Privacy Policy

1. Introduction

SageWiz ("we," "us," or "our") is committed to protecting your privacy and handling your personal information with care and respect. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, mobile application, and related services (collectively, the "Service").

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide when you:

• Create an account (email address, password)
• Complete your user profile (allergies, medical conditions, optional age range and gender)
• Contact customer support (email, support inquiry details)
• Subscribe to our services (billing information through Stripe)
• Opt-in to marketing communications (email preferences)
• Two-factor authentication (2FA) data: If you enable 2FA, we store your preferred authentication method, verification status, and protected recovery-code records

2.2 Health Information

Important: SageWiz is an educational platform and NOT a healthcare provider or HIPAA-covered entity. We treat health information as sensitive and apply strong security controls. Do not submit protected health information (PHI) on behalf of a healthcare provider or for clinical care.

We collect health-related information including:

• Symptom descriptions and health concerns
• Duration and severity of symptoms
• Medical history (conditions, allergies, medications)
• Lifestyle factors (diet, exercise, sleep patterns, stress levels)
• Assessment responses and follow-up questions
• Notes and journal entries about your health context
• What you type in SageWiz Chat, including symptoms, medicines, and questions
• Photos and documents you attach in chat, such as lab results. When you are signed in, SageWiz saves a copy of each photo and document you attach in chat to your Files, the same as a file you add on the Files page. It stays there until you delete it in Files or close your account. We do not save it from a chat you marked Private chat (no memory), or from a chat you asked us to keep off the record or to forget. When a chat is about someone in your Family, we file it under that person only when we are sure it is theirs; otherwise we ask you first. Unless you turned memory off, SageWiz also keeps a short, dated description of what a health photo shows (never the photo itself, and never a diagnosis) in your health timeline.
• Check-in scores (1 to 10) you choose to log, with their dates
• Health Profile facts you confirm from chat or add on your About you page (age range, sex, medicines with dose, supplements, allergies, conditions a clinician told you, pregnancy, menopause, or breastfeeding status, sleep hours and quality, diet, stress, activity level, alcohol, smoking or nicotine use, caffeine, family health history, movement limits, goals, and notes)
• A dated health timeline SageWiz keeps from your chats, files, health photos, reports and check-ins. Memory is on by default and you can turn it off in Settings → Memory

2.3 Guest Chat Privacy

Guest chat needs no account. You just type. A short line under the chat box says that by chatting you agree to our Terms, this Privacy Policy and our Consumer Health Data Privacy Policy, that you must be 18 or older, and that chat is not for emergencies. When you send your first message, we record that you accepted. The record holds the versions of our legal documents in force, the time, the documents the notice names, and a hash (a digital fingerprint) of the exact notice text you were shown. We keep your IP address, browser type and country with it. We keep this record for 12 months, then delete it automatically. Guest chat is only for people in the United States. We check the country of your IP address, and we do not start a guest chat outside the US. A guest chat keeps no Health Profile and takes no attachments. It expires 48 hours after it starts, and then the chat and its guest session are deleted. On the same device, you can delete it sooner, with no code, using the privacy request form on our Consumer Health Data Privacy Policy page. If you go from a guest chat to Log in or Sign up, that chat is saved to your account. Other guest chats left in the browser are not saved to the account; the browser stops using them, and they are deleted 48 hours after they started. Saving a chat does not turn what you said into saved Health Profile facts.

2.4 Automatically Collected Information

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features accessed, time spent)
• Log data (access times, error logs, performance data)
• Cookies and tracking technologies (see our Cookie Policy)
• Geographic location (country and approximate location based on IP address). For guest chat, we use the country to check that you are in the United States.
• Session tracking data: Active session information, login timestamps, device identifiers for security purposes
• Account status logs: If your account is suspended or locked, we log the reason, timestamp, and administrative action taken

2.5 Information from Third Parties

We may receive information from third-party services when you:

• Process payments through Stripe (payment method, transaction details)
• Use analytics services (aggregated usage statistics)
• Sign up through authentication providers (if applicable in the future)

2.6 SageWiz Chat and Your Health Profile

SageWiz Chat is an educational conversation, not a clinical service. When you send a message, what you send goes to our AI provider (xAI) to write the reply. That is your text, plus any photo or document you attach. For a document we send the text inside it, and for a photo or scanned page we send the image. A small second call reads your typed words, the names of your files and the values SageWiz read from them, to suggest facts about you and, unless you turned memory off, to add dated notes to your health timeline. Before any of this goes to xAI, SageWiz checks xAI's zero-data-retention setting. xAI's public documentation says that when this setting is on, xAI does not store the text we send or the reply it writes, and that every xAI response says whether the setting is on. We send health information to xAI only if a test request, which contains no health information, came back from xAI in the last 10 minutes saying the setting is on. If there is no such recent answer, we send a new test first, and if that test fails, nothing is sent. If a chat reply comes back without that confirmation, we discard the reply and pause health chat until two tests in a row pass. We rely on what xAI says about its own service; we cannot inspect xAI's systems.

