Privacy, practically

The full story lives at What we store. This page is the practical version.

The core design

Your vault contains health data, not identity. Original documents are never kept: lab PDFs — and genetic and gut-microbiome reports — are deleted after their values are extracted (you confirm each one first); medical records are stored as sanitized text — you review exactly what's kept and what was removed ("2 names · 1 address · 1 phone"), and the original is permanently deleted with a visible receipt on the record. Purchase receipts aren't stored either — the cost entry (vendor, amount, date) is the record.

Names, addresses, contact details, insurance/patient numbers and full birth dates never enter your record — stripped by the sanitizer and caught by a second, deterministic filter.

Using COHORT pseudonymously

If you want the account itself to carry no identity:

1. Sign up with an alias email — any working address; it's for login, not identity.
2. Skip the name — the name field is optional; use a nickname or nothing.
3. Birth year only — sign-up asks for your date of birth to check you're 18 or over, then keeps only the year. COHORT never stores a full birth date; age ranges work fine on the year.
4. Choose your share name — nothing is public unless you publish an experiment result, and you pick the name that appears on it.

Honest limits: login needs a working email, connecting Whoop links that OAuth account, and our providers keep operational logs for up to 30 days (see Deleting everything). The promise is precise — the *health record* carries no identity.

AI and your data

When you upload a report, or type or paste text for COHORT to read into your record, the content is processed transiently by our AI provider (Anthropic) to read it for that one request. Nothing else sends your data to Anthropic. It is not used to train models, and per everything above, we don't retain the documents afterwards. Processing is not storage; we won't pretend otherwise.

Deleting everything

Deleting your account is self-serve, under Settings → Privacy & consent → Delete account: every row you own, every file in your private storage and your waitlist entry are removed, with no soft-delete copy. If the deletion can't finish, for example because a file couldn't be removed, your account is kept so you can try again. Part of it may already have happened by then: your data permissions withdrawn, connected wearables disconnected, and some files removed. Some copies sit outside our database and are not removed at that moment. Each ages out on its own schedule, and none can be shortened from our side:

• Database backups: up to 7 days.
• Database logs of requests and sign-ins, at our database provider: up to 7 days.
• Hosting logs of requests, at our hosting provider: up to 30 days.
• Emails we sent you and their delivery logs, at our email provider: up to 30 days, plus up to 7 days in its backups.
• AI requests, at our AI provider: up to 30 days. A request its safety systems flag as breaking its usage policy is kept for up to 2 years, and its safety score for up to 7 years.