How we handle your data

Operator: optim8 (Roman Kostiucik). Contact for data protection matters and to exercise your rights: support@optim8.ai.

• Profile (name, email, age, sex, weight, height, goals) — to personalize your program. Basis: service agreement / your consent.
• Health data (lab results, complaints, diagnostics — special category personal data) — to interpret markers and build recommendations. Basis: your explicit consent, separate from the general terms of use.
• Wearable device data (Oura, Garmin, WHOOP, Apple Health) and calendar (Google Calendar) — only if you connect them yourself. Basis: consent.

The platform provides an educational interpretation of lab results based on scientific publications (PubMed, Lancet, NEJM, JAMA, etc.), including AI models used for document recognition. This is not a medical diagnosis or a treatment prescription. Diagnoses and recommendations are generated by a deterministic algorithm, not the AI — see our Data Protection page for detail. Consult a doctor to confirm, refine, or act on any recommendation.

A limited set of subprocessors handle data to run the platform: Supabase (database and file storage, EU-hosted), Anthropic (document recognition, enterprise contract — data is never used to train models), Vercel (application hosting), Resend (email notifications), and Oura/Garmin/WHOOP/Google Calendar — only if you connect them yourself. Your data is never sold or shared with third parties for marketing purposes. For the full list with each subprocessor's exact role and region, see our Data Protection page.

• Health data and profile are kept while you're active — meaning at least one login within the last 24 months, regardless of whether a paid plan is currently active.
• After 24 months with no login at all, we send email warnings 30 and 7 days before deletion. Any login resets the clock.
• An explicit deletion request works at any time, with no waiting period — see "Your rights" below.
• Consents (the fact and text of them) are kept for 5 years — a separate period from health-data retention.
• Technical logs — 90 days. De-identified aggregate data may be kept indefinitely.

Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Admin access is protected by per-admin credentials and logged. Database access is restricted by security policies enforced at the database level itself (Row Level Security), not only by application code.

In the event of an incident that poses a risk to your rights, we notify the supervisory authority (Moldova's National Center for Personal Data Protection) within 72 hours and, where risk is high, inform you without undue delay.

We may update this policy from time to time. The date of the last update is shown at the top of this document.

Exercised on request — by a person, not an autoresponder

To exercise any right below, email support@optim8.ai — we respond within one month.

• Access your data and get a copy of it
• Correct inaccurate data
• Delete your data ("the right to be forgotten")
• Restrict processing
• Receive your data in a machine-readable format
• Withdraw consent at any time, without affecting processing already carried out
• Object to processing