Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use your information to:

• Provide and improve our health and wellness services
• Generate AI-powered insights and recommendations
• Create personalized daily routines
• Process payments and manage subscriptions
• Send notifications about your health goals and routines
• Enable social features and community interactions
• Detect and prevent fraud or security issues
• Comply with legal obligations
• Analyze platform usage to improve user experience

3. How We Protect Your Data

We implement industry-standard security measures:

• Encryption at Rest: Sensitive health data is encrypted using AES-256-GCM
• Encryption in Transit: All data transfers use HTTPS/TLS
• Password Security: Passwords hashed with bcrypt
• Audit Logging: HIPAA-style access tracking for sensitive data
• Secure Infrastructure: Hosted on Vercel and Neon PostgreSQL with built-in security
• Regular Updates: Security patches and monitoring

4. When We Share Your Information

We do NOT sell your personal or health data. We may share information:

• With Your Consent: When you choose to share posts, routines, or health metrics publicly
• Service Providers: Third-party services that help us operate (hosting, analytics, payment processing)
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In case of merger, acquisition, or asset sale
• Safety & Security: To protect rights, property, or safety of users and the public

5. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your data in a portable format
• Opt-Out: Disable notifications, marketing emails, or analytics
• Privacy Settings: Control who can see your health data and social content

To exercise these rights, contact us at privacy@healthopenpage.com

6. Data Retention

We retain your data as follows:

• Active Accounts: Data stored indefinitely while your account is active
• Deleted Accounts: Personal data deleted within 30 days of account deletion
• Backup Retention: Encrypted backups retained for 90 days for disaster recovery
• Legal Requirements: Some data may be retained longer to comply with legal obligations
• Anonymized Data: Aggregated, anonymized analytics may be retained indefinitely

7. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Essential Cookies: Authentication, session management, security
• Analytics: Privacy-friendly usage tracking via self-hosted Umami (no third-party trackers)
• Preferences: Remember your settings and language preferences

You can control cookie preferences in your browser settings. Disabling essential cookies may limit functionality.

8. HIPAA & Regulatory Compliance

OpenPage Health is NOT a HIPAA-covered entity.

We are a wellness platform, not a healthcare provider. Your health data is voluntarily self-entered and not subject to HIPAA protections. However:

• We implement HIPAA-style security measures (encryption, audit logs)
• We comply with the FTC Health Breach Notification Rule
• We follow GDPR principles for European users
• We adhere to CCPA requirements for California residents

For more details, see our Health & Medical Disclaimer

9. Children's Privacy (COPPA Compliance)

OpenPage Health is NOT intended for children under 13 years old.

• We do not knowingly collect data from children under 13
• If we discover a child's account, we will delete it immediately
• Parents who believe their child has created an account should contact us

10. International Data Transfers

OpenPage Health is based in the United States. Your data may be transferred to and processed in the US or other countries where our service providers operate.

By using our platform, you consent to international data transfers. We ensure adequate protection through:

• Standard contractual clauses (EU users)
• GDPR-compliant data processing
• Security measures across all jurisdictions

11. Data Breach Notification

Per the FTC Health Breach Notification Rule, we will notify you within 60 days if:

• Unauthorized access or disclosure of your health information occurs
• A data security breach affects your account
• Your personal health information is compromised

Report security concerns to: security@healthopenpage.com

12. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be:

• Posted on this page with a new "Last Updated" date
• Communicated via email for material changes
• Effective immediately upon posting (unless otherwise stated)

Continued use of the platform after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions or requests, contact:

• Privacy Inquiries: privacy@healthopenpage.com
• Security Issues: security@healthopenpage.com
• General Support: support@healthopenpage.com