Health Center is a personal health assistant operated by Cavenaugh Media. You connect a wearable service, see your own data, and ask questions about it. This page explains what we store, why we store it, and the rights you have over it. Contact: contact@cavenaughmedia.com.
What we store
- Your account: the email address and name you sign up with.
- Health data you connect: workouts, daily activity such as steps, sleep totals, and recovery metrics such as heart-rate variability, resting heart rate, and blood-oxygen — read from the provider account you connect (for example, intervals.icu relaying data from your watch). We only read; we never write to your provider account.
- Provider credentials: the OAuth token or API key that lets us read your provider account, encrypted at rest.
- Chat: the questions you ask and the answers you receive.
Why we store it
- To show you your own data. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
- To answer your questions in chat. Relevant figures from your data are sent to Anthropic, our AI provider, to generate the answer — only when you use the chat, and only under the explicit consent we ask for before you connect a device (GDPR Art. 9(2)(a)).
- Health data is special-category data under GDPR Article 9. We process it solely to show it to you and to answer your questions about it. We do not advertise, we do not sell data, and we do not share it with anyone except the processors listed below.
Who else processes your data
- The provider you connect (for example, intervals.icu) — we read from it on your behalf.
- Anthropic — processes chat requests to generate answers.
- Our hosting infrastructure, where the application and database run.
How long we keep it
- For as long as your account is active.
- Disconnecting a device stops all further reading and withdraws your consent to future AI processing. Data already synced stays visible to you until you delete your account.
- Deleting your account permanently erases your account, health records, chat history, and provider credentials, and revokes our access at the provider where the provider supports revocation.
Your rights
- Access and portability: request a machine-readable export of your data.
- Erasure: request deletion of your account and everything in it.
- Withdrawal of consent: disconnect a device at any time from the Connect page.
- Rectification: your health data comes from your device via your provider; correcting it at the source corrects it here on the next sync.
- Complaint: you can lodge a complaint with your data-protection supervisory authority.
To request an export or erasure, write to contact@cavenaughmedia.com from your account email.
Security
Provider credentials are encrypted at rest. Traffic is encrypted in transit. Every read of health data is scoped to the signed-in account it belongs to.
Cookies
Only the session cookies that keep you signed in. No advertising or tracking cookies.
Changes
When this policy changes, we will update this page and the effective date above.