Sylvia Precision Health ("Sylvia," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It covers our website at sylviaprecision.health and the Sylvia check-in app, on the web at app.sylviaprecision.health and on iPhone (together, the "Services").
If you use the Sylvia app, our shorter Sylvia App Privacy Notice describes the same practices for the app in plain language. If the two ever seem to differ, contact us and we will clarify.
In the Sylvia app
The Sylvia app is invitation-only. When you are invited and when you use the app, we collect:
- Account information: your name and email address, from your invitation and when you create your account; the date you joined; and an account ID that links your records together.
- Your password, which is handled entirely by our sign-in provider, Google Firebase Authentication. Sylvia staff never see it.
- Check-in responses: your answer to each question you are asked about your thoughts, feelings, eating behaviors and related experiences. Most answers are a rating on a slider; some questions are multiple choice, and some let you type your own words. If you skip a question, we record that it was skipped. Each answer is stored with the date and time you gave it and the scheduled check-in it belonged to. This is health information.
- Check-in records: when each check-in started and finished, and how many of its questions you answered.
- Your check-in schedule, which your care or research team sets up for you.
- Crash reports: if the app runs into an error, it sends us a short technical report of what went wrong, with web addresses, email addresses, invitation codes and sign-in details removed and no account ID attached. We use these only to find and fix problems.
Some information stays on your device and is not sent to us: the sign-in that keeps you logged in, your place in a check-in you have not finished, and whether you declined reminder notifications. Check-in reminders on iPhone are scheduled by the app on your phone itself. We do not send them from a server, and we do not collect a notification token for your device.
On our website
- Contact form: your first and last name, email address, the kind of visitor you are, what you are interested in, and your message.
- Workbook updates: your email address, if you ask to be notified about the workbook.
- No analytics or cookies: our website does not use analytics, advertising or tracking tools, and it sets no cookies. Our Cookie Policy has more detail.
Technical information our providers record
Like most online services, the companies that host our website and app and handle sign-in automatically record technical information when your browser or phone connects to them. This includes your IP address, the time of the request, and your browser or device type. These records are used to operate and secure the Services.
What we do not collect
- Payment information. We do not currently take payments online. If we begin to, payments will be handled by a payment processor, and we will update this policy first.
- Analytics or usage tracking, from the Sylvia app or our website.
- Your precise location, contacts, photos, or data from Apple Health.
- Advertising identifiers, or any data used to track you across other companies' apps and websites.
2. How We Use Your Information
We use the information we collect to:
- Run your check-ins, send you reminders, and show you your history
- Let the Sylvia team members responsible for your care or study review your responses
- Prepare your Personalized Recovery Roadmap and related recommendations, if you use a Sylvia service that includes one
- Send account emails, such as your invitation and password-reset messages
- Reply to messages you send us, and send workbook updates you asked for
- Conduct research to improve our clinical methods and platform, using de-identified data only
- Keep the Services secure, for example by limiting repeated password-reset requests and logging administrative actions
- Comply with legal obligations
We do not use your health information for advertising, and we do not sell your information.
3. Who We Share It With
We do not sell, rent, or share your personal information for anyone's marketing. We share it only in these situations:
- Your care or research team: the Sylvia team members responsible for your care or study can see your account information, schedule and check-in responses through Sylvia's admin console. Access is limited by role.
- Service providers that process information on our behalf, only to run the Services:
- Google (Firebase) stores app data and handles sign-in.
- Vercel hosts our website and app.
- Resend delivers account emails.
- Formspree receives website form submissions.
- Legal requirements: we may disclose information if required by law, court order, or governmental authority.
- Business transfers: if Sylvia is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
4. Data Security
We protect your information with technical and organizational safeguards, including:
- Encryption in transit: all connections use HTTPS
- Encryption at rest: app data is encrypted by Google, which stores it
- Database rules that let your account read and write only your own check-in data
- Role-based access for Sylvia team members, who use a separate admin console and are signed out automatically after a period of inactivity
- A log of key administrative actions, such as invitations sent and accounts deleted
No method of transmission over the internet or electronic storage is completely secure. We work to protect your information, but we cannot guarantee its absolute security.
5. Health Data and HIPAA
Your check-in responses are sensitive health information. We treat them with particular care. Your health data is:
- Used only to provide the Services to you and your care or research team, and, once de-identified, for research to improve them
- Never sold, including to insurance companies, employers, data brokers or advertisers
- Stored with encryption and protected by access controls
HIPAA is a US law that protects health information held by healthcare providers, health plans, and the companies that work on their behalf. Whether HIPAA applies to your Sylvia information depends on how you came to use Sylvia. If a clinician or program covered by HIPAA invited you, their HIPAA obligations apply to how they use your information. Either way, we build Sylvia around the kinds of safeguards HIPAA expects. There is no official "HIPAA certification," and we do not claim one. If you have questions about how HIPAA applies to you, contact us.
6. Your Choices and Rights
- Delete your account: in the Sylvia app, go to Settings and choose Delete my account. This deletes your account and check-in data right away; section 7 explains the few records we keep. You can also ask us by email.
- Access and portability: ask us for a copy of your information, including your check-in responses in a machine-readable file (CSV).
- Correction: ask us to correct inaccurate or incomplete information.
- Research: ask us not to include your de-identified data in research.
- Reminders: turn check-in notifications off at any time in your phone's Settings.
Depending on where you live, you may have additional rights under local law. To make any request, contact us at privacy@sylviaprecisionhealth.com. We may need to confirm your identity before acting on a request.
7. Data Retention
We keep your information while your account is active and for as long as your care or study needs it.
When you delete your account in the app, we immediately delete your profile, check-in responses, check-in records, schedule and login. We keep a small administrative record:
- The invitation that was sent to you, marked as deleted, with your name and email address removed. Only the invite code and its dates remain.
- Entries in our administrative log noting that you were invited and that your account was deleted, including your name and email address
We keep these so we can show who was invited and when an account was removed. If you ask us by email to delete your information, we will do so within 30 days, unless the law requires us to keep it.
Our service providers keep their own technical logs for limited periods under their policies. Website form submissions are kept only as long as we need them to respond to you or to send the updates you asked for. De-identified research data, which can no longer be linked to you, may be kept indefinitely.
8. Children's Privacy
Our Services are for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe we may have collected information from someone under 18, please contact us at privacy@sylviaprecisionhealth.com.
9. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we do, we will post the new policy on this page and update the "Last updated" date. If we make a significant change to what we collect or how we use it, we will also let you know in the app or by email before the change takes effect.
If you have any questions, concerns, or requests about this Privacy Policy or how we handle your information, please contact us at:
Sylvia Precision Health
Louisville, Kentucky
Email: privacy@sylviaprecisionhealth.com