When you are signed in, SageWiz saves a copy of each photo and document you attach in chat to your Files, the same as a file you add on the Files page. It stays there until you delete it in Files or close your account. We do not save it from a chat you marked Private chat (no memory), or from a chat you asked us to keep off the record or to forget. When a chat is about someone in your Family, we file it under that person only when we are sure it is theirs; otherwise we ask you first. Unless you turned memory off, SageWiz also keeps a short, dated description of what a health photo shows (never the photo itself, and never a diagnosis) in your health timeline. If you attach lab results, SageWiz keeps a short list of the values it read (the test, the value, its range and the date printed on the report). You can ask about them later in that chat, and, unless you turned memory off, in later chats too. They are deleted when you delete that chat, when you tell chat to forget them, or when you close your account. You can also attach one of your own past reports to a chat. That chat uses it until you remove it. If memory is on and you let chat use your saved reports, later chats can also use what your reports say. A report you attach while saved reports are off is used only in that chat.

Nothing goes into your Health Profile silently. Chat asks first, and a suggestion is saved only when you confirm it: you tap Keep, or you reply in chat to keep the card on your screen (for example "yes, keep it"). After you keep a card, replying "save the rest" also keeps the other suggestions that card counted as "And N more". A suggestion you do not confirm can no longer be saved after 10 minutes, and it is deleted from your account the next time you use chat or About you, or by our daily clean-up, whichever comes first. A suggestion you pass on with Not now is deleted the same way. So that chat does not offer the same thing twice, we keep a list of what it offered (the kind and the words) for 30 days. You can also add, edit, or delete any line on your About you page. SageWiz remembers what you share, in any chat, file or photo, to personalize your answers. It keeps a private, dated record for you and for each Family person you save (your health timeline), and builds a searchable index of it that only your account can use. The timeline notes what you tell chat about your health (such as symptoms, injuries, medicines, supplements and life events), the values SageWiz reads from files and reports, short descriptions of what your health photos show, and your check-ins. It also keeps notes about the people you saved in Family when you ask about them, if you allowed chat to use and remember details about that person. Those notes are about them as well as you. Each note records when it was said or measured and when you last confirmed it. In later chats, SageWiz uses the notes that matter to what you ask, and asks you whether something is still going on rather than assuming. It never stores the photo itself, never records a note as a diagnosis, and does not keep notes from a chat you marked private or asked to keep off the record. This timeline is separate from your Health Profile, which still saves only what you confirm. To correct something, tell chat (for example, "that rash cleared up" or "that's wrong, it was 10 mg"); SageWiz updates the note and keeps a record of the change. Memory is on by default. You can turn it off in Settings → Memory; while it is off nothing new is remembered and earlier chats are not used. Tell chat "forget …" to delete something, delete a chat to delete what came from it, or close your account to erase everything. The index is processed by SageWiz's own systems and our hosting and database providers; your messages are sent to xAI to write answers, as before. The profile is stored per account and never used for advertising or model training. Other users cannot see it. It stays in your account. If chat is allowed to use it, the text goes to our AI provider to write the reply. When you delete a line on your About you page, it is removed from SageWiz right away. When you tell chat to forget something, the matching notes in your health timeline, and the index entries built from them, are deleted right away. When you delete a chat, timeline notes that came only from that chat are deleted with it. When you remove a Family person you saved, the notes SageWiz kept about that person are deleted. When you close your account, your About you and your whole health timeline, with its index, are removed from SageWiz right away, and your other ordinary account data within 30 days. Backup copies are deleted within 90 days. A file you already downloaded does not change. A share link stops working when you cancel it, when it expires (1 to 30 days), when you close your account, when you delete the chat or report it came from, or, for a visit sheet, when you delete an About you line it shows. Family health history is about your relatives, as you describe them. Share only what you are comfortable with. It is used the same way as the rest of your profile, and you can edit or forget any line.

