Consumer Health Data Privacy

1. Scope of this policy

This policy applies to information you provide to, or that we generate through, the MyDeficiencies educational analysis experience that could reasonably identify or be used to infer something about your physical or mental health status. Several U.S. state laws use terms such as "consumer health data" for this category, and we treat it as sensitive regardless of where you live.

Our general Privacy Policy covers account, technical, payment, and communication information. Where the two documents overlap, this policy governs consumer health data.

2. Categories of consumer health data we collect

We deliberately keep this list short. MyDeficiencies does not ask for your name, date of birth, diagnoses, lab values, insurance details, or medical records.

Medication inputs. The medication names you enter or select in order to request an educational analysis. Collected because they are the input the analysis engine requires.
Supplement inputs. Supplement or vitamin names you add, for the same purpose.
Other free-text health inputs. Any additional text you choose to type into an input field. We ask you not to include information you do not want stored.
Derived educational findings. The nutrient relationships, body-system findings, severity signals, citations, and narrative text our knowledge engine generates from your inputs, saved so you can reopen the report you requested (and, if purchased, keep access to it).
Optional feedback. If you rate a preview, we store your ratings, the counts of items analysed, and any comment you write. This record is not linked to your account or to a specific report.

What we do not collect

MyDeficiencies does not collect biometric identifiers, precise geolocation, genetic data, diagnoses, prescription records from pharmacies or insurers, or health records from third parties.

3. Where consumer health data comes from

All of it comes from you, directly, through the analysis form on this website — or is derived by our own knowledge engine from what you entered. We do not buy health data, and we do not receive it from data brokers, pharmacies, insurers, employers, or advertising networks.

4. How we use it

To generate the educational report you requested.
To save that report so you can reopen it, and so a purchased report stays available to you.
To avoid regenerating an identical report for you, which reduces unnecessary processing.
To operate, secure, debug, and improve the accuracy of the knowledge engine, using the minimum data necessary.
To comply with law and to protect against fraud, abuse, and security incidents.

We do not use consumer health data for advertising, profiling for marketing, or any purpose unrelated to providing the service you asked for.

5. Sharing and categories of processors

We do not share consumer health data with third parties for their own purposes. A limited number of service providers process it on our behalf, under contract, only to deliver the service:

Cloud application and database infrastructure — stores your inputs and generated report so the service can function.
AI model processing (Lovable AI Gateway, routing to third-party models) — receives medication and supplement names plus knowledge-base context to draft the educational narrative. It does not receive your name, email, account ID, or payment information.
Hosting and content delivery — transmits pages and API responses.

Payment processing does not receive your health data

Our payment processor, Stripe, receives order, amount, and contact details necessary to take payment. It does not receive your medication inputs or your report contents.

We cannot make representations about third-party model providers' internal retention or training practices beyond what our provider agreements state. Where we have not verified a practice, we say so rather than promising zero retention. See AI and model processing in the Privacy Policy.

6. No sale and no health-data advertising

MyDeficiencies does not sell consumer health data, and does not share it for targeted or cross-context behavioural advertising. We do not operate advertising pixels or third-party advertising trackers on this site, and no health-related values are transmitted to any analytics provider.

7. Retention and deletion

Reports and their inputs are retained so you can return to them. Purchased reports are retained for as long as your access to them lasts.
You may request deletion of your reports and health inputs at any time (see below).
Where you request account deletion, we review and action the request, and confirm when it is complete. Certain records — payment and accounting records, fraud and security logs, and records we must keep by law — are retained even after health data is removed.
Deleted data may persist briefly in encrypted backups until those backups rotate out of retention. We do not claim instantaneous erasure from every backup copy.

Deletion timing

We aim to action verified deletion requests without undue delay and within the timeframe required by applicable law. A formal, published service-level timeframe is a business policy decision that has not yet been finalised; until it is, we will confirm timing with you directly when you make a request.

8. Exercising health-data rights

Depending on where you live, applicable law may give you rights to confirm whether we process your consumer health data, to access it, to correct it, to delete it, to obtain a copy, and to withdraw consent. We honour access, correction, deletion, and copy requests for consumer health data for all MyDeficiencies users, regardless of state.

Start a request on the Privacy Request page, or read more about state-specific rights on State Privacy Rights.

9. Consent and withdrawing consent

Before an analysis is generated, you affirmatively acknowledge what MyDeficiencies is and is not, and you agree to our policies. Submitting medication and supplement names is how you ask us to produce the report, so that processing is necessary to provide the service you requested.

We do not use your consumer health data for any secondary purpose that would require a separate affirmative consent. If that ever changes, we will ask for that consent separately — not bundled into the Terms of Service.

You can withdraw consent by asking us to delete your health inputs and reports and by not submitting further inputs. Withdrawal does not affect processing already carried out and does not undo a completed purchase.

10. Appealing a denied request

If we decline a privacy request, we will tell you why. Where applicable law provides an appeal right, you may appeal by replying to our decision or emailing hello@mydeficiencies.com with the subject line "Privacy Appeal". We will review the appeal and respond in writing with the outcome and, where required, information about contacting your state attorney general.

11. Contact

Questions about this policy: hello@mydeficiencies.com or the contact form.