How we handle your data

Operator: Optim8 Health SRL, str. Tarinii 10, mun. Chisinau, Republica Moldova, IDNO 1026023150736. Contact: +373 69 088 181, support@optim8.ai — for data-protection questions and to exercise your rights.

• Profile (name, email, age, sex, weight, height, goals) — to personalize your program. Basis: service agreement / your consent.
• Health data (lab results, complaints, diagnostics — special category personal data) — to interpret markers and build recommendations. Basis: your explicit consent, separate from the general terms of use.
• Wearable device data (Oura, Garmin, WHOOP, Apple Health) and calendar (Google Calendar) — only if you connect them yourself. Basis: consent.

The platform provides an educational interpretation of lab results based on scientific publications (PubMed, Lancet, NEJM, JAMA, etc.), including AI models used for document recognition. This is not a medical diagnosis or a treatment prescription. Diagnoses and recommendations are generated by a deterministic algorithm, not the AI — see our Data Protection page for detail. Consult a doctor to confirm, refine, or act on any recommendation.

A limited set of subprocessors handle data to run the platform: Supabase (database and file storage, EU-hosted), Anthropic (document recognition, enterprise contract — data is never used to train models), Vercel (application hosting), Resend (email notifications), and Oura/Garmin/WHOOP/Google Calendar — only if you connect them yourself. Your data is never sold or shared with third parties for marketing purposes. For the full list with each subprocessor's exact role and region, see our Data Protection page. Payment data (amount, date, order status, the last 4 digits of the card and a payment identifier) is processed by the Paynet.md payment service; the card number is entered on its secure page and never reaches us. Only a client code and, if available, your e-mail are passed to the payment service. On the public pages of the site, and only with your consent, we use Google Analytics (Google Ireland Ltd) for anonymous visit statistics. It does not run on pages that contain health data, and no health data is sent to it. You can decline in the cookie notice.

• Performance of the service contract (paying for a plan, providing access and recommendations).
• Your explicit consent — for health data (a special category) and for optional mailings; you can withdraw it at any time.
• Legal obligations — accounting and tax records of payments.

• Some providers (hosting, database, document recognition, e-mail) are located outside the Republic of Moldova, including in the EU and the USA.
• Transfers rely on standard contractual clauses and security measures that give a level of protection comparable to Moldovan and EU law.
• The recipients are listed in "Who receives your data". Data is never sold or shared for advertising.

• Health data and profile are kept while you're active — meaning at least one login within the last 24 months, regardless of whether a paid plan is currently active.
• After 24 months with no login at all, we send email warnings 30 and 7 days before deletion. Any login resets the clock.
• An explicit deletion request works at any time, with no waiting period — see "Your rights" below.
• Consents (the fact and text of them) are kept for 5 years — a separate period from health-data retention.
• Technical logs — 90 days. De-identified aggregate data may be kept indefinitely.

Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Admin access is protected by per-admin credentials and logged. Database access is restricted by security policies enforced at the database level itself (Row Level Security), not only by application code.

In the event of an incident that poses a risk to your rights, we notify the supervisory authority (Moldova's National Center for Personal Data Protection) within 72 hours and, where risk is high, inform you without undue delay.

We may update this policy from time to time. The date of the last update is shown at the top of this document.

Exercised on request — by a person, not an autoresponder

To exercise any right below, email support@optim8.ai — we respond within one month.

• Access your data and get a copy of it
• Correct inaccurate data
• Delete your data ("the right to be forgotten")
• Restrict processing
• Receive your data in a machine-readable format
• Withdraw consent at any time, without affecting processing already carried out
• Object to processing