HerClarity AI

Privacy & Data Security Statements

Your Data Belongs to You

At HerClarity, your health data is yours — full stop. We built this platform specifically so that the most personal information about your body never
becomes a product, never gets sold, and never leaves a server you can trust.

What We Collect

We collect only what you choose to share with us through your daily check-ins and experiments:

– Wellness metrics you track (energy, mood, sleep, stress, digestion)
– Custom metrics you choose to add
– Lab values and numeric health markers you choose to track (such as ferritin, vitamin D, or other bloodwork results)
– Your experiment goals and hypotheses
– Your email address for account access

What We Never Do

– We never sell your data
– We never share your data with advertisers or third parties
– We never use your data to train AI models without your explicit consent
– We never display ads
– We never make product recommendations based on your data

Where Your Data Lives

Your data is stored on a private server in Helsinki, Finland, hosted by Hetzner — a European company subject to strict EU data protection laws (GDPR). Your
data never passes through Amazon, Google, Microsoft, or any major cloud provider.

Your Rights

– You can export all your data at any time
– You can delete your account and all associated data at any time
– You can contