Health Data Policy

Is Syndova Health HIPAA compliant?

Syndova Health is a direct-to-consumer wellness app and is not a HIPAA covered entity. HIPAA (the U.S. Health Insurance Portability and Accountability Act) applies to healthcare providers, health plans, healthcare clearinghouses, and the business associates that handle protected health information on their behalf. We do not bill insurance, we are not a provider, and we do not receive records from covered entities. The information you enter here is consumer health data, not HIPAA-regulated PHI.

We do not claim HIPAA certification — no such certification exists — and we have not undergone a HIPAA audit. What we do instead is described below: we have organized our safeguards around the same three categories HIPAA's Security Rule uses, because it is a well-understood framework for protecting health information.

If you are a clinician, employer, or health plan considering Syndova Health for patients or members, contact support@syndovahealth.com before uploading any patient data. We would need a Business Associate Agreement in place first, and we will tell you plainly whether we can support it.

What health data we hold

• Food photos you capture and the AI-estimated calories, macros and blood-sugar impact derived from them.
• Body scan photos and estimated body composition (body fat percentage, BMI).
• Body measurements — weight, height, chest, waist, thigh circumference.
• Goals, water intake, activity entries and fasting windows.
• Account data: email address and authentication timestamps.

Administrative safeguards

• Access to production data is limited to the smallest number of people needed to operate the service.
• Health data is used to provide the features you request and to keep the service running — not sold, and not shared with advertisers.
• Third parties that process data on our behalf are limited to infrastructure, AI analysis, email delivery, and payment processing. They are listed in our Privacy Notice.
• If we become aware of a breach affecting your data, we will notify affected users and any authority required by applicable law.

Physical safeguards

• We operate no physical servers of our own. Data is stored with managed cloud infrastructure providers in access-controlled data centres.
• Photos and entries are stored in the cloud, not left on shared or personal devices by our team.

Technical safeguards

• All traffic between your device and our servers is encrypted in transit over TLS.
• Data is encrypted at rest by our infrastructure provider.
• Row-level security is enforced in the database: every health record is scoped to the account that created it, so one user's queries cannot return another user's data.
• Authentication uses hashed passwords, and we check new passwords against known-breached password lists.
• Server-side authorization is re-checked on every request — we never trust the browser to decide access.

Retention and deletion

• You can delete individual meal entries and photos from within the app at any time.
• We retain your account and health data for as long as your account is active.
• On account deletion, we delete or anonymize your data within 30 days, except where retention is required by law (for example, payment records held by our Merchant of Record).

Your choices

• Health tracking is opt-in feature by feature — you can use food scanning without body scans, or vice versa.
• You may request access to, correction of, export of, or deletion of your data by emailing support@syndovahealth.com.
• U.S. state consumer health data laws (such as Washington's My Health My Data Act) and UK/EEA GDPR rights are covered in our Privacy Notice.

Not medical advice

Calorie estimates, macros, glycemic impact scores, body composition estimates and meal plans produced by Syndova Health are informational only, may be inaccurate, and are not medical, nutritional or clinical advice. Consult a qualified professional before making health decisions.

Contact

Security or privacy questions, including vulnerability reports: support@syndovahealth.com. Please do not include health data or credentials in your first message.