Check-in scores you log (1 to 10, with dates) are kept until you close your account, used in your chat and reports if you allow it, and included in your data export.

Guest chat keeps no profile, takes no attachments, and is deleted 48 hours after it starts. Our separate Consumer Health Data Privacy Policy describes these categories, purposes, sources, who receives them, and your rights for people covered by state health-data laws.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Service Delivery

• Provide AI-powered symptom analysis and educational recommendations
• Generate personalized natural health information
• Maintain your assessment history and user profile
• Enable AI coaching and follow-up questions
• Deliver tier-appropriate features and content

3.2 Service Improvement

• Analyze usage patterns to improve user experience
• Debug technical issues and optimize performance
• Count how people use the Plus cancel screen. We record each step, the reason picked from a fixed list, and the choice made. We store these counts without your account, your email or any text you type, so they are not linked to you. They hold no health information.

3.3 Communication

• Send transactional emails (assessment results, subscription confirmations)
• Provide customer support and respond to inquiries
• Send subscription renewal reminders and usage notifications
• Deliver educational content and health tips (if opted-in)
• Notify you of policy changes or important updates

3.4 Legal and Security

• Comply with legal obligations and regulatory requirements
• Enforce our Terms of Service and prevent abuse
• Protect against fraud, security breaches, and unauthorized access
• Respond to legal requests (subpoenas, court orders)

3.5 Marketing (Opt-In Only)

• Send promotional emails about new features or educational content
• Offer relevant tier upgrade prompts
• Share wellness tips and natural health research

You can opt-out of marketing communications at any time using the unsubscribe link in emails or by updating your preferences in your account settings.

3.6 Email Communications & Preferences

SageWiz sends different types of emails, and you have control over which you receive:

CAN-SPAM Compliance: All our marketing emails comply with the CAN-SPAM Act. Every marketing email includes a clear unsubscribe link, our physical mailing address, and accurate "From" and "Subject" lines. We honor all unsubscribe requests within 10 business days.

Email Service Provider: We use Resend (resend.com) to send emails. Resend processes email data (recipient addresses, email content) solely for the purpose of delivering emails on our behalf and does not use this data for any other purpose.

4. How We Share Your Information

4.1 Service Providers

We share limited information with trusted third-party service providers who assist in operating our Service:

• Supabase (PostgreSQL Database): Stores your account information, assessment history, and user profile data. Supabase is SOC 2 Type II certified and supplies managed database security controls.
• Stripe (Payment Processing): Processes subscription payments and manages billing. Stripe is PCI DSS Level 1 certified and handles payment data securely.
• Resend (Email Service): Sends transactional and marketing emails on our behalf. Resend complies with GDPR and CAN-SPAM regulations.
• Grok AI / XAI API (AI Analysis): Processes the health text you submit, including assessment answers and chat messages, and the photos or documents you attach in chat, to write educational replies. We send what you provide, not your name, email, or account identifiers, and health information is sent only after a recent test request confirms that xAI's zero-data-retention setting is on; otherwise nothing is sent (see section 2.6).
• Upstash Redis (Rate Limiting): Temporarily stores rate limiting data to prevent abuse. No health information is stored in Redis.
• Vercel (Hosting & Infrastructure): Hosts our application and provides CDN services. Vercel complies with SOC 2 Type II and GDPR.

All service providers are bound by strict data processing agreements and are prohibited from using your data for any purpose other than providing services to SageWiz.

4.2 Legal Requirements

We may disclose your information if required by law or to:

• Comply with legal processes (subpoenas, court orders, warrants)
• Respond to government or regulatory requests
• Protect the rights, property, or safety of SageWiz, our users, or the public
• Enforce our Terms of Service and prevent fraud or abuse

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our Service before your information is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We share your information with others only when you choose to. When you choose to share something from SageWiz by link, anyone with the link can read it, without signing in, until it expires (1 to 30 days) or you cancel it. We count how often it is opened and note when it was last opened. Shared pages are hidden from search engines, and links stop working if you close your account. You can see and cancel your links on your Account page. Only share links with people you trust.

5. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. Retention periods vary by the kind of data and your choices, not by whether you pay:

5.1 Account Closure

When you close your account or request data deletion:

• Your account is marked for deletion immediately upon closure
• Access is disabled and deletion begins after your explicit final confirmation
• This is not presented as a 30-day undo period; a final closure request cannot be restored through the product
• Some chat-first records are removed immediately and ordinary remaining account data is scheduled for deletion
• Some data may be retained for legal compliance (e.g., financial records for 7 years)
• Backup copies are deleted within 90 days

5.2 Legal Hold

We may retain your information longer if required by law, legal proceedings, investigations, or to prevent fraud and abuse.

6. Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction:

6.1 Technical Safeguards

• Encryption: HTTPS protects data in transit, and our database provider encrypts stored data at rest.
• Authentication: Managed password hashing, session controls, and optional two-factor authentication
• Access Controls: Role-based access controls (RBAC) and least privilege principles
• Database Security: Supabase Row Level Security (RLS) policies ensure users can only access their own data
• Rate Limiting: Protection against brute force attacks and abuse
• Monitoring: Application logs and security alerts used to investigate failures and abuse

6.2 Organizational Safeguards

• Access is limited to people and services that need it to operate SageWiz
• Security checks are run as part of development and release review
• Incident response plan for data breaches
• Vendor security assessments and data processing agreements

6.3 Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify you within 72 hours via email and provide details about the breach, affected data, and steps you should take to protect yourself.

7. Your Privacy Rights

Depending on your location, you have specific rights regarding your personal data:

7.1 General Rights (All Users)

• Right to Access: Request a copy of your personal data
• Right to Correction: Request correction of inaccurate data
• Right to Deletion: Request deletion of your personal data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to certain processing of your data (e.g., marketing)
• Right to Withdraw Consent: Withdraw consent for data processing at any time

7.2 GDPR Rights (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Restriction: Request restriction of processing your data
• Right to Lodge a Complaint: File a complaint with your local data protection authority
• Right to be Informed: Receive clear information about data processing
• Automated Decision-Making: Right to not be subject to decisions based solely on automated processing (including AI)

Legal Basis for Processing (GDPR): We process your data based on consent (assessment completion), contract performance (subscription services), legitimate interests (service improvement), and legal obligations (compliance).

7.3 CCPA Rights (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you these rights:

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell data)
• Right to Non-Discrimination: Equal service and pricing regardless of privacy rights exercise
• Right to Correct: Request correction of inaccurate personal information

Categories of Data Collected (CCPA): Identifiers (email), health information (allergies, medical conditions, symptoms, age range, gender), internet activity, geolocation data, commercial information (subscription history), and inferences (health preferences).

7.4 How to Exercise Your Rights

To exercise any of these rights, contact us at:

Guests can use the guest privacy request form. On the same device, you can delete your current guest chat there with no code. You can also email privacy@sagewiz.org.

We will respond to your request within 30 days (GDPR) or 45 days (CCPA). We may request additional information to verify your identity before processing your request.

8. Children's Privacy

SageWiz is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@sagewiz.org.

If we become aware that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information from our servers as quickly as possible.

9. International Data Transfers

SageWiz is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

For EU/EEA Users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection for international data transfers. Our data processing agreements with service providers include these clauses.

By using the Service, you consent to the transfer of your information to the United States and other countries that may have different data protection laws than your country of residence.

10. HIPAA Notice (Not Covered Entity)

We recognize the sensitive nature of health information and use reasonable administrative, technical, and physical safeguards, including:

• Encryption of health data in transit and at rest
• Access controls and authentication mechanisms
• Audit logs and security monitoring
• Security checks during development and release review
• Incident response and breach notification procedures

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Service. For detailed information about our use of cookies, please see our Cookie Policy.

In the United States, optional cookies are on by default and you can turn them off. They cover Vercel Web Analytics and Speed Insights, our own page and web-vitals analytics, and functional view preferences. We do not use ad tracking, and we do not sell or share your information for advertising. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out and turn off all optional cookies, both analytics and preferences. Our analytics endpoints also drop any request that carries the GPC signal.

You can change your choice at any time on our Cookie settings page, in the menu and the site footer, or manage storage in your browser. Blocking essential storage may prevent sign-in and other features from working.

12. Third-Party Links

The Service may contain links to third-party websites, plugins, and applications. We are not responsible for the privacy practices or content of these third parties.

We encourage you to read the privacy policies of any third-party sites you visit. This Privacy Policy applies solely to information collected by SageWiz.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on the Service

Your continued use of the Service after the effective date of the revised Privacy Policy constitutes acceptance of the changes. If you do not agree to the changes, you should stop using the Service and may request deletion of your account.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: