What we can and cannot see
Your family record is encrypted on your device before it reaches our servers, under a key derived from a passphrase we never receive. What our servers hold is ciphertext, your email address in readable form (to send you email), the name you gave for your account if you gave one, a hash of your email for sign-in lookup, sign-in times, billing state and counts for internal reporting (your account ID, when you signed up, whether you pay, the emails we sent you and, only if you turned on usage data, the days you used the app and how many records and relatives your family added). Nothing readable about any relative. An employee with full admin access sees the same. The security white paper lists every field, names what each adversary could learn, and states the cost of that design: lose both your passphrase and your recovery code and the record is gone, because there is no key on our side to recover it with.
We don't sell your data or license it to anyone. Subscriptions are how we are paid.
AI help is off until you turn it on
Deeper insights, condition auto-fill and report scans use Google Vertex AI. With AI help on, your device sends Google the text the feature needs: conditions, symptoms, ages and relationships with names removed, the condition name you type, or the report you scan, as it is. Google processes it in the United States. Insights and scanned reports go from your device to Google, not through our servers. Turn AI help off in Settings and nothing more is sent.
Crash reports are sent to our processor Sentry even if analytics is off. They contain the error, the app version and your device and OS version, and no health data and no account identifier. If you turn analytics on, crash reports also include your account ID and the steps that led to the crash.
What GINA does and doesn't cover
The Genetic Information Nondiscrimination Act of 2008 (GINA) protects against health-insurance and employment discrimination based on family medical history. It is the reason a positive family history of cancer cannot be used by a health insurer to raise your premium or deny coverage, and it is the reason employers (15+ employees) cannot use it in hiring or promotion decisions.
GINA does not extend to life insurance, long-term-care insurance, or disability insurance. It also does not apply to the military or to employers with fewer than 15 employees. Some U.S. states (Florida and California among them) extend additional protections, but coverage is patchy.
Practically: when you share family history with a clinician, that information may enter your medical record and could be discoverable in life, LTC, or disability insurance underwriting via routine medical-records requests. This is a consequence of where the data flows once it leaves the app — not of how we handle your data inside the app.
You can read more about how we use clinical guidelines and AI to surface insights on our methodology page.
Full privacy policy
The full privacy policy is available as a PDF: Download Privacy Policy (PDF) .
Questions?
Reach the team at [email protected].