Security & trust

• Your uploaded lab document is never stored. It is analyzed once to extract your results, then deleted immediately. There is no copy of the source file to download, export, or expose — not by you, not by your clinic, and not by Nodava.
• If you upload without an account, extracted results are stored only in your own browser using localStorage. Nodava does not keep a copy of your results on our servers.
• If you create an account, only the extracted results — biomarkers, reference ranges, and your health summary — are saved to your account so you can view them again, compare new labs, and track biomarkers over time.
• Account data is hosted on Lovable Cloud infrastructure, which includes standard encryption in transit and at rest as part of the platform.

• Individual patients can only see reports they uploaded themselves while signed in to their own account.
• A provider or clinic can only see your reports after you join their clinic with a clinic code and the clinic accepts the connection.
• Access is enforced at the database layer by Row Level Security (RLS) policies, so even if the application code has a bug, the database will not return data to an unauthorized user.

When you upload a PDF, it is sent one time to an AI provider to extract biomarkers and generate explanations. The PDF is not retained by the AI provider, and Nodava discards it as soon as analysis finishes. Only the extracted results are returned to your browser and, if you are signed in, saved to your account. Your uploads are not used to train AI models.

Billing for provider plans is handled by Stripe. Nodava does not store full credit-card numbers or other payment instrument details on our servers.

There are no analytics pixels, advertising trackers, or third-party advertising cookies. We do not build profiles, sell data, or share your information with advertisers or data brokers.

You can delete any saved report at any time from your dashboard. Anonymous reports live only in your browser, so clearing your browser storage removes them. Deleting your account removes every report saved to it.

Nodava secures the platform, enforces access controls, and chooses infrastructure providers with strong security practices. You are responsible for keeping your password safe, signing out on shared devices, and choosing carefully which clinic connections you accept. Providers and clinics are responsible for approving only the staff who should access patient data and for following their own privacy and security practices.

If you have a security or privacy question, please reach out through our contact page.