Privacy Policy

COHORT (“we”, “us”) operates the COHORT web application at app.cohort.study. For privacy questions or to exercise your rights, contact us at privacy@cohort.study. We are the data controller for the personal data described here.

Our public website, cohort.study, is a set of information pages. It sets no cookies, uses no third-party analytics or advertising tools and has no forms: requesting an invite and signing in happen here, on app.cohort.study. To tell visitors outside the US that COHORT is only available there for now, it uses the country our hosting provider works out from your IP address, only to choose that version of the page, and doesn’t keep it.

Account data — your email, name, and authentication details, so you can sign in and we can contact you about your account; and your confirmation that you are 18 or older and the US state you live in, which decide whether you can join. You can change your state in Settings. During sign-up we also ask for your date of birth to check that you are 18 or older; we keep only the year, never the full date.

Questions at sign up. During sign up we ask whether you are pregnant or breastfeeding, because COHORT’s experiments are not designed for pregnancy or breastfeeding. We use the answer only to decide whether you can continue, and we do not save it.

Waitlist requests — when you request an invite, your name or nickname, your email, the US state you live in and your confirmation that you are 18 or older (we keep the state, not the confirmation); whether and when you confirmed your email; and any optional answers you give, such as what you are trying to optimize, what you track with, how many self-experiments you have run, when you last did bloodwork, what you spend on your health stack, one experiment you want to run and how you heard about us. We use them to review requests. You can remove your request with the link in our emails, or by writing to us.

Health data you provide — anything you choose to add: lab panels and marker values, uploaded lab/DNA/microbiome report files, medications and supplements, conditions, allergies, family history, body measurements, nutrition, and the notes you write. You decide what to add; you can skip any of it. Genetics isn’t available yet: uploading a DNA report is switched off until it has a consent of its own.

Questions before an experiment. Before you start an experiment, we ask whether any of its exclusions apply to you and which groups of medicines you take. Your answers are checked on your device and are not sent to or stored by COHORT. If your health record lists medicines or supplements, the app uses them to pre-fill the medicine groups, and nothing about that match is stored.

Connected devices — if you connect a wearable (e.g. Whoop), we store the access tokens needed to sync, the metrics returned (HRV, sleep, recovery, workouts), and your sleep and recovery records as the device provides them — for example sleep and wake times, naps, sleep stages, breathing rate, blood oxygen and skin temperature. We keep those records so an experiment can measure your baseline. You can disconnect at any time.

Usage data — basic logs needed to operate and secure the service (e.g. request timestamps, errors). We do not sell your data or run third-party advertising trackers.

To run the product for you: structure experiments, grade your markers, build your daily checklist, read the reports and text you give us into your record with AI, sync connected devices, and send the emails you’ve enabled. We use your data to provide these features to you — not to profile you for advertisers.

Where GDPR/UK GDPR applies, we rely on: contract (to provide the service you signed up for); consent (for processing health data, which is a special category — you give explicit consent by adding it, and can withdraw it by deleting the data or your account); and legitimate interests (to secure and improve the service). You can withdraw consent at any time without affecting prior processing.

We use a small set of trusted providers to run COHORT. Each processes data only to provide their service to us:

• Supabase — database, authentication, and encrypted file storage (your account and all health data).
• Vercel — application hosting and delivery.
• Anthropic (Claude) — reads what you give it to read: the reports you upload (lab reports including DEXA and smart-scale, DNA, microbiome and food-sensitivity tests, medical records), the health background you type in, and a lab booking you paste. Nothing else we do sends your data to Anthropic. What you send is processed for that request; it is not used to train their models.
• Resend — transactional and digest email delivery.
• Amazon Web Services (AWS) — runs the statistics behind curated experiments: your baseline and the analysis at the end of a run. For that it receives your sleep and recovery records and the dates and answers the calculation needs, never your name, email or account. It processes them only to work out the result it sends back to us, and does not store them.
• Whoop and other device providers you explicitly connect — to sync your own wearable data.

Your data is private by default. We do not sell it, and nothing is shared publicly unless you choose to — for example, publishing a share page for one experiment. Community/“cohort” comparison features, as they roll out, will use anonymized, aggregated data on an opt-in basis only; you control, marker by marker, what you ever contribute.

Almost everything COHORT stores for you — lab results, genetic and microbiome reports, conditions, medications, supplements, wearable metrics, journal entries — is consumer health data in the sense used by US state health-privacy laws such as Washington’s My Health My Data Act. Our position on it is simple:

• We do not sell your consumer health data, and we will never sell or share it without first asking you for a separate, explicit authorization — distinct from accepting our terms — that you can decline or revoke.
• We share it only with the service providers listed above, and only so they can run the product for you — never for their advertising or their own purposes.
• We collect only what the features you use actually need, and you can see, export, and delete all of it.

Washington residents (and residents of states with similar laws) may exercise the rights described under “Your rights” by emailing us; we honor them for everyone regardless of state.

We keep your data for as long as your account is active. When you delete your account, we delete your personal data from our systems, and request deletion from sub-processors, except where we must retain limited records to meet legal obligations. Backups are purged on a rolling schedule.

You can access and export your data (Settings → export a full JSON copy), correct it by editing in-app, and delete your account and data. Where GDPR/UK GDPR or CCPA applies, you also have rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority. To make a request, email privacy@cohort.study.

Data is encrypted in transit and at rest. Access is scoped per-user by row-level security, uploaded files live in private, per-user storage, and administrative access is restricted. No system is perfectly secure, but we design to minimize what’s exposed if something goes wrong.

Our providers may process data in the US and other countries. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

COHORT is not intended for anyone under 18, and we do not knowingly collect data from children. If the date of birth given during sign-up shows someone is under 18, we delete the account and its waitlist entry at once.

We’ll update this policy as the product evolves and note the date at the top. Material changes will be communicated in-app or by email.

Questions or requests: privacy@cohort.study.