Privacy policy

• Account information: your email address, and a name if you provide one. Passwords are stored only as salted hashes by our authentication provider.
• Lab data: the biomarkers, values, units, reference ranges, collection dates, and generated explanations extracted from reports you upload.
• Notes you write on a report, and clinic connection details if you join a clinic.
• Billing information: if you purchase an analysis, Stripe processes your payment and we store only a customer reference and purchase status. We never see or store your full card number.
• Basic technical logs needed to operate and secure the service, such as error reports and request timestamps.

We do not collect data from third-party sources, and we do not buy or enrich your profile with outside data.

The PDF or photo you upload is analyzed once and then deleted. It is not stored in our database or file storage, so there is no copy of your original report to download, export, or leak. Only the extracted results and explanations remain.

If you upload without an account, extracted results are stored only in your own browser using localStorage. Clearing your browser data removes them.

If you have an account, the extracted results — biomarkers, reference ranges, notes, and your health summary — are saved to your account so you can view them again, compare new labs, and track biomarkers over time. Records are stored in our managed cloud database with row-level access rules so each row is readable only by the account that owns it and, where you have consented, your connected clinic.

• You, when signed in to your account.
• A clinic and its listed providers, only if you joined that clinic with a code or invitation and the clinic accepted you. You can ask us to disconnect you at any time.
• Our AI processing provider, at the moment of analysis only, to extract and explain the report.
• A small number of Nodava operators, only when strictly necessary to investigate a support request or a security issue.
• Nobody else. We do not sell, rent, or share your health data with advertisers, data brokers, insurers, or employers.

When you upload a report, its contents are sent one time to an AI provider through our server to extract biomarkers and generate explanations. The document is not retained by the AI provider after processing and is not used to train models. The resulting text is returned to your browser and, if you are signed in, saved to your account.

• Cloud database, authentication, and hosting for storing your account and results.
• An AI model provider for one time report analysis.
• Stripe for payment processing.
• An email delivery provider for account emails such as confirmations, password resets, and clinic invitations.

These providers process data on our instructions and only to deliver the service.

There are no analytics pixels, advertising trackers, or third-party advertising cookies. We use only the cookies and local storage needed to keep you signed in and to hold your results when you use Nodava without an account. We do not build advertising profiles and we do not sell data.

Nodava is a consumer educational tool. It is not a HIPAA-covered entity and does not act as a business associate for individual users, so HIPAA protections do not apply to information you upload to your personal account. We still protect your data with encryption in transit and at rest, per-row access controls, and deletion of original documents after analysis. More detail is on our Trust & Security page.

• Results are kept until you delete them, so your lifetime lab record stays intact.
• You can delete any individual report from your dashboard at any time.
• Deleting your account removes every report saved to it. Anonymous reports live only in your browser, so clearing your browser storage removes them.
• You can request a copy of your data, correction of inaccurate data, or full deletion by emailing us. We respond within 30 days.
• Limited billing records may be retained where required for tax and accounting purposes.

To exercise any of these rights, email Dylan.nodava@gmail.com.

Nodava is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.