, trend-tracking, or profiling on a minor, and we will never use a child's data for behavioural monitoring or advertising.
Retention & security
We keep your data while your account is active, and remove it on deletion. Your data is encrypted in transit, isolated per-user by database row-level security, and kept in private storage reachable only through short-lived signed links. It is stored in India (Mumbai), and the servers that process it run there too. We do not add a separate layer of application-level encryption on top of that, and we would rather say so than imply protection we do not provide. We maintain a breach-response process and will notify you and the Data Protection Board of a personal-data breach without undue delay, as the law requires.
Notifications, if you turn them on. You can ask Baymax to remind you when it's time for your medicines and to tell you when a new report is ready. This is off by default and per-device: turning it on on your phone does not turn it on anywhere else, and you can turn it off in Settings or in your browser at any time. A notification never contains health data: it says a medicine is due, not which one, and that a report is ready, not what it found, because a notification is rendered by your phone and readable by anyone holding it. To send them we store the notification address your browser issues for that device; it is deleted when you turn notifications off, when you delete your account, and automatically once the device stops accepting messages.
Two pages are kept on your device so they work without a signal. If you install Baymax, your vault and your doctor sheet are stored on the device after you open them, so you can read them at a clinic with no reception. Nothing else is: not your reports, check-ins, meals, wearable data or your Ask conversations. The app clears these offline copies before completing sign-out or another sign-in. Copies are not served offline after 7 days and are removed when the app next runs or reads them. A closed or inactive browser cannot erase stored bytes on a timer; use the browser’s site-data controls to remove them while the app is inactive. Your phone's own passcode or biometric lock is what protects it in the meantime, so lock the device if other people use it.
Changes & governing law
We'll update this policy as the product and law evolve, and show the new effective date. This policy is governed by the laws of India; the DPDP Act and DPDP Rules apply to our processing of your personal data.