Privacy Policy

1. Information We Collect

Livaramed collects the following categories of information to provide our medical companion service:

Account Information

• Name and email address — used for account creation, login, and communication
• Password — stored as a bcrypt hash (we never store or see your plaintext password)
• Two-factor authentication secrets — encrypted TOTP secrets for 2FA, if enabled
• Account preferences — communication style, display settings, notification preferences

Medical Data

• Conversation transcripts — your messages with Livaramed and Livaramed's responses
• Knowledge base entries — conditions, medications, lab results, symptoms, hypotheses, and other structured medical data that you provide or that Livaramed extracts from your conversations and uploads
• Uploaded documents — lab result images, PDFs, and other medical documents you choose to upload
• Symptom logs — daily symptom severity ratings, medication adherence records, and mood journal entries
• Analysis results — diagnostic analyses, treatment protocols, and other AI-generated reports

Usage Data

• Session information — login timestamps, session duration, and feature usage patterns
• Error logs — technical error reports to help us identify and fix issues
• Performance metrics — page load times and API response times (aggregated, not personally identifiable)

Device Information

• Browser type and version — for compatibility and security purposes
• Operating system — for compatibility purposes
• IP address — for security (login anomaly detection) and rate limiting; not used for tracking

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service

• Generating personalized AI responses based on your medical history and knowledge base
• Maintaining your persistent medical memory across conversations
• Processing uploaded lab results and medical documents
• Generating diagnostic analyses, treatment protocols, and health tracking reports
• Sending medication reminders and notification emails you've opted into

Improving the Product

• Analyzing aggregated, de-identified usage patterns to improve features
• Identifying and fixing bugs and performance issues
• Understanding which features provide the most value to users

Security

• Detecting and preventing unauthorized access and abuse
• Monitoring for suspicious login activity and alerting you to new device logins
• Maintaining audit logs for security review

3. Data Storage & Security

We take the security of your medical data extremely seriously. Here's how we protect it:

Encryption at Rest

• AES-256-GCM encryption for all sensitive data stored in our database, including conversation transcripts, medical knowledge base entries, symptom logs, and analysis results
• Each encryption operation uses a unique initialization vector (IV)
• Encryption keys are stored separately from encrypted data

Database Security

• PostgreSQL database with encrypted connections
• Database access restricted to application service accounts only
• Regular automated backups encrypted before storage

Backup & Recovery

• Encrypted backups stored in Amazon S3 with server-side encryption (SSE-S3)
• Backup retention follows our data retention policy
• Regular backup integrity verification

Password Security

• Passwords hashed with bcrypt (adaptive cost factor)
• Plaintext passwords are never stored, logged, or visible to staff
• Password reset tokens are time-limited and single-use

Infrastructure

• HTTPS/TLS encryption for all data in transit
• Regular security updates and patching
• Firewall and intrusion detection systems

4. AI Processing

Livaramed uses artificial intelligence to provide medical companion services. Here's how your data interacts with AI systems:

AI Provider

• Livaramed uses Anthropic's Claude API (Sonnet and Opus models) for natural language processing, medical analysis, and response generation
• Your medical context (knowledge base, conversation history, symptom data) is sent to the Claude API as part of each request to provide personalized responses

Prompt Caching

• We use Anthropic's prompt caching feature to reduce latency and cost for repeated context
• Cached prompts are stored temporarily by Anthropic and are subject to their data handling policies

Data Retention by AI Provider

• Per Anthropic's API Terms of Service, data sent via the API is not used to train Anthropic's models
• Anthropic may temporarily retain API inputs/outputs for abuse monitoring and safety purposes (typically 30 days)
• We have reviewed Anthropic's data handling practices and trust their commitment to API customer data privacy

5. Data Sharing

We Do NOT Sell Your Data

We do not sell, rent, lease, or trade your personal information or medical data to any third party. Period. This applies to all data categories — account information, medical data, usage data, and device information.

Sub-Processors

We use a limited number of third-party services to operate Livaramed. Each has been evaluated for their data handling practices:

• Anthropic (Claude API) — AI processing for conversations and analysis. Data not used for model training.
• Amazon Web Services (S3) — Encrypted backup storage. Data encrypted at rest with SSE-S3.
• Postmark — Transactional email delivery (medication reminders, password resets, security alerts). Receives only email addresses and message content necessary for delivery.
• Sentry — Error monitoring and performance tracking. Receives technical error data only; personal medical data is scrubbed before transmission.

