Privacy

Your vault contains health data — not identity

Most health apps store your documents and promise to protect them. COHORT takes the stricter path: we extract the health data and refuse to keep the rest. A breach of something we never stored is impossible — that’s the whole design.

What’s in your vault

✓

Your marker readings

values, units, dates, reference ranges — the numbers themselves

✓

Your experiments

protocols, hypotheses, measurements, the days you log as taken, reduced, skipped or paused, outcomes

✓

Wearable metrics

HRV, sleep, recovery, workouts — numbers from devices you connect, and the sleep and recovery records behind them as the device provides them (for example sleep and wake times, naps, breathing rate, blood oxygen, skin temperature), kept so an experiment can measure your baseline

✓

Your journal & notes

the daily factors and reflections you choose to log

✓

Sanitized report content

the health substance of documents you add — as plain text you reviewed line by line

✓

Structured health context

conditions, allergies, medications, family history — as you entered them

What never enters it

Your original documents

lab PDFs, doctors' letters, scans, genetic & microbiome reports — deleted after extraction, with a visible receipt

Receipts & invoices

the purchase entry (vendor, amount, date) is the record — the file itself is not kept

Names inside documents

yours, your physicians', anyone's — stripped before anything is saved

Addresses, phones, emails from reports

removed by the sanitizer and blocked by a second, deterministic filter

Insurance, patient & case numbers

never extracted, never stored

Your data for advertising

we don't sell data, run ads, or share your records with third parties

The one exception that stays as a file, because it is the data: your profile picture — taken by you, of you, and deletable anytime.

Genetics isn’t available yet: uploading a DNA report is switched off until it has a consent of its own.

How a document upload actually works

When you add a medical report — a lab PDF, a discharge letter, an MRI result:

The file is uploaded to a transient, private area — not your record.
The health content is extracted and restructured; identifying details are counted and left out. Nothing is redacted-in-place — the content is re-rendered from scratch, so nothing hidden in the original file can survive.
You review the result: “Removed: 2 names · 1 address · 1 phone number” plus every line that will be kept. What you see is everything there is.
On save, the sanitized text enters your record and the original is permanently deleted — each record carries its deletion receipt. Cancel instead, and the upload is discarded entirely.

Using COHORT pseudonymously

Because the vault holds no identity, you can run COHORT under a pseudonym if you want to:

No real name required. The name field is optional — a nickname or nothing at all; your display name and handle are whatever you choose.
Birth year, never birth date. Sign-up asks for your date of birth once, to check you’re 18 or over, and keeps only the year. Age matters for health ranges; the exact date only identifies you — so we don’t store one, anywhere.
Any email works — including an alias or a dedicated address that isn’t linked to you. It’s used to log you in, not to identify you.
Sharing is opt-in and curated. Nothing about you is public unless you publish a result — and you choose the name on it.

The honest limits. Pseudonymity is a posture, not magic. Logging in requires a working email; connecting a wearable links that provider’s account; our providers keep operational logs for up to 30 days (as all servers do). What we can honestly promise: the health record itself carries no identity, and we collect nothing about you that the product doesn’t visibly use.

When data leaves your account

AI processing. When you upload a report, or type or paste text for COHORT to read into your record, the content is processed transiently by our AI provider (Anthropic) to read it for that one request. Nothing else sends your data to Anthropic. It isn’t used to train models, and — per everything above — the original document is never retained by us afterwards. Processing is not storage, and we won’t pretend otherwise.
Experiment statistics. For a curated experiment, your baseline and the analysis at the end of the run are worked out on Amazon Web Services: your sleep and recovery records and the dates and answers the calculation needs go there for that one calculation, without your name, email or account, and are not stored there.
Aggregate signals. Community comparisons use anonymous, aggregate-only statistics that must rest on at least 11 members before they’re shown to anyone — including you.
Nothing else. No data sales, no ad networks, no third-party analytics on your health record.

Before you have an account

Requesting an invite keeps a waitlist entry: your name or nickname, your email, your US state, whether you confirmed your email, and the optional answers you chose to give. It sits apart from any account and only our team can read it. The remove link in our emails deletes it at once. If there is none, or it no longer works, write to privacy@cohort.study and we will.

Deleting everything

Account deletion is self-serve: every row you own, every file in your private storage and your waitlist entry are removed. There is no “soft delete” copy waiting around. If the deletion can’t finish, your account is kept so you can try again, though part of it may already have happened: data permissions withdrawn, wearables disconnected, some files removed. Some copies sit outside our database and are not removed at that moment. Each ages out on its own schedule, and none can be shortened from our side:

Database backups: up to 7 days.
Database logs of requests and sign-ins, at our database provider: up to 7 days.
Hosting logs of requests, at our hosting provider: up to 30 days.
Emails we sent you and their delivery logs, at our email provider: up to 30 days, plus up to 7 days in its backups.
AI requests, at our AI provider: up to 30 days. A request its safety systems flag as breaking its usage policy is kept for up to 2 years, and its safety score for up to 7 years.

This page describes how COHORT is engineered, in plain language. The legal version lives in the Privacy Policy; how we grade a result is explained in Methodology. Questions or a hole in our reasoning? We genuinely want to hear it — notifications@cohort.study.