Sylvia App Privacy Notice

This notice covers the Sylvia check-in app, on the web at app.sylviaprecision.health and on iPhone. It explains, in plain language, what the app collects and what happens to it. Our full Privacy Policy covers the rest of Sylvia Precision Health's website and services.

1. What the Sylvia app is

Sylvia is a clinical research tool. Several times a day it asks you short questions about your thoughts, feelings and eating-related behaviors. This is called ecological momentary assessment. Your answers help you and your care or research team see how things change over time.

The app is invitation-only. You join with an invite code from the Sylvia team. Sylvia does not diagnose or treat anything, and it is not monitored in real time.

If you are in crisis or thinking about harming yourself, do not use Sylvia to get help. In the US, call or text 988 (Suicide & Crisis Lifeline), or call 911.

2. What we collect

• Your name and email address, from your invitation and when you create your account.
• Your password, handled entirely by our sign-in provider (Google Firebase Authentication). Sylvia staff never see it.
• Your check-in responses: your answer to each question, usually a rating from 0 to 100, sometimes a multiple-choice answer or words you type yourself, or a note that you skipped it; when you answered; and which scheduled check-in it belonged to. This is health information.
• Check-in records: when each check-in started and finished, and how many questions you answered.
• An account ID that links these together.
• Crash reports: if the app runs into an error, a short technical report of what went wrong, with web addresses, email addresses, invite codes and sign-in details removed and no account ID attached, used only to find and fix problems.

On your device, the app keeps you signed in and stores a few small settings. Check-in reminders are scheduled on your phone itself.

The app does not collect:

• your location, contacts or photos;
• advertising identifiers;
• any data for advertising or for tracking you across other apps and websites.

It contains no advertising or third-party analytics.

3. How we use it

• To run your check-ins and show you your history.
• To let the Sylvia team members responsible for your care or study review your responses.
• To send account emails, such as your invitation and password resets.
• For research, using de-identified data only, to improve Sylvia and its clinical methods.

We do not sell your information. We do not use it for advertising, and we do not share it with data brokers, insurers or employers.

4. Who can see it

Sylvia team members see your information only through Sylvia's admin console. Access is limited by role: some team members can only view data, and only a few can change settings or manage the team. Key administrative actions are logged.

Service providers process data only on our behalf, and only to run the service:

• Google Firebase stores the data and handles sign-in.
• Vercel hosts the web app.
• Resend delivers account emails.

We may also disclose information when the law requires it.

5. How it is stored and protected

Your information is stored in Google Cloud Firestore and Firebase Authentication. It is encrypted in transit, over HTTPS, and encrypted at rest by Google.

Database rules make sure your account can read and write only your own check-in data. Team access goes through the admin console and its role checks. No method of storage or transmission is perfectly secure, but we work to protect your information with these safeguards.

6. How long we keep it

We keep your information while your account is active and for as long as your care or study needs it.

When you delete your account in the app, we immediately delete your profile, check-in responses, check-in records, schedule and login. We keep a small administrative record:

• the invitation that was sent to you, marked as deleted, with your name and email address removed;
• entries in our administrative log noting that you were invited and that your account was deleted, including your name and email address.

We keep these so we can show who was invited and when an account was removed. If you ask us by email to delete your information, we will do so within 30 days, unless the law requires us to keep it. De-identified research data, which can no longer be linked to you, may be kept.

7. HIPAA, in plain language

HIPAA is a US law that protects health information held by healthcare providers, health plans, and the companies that work on their behalf. Whether HIPAA applies to your Sylvia information depends on how you came to use Sylvia.

If a clinician or program covered by HIPAA invited you, their HIPAA obligations apply to how they use your information.

Either way, we build Sylvia around the same kinds of safeguards HIPAA expects:

• encryption;
• access limited by role;
• logging of administrative actions;
• never selling health data.

There is no official "HIPAA certification", and we do not claim one. If you have questions about how HIPAA applies to your situation, contact us.

8. Your choices

• See or correct your information: contact us and we will help.
• Delete your account and data: in the Sylvia app, go to Settings and choose Delete my account. This deletes your account and check-in data right away; section 6 explains the few records we keep. You can also ask us by email.
• Reminders: you can turn check-in notifications off at any time in your phone's Settings.
• Stop participating: you can stop using Sylvia at any time.

9. Children

Sylvia is for adults 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

10. Changes to this notice

If we change what the app collects or how we use it, we will update this notice and the date at the top. For significant changes, we will also let you know in the app or by email.

11. Contact us

Questions or requests about your information:

Sylvia Precision Health
Louisville, Kentucky
Email: privacy@sylviaprecisionhealth.com