Legal Disclosure

We may disclose your information if required by law, subpoena, or court order. In such cases, we will notify you unless legally prohibited from doing so, and we will challenge overly broad requests.

6. Your Rights

You have the following rights regarding your data:

Right to Access

You can view all data Livaramed holds about you at any time through your account dashboard, including your knowledge base, conversation history, symptom logs, and analysis reports.

Right to Export

You can export your complete data set as JSON at any time from your account settings. This includes your knowledge base, conversation transcripts, symptom logs, medication records, and analysis results.

Right to Deletion

You can delete your account and all associated data at any time. Deletion is permanent and cascades to all related records: conversations, knowledge base entries, symptom logs, uploaded documents, analysis results, and session data. Encrypted backups containing your data will be purged according to our backup rotation schedule (maximum 90 days).

Right to Correction

You can edit your knowledge base, update your account information, and correct any data through the application interface at any time.

Right to Restrict Processing

You can disable specific features (e.g., medication reminders, mood tracking) without deleting your account. Contact us if you need to restrict processing in ways not available through the interface.

7. Cookies & Sessions

Session Cookies

Livaramed uses httpOnly, secure session cookies for authentication. These cookies:

• Are marked httpOnly (not accessible to JavaScript, preventing XSS attacks)
• Are marked secure (transmitted only over HTTPS)
• Use the SameSite=Strict attribute (preventing CSRF attacks)
• Expire when you close your browser or after an inactivity timeout

What We Don't Use

• No third-party tracking cookies
• No advertising cookies or pixels
• No analytics cookies (Google Analytics, etc.)
• No social media tracking pixels

Because we use only essential session cookies, no cookie consent banner is required. However, we disclose their use here for full transparency.

8. Children's Privacy

Livaramed is not intended for use by individuals under the age of 18 without the involvement and consent of a parent or legal guardian.

• Users must be at least 18 years of age to create an account independently
• A parent or legal guardian may create and manage an account on behalf of a minor for the purpose of managing the minor's health information
• The parent or guardian is responsible for all account activity and data provided
• We do not knowingly collect personal information from children under 13 without verifiable parental consent

If you believe a child under 13 has provided us with personal information without parental consent, please contact us immediately at support@brownias.com and we will promptly delete the information.

9. Data Retention

Active Accounts

For active accounts, we retain all data for as long as your account exists. Your medical memory, conversation history, and tracking data grow over time — this is by design, as longitudinal data is what makes Livaramed valuable.

Account Deletion

When you delete your account:

• All account data is permanently deleted from our primary database immediately
• Encrypted backups containing your data are purged within 90 days per our backup rotation schedule
• De-identified, aggregated analytics data (which cannot be linked back to you) may be retained

Inactive Accounts

• Accounts with no login activity for 24 months will receive an email notification
• If no action is taken within 30 days of notification, the account and all associated data may be permanently deleted
• You can prevent this by logging in at least once within the notification period

Downgraded Accounts

• If you downgrade from a paid plan to Free, premium-tier data (diagnostic analyses, treatment protocols) is retained in read-only mode for 90 days
• After 90 days, premium-tier data is permanently deleted unless you resubscribe
• Core data (conversations, knowledge base, symptom logs) is not affected by plan changes

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• Material changes (changes to data collection, sharing, or security practices) will be communicated via email to all registered users at least 30 days before they take effect
• Minor changes (clarifications, formatting) will be reflected in the "Last Updated" date at the top of this page
• Continued use of Livaramed after changes take effect constitutes acceptance of the updated policy
• If you disagree with changes, you may export your data and delete your account before the effective date

11. California & State-Specific Rights

California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

• Right to Know: You can request a detailed disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: You can request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out of Sale: We do not sell your personal information. No opt-out is necessary, but we affirm this right
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

Washington My Health My Data Act (MHMDA)

We are aware of Washington state's My Health My Data Act and its requirements for consumer health data. Our practices are designed to align with MHMDA's principles:

• We collect health data only with your knowledge and for specified purposes
• We do not sell or share health data for advertising
• We provide data access and deletion capabilities
• We use geofencing for no health data facilities (not applicable to our service type)

Other State Laws

We strive to comply with all applicable state privacy laws, including those in Colorado, Connecticut, Virginia, and other states with consumer privacy legislation. If you have state-specific rights questions, please contact us.

12. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, please contact us:

For data subject requests (access, deletion, correction), please email us from the email address associated with your Livaramed account. We will verify your identity before processing any request and respond within 30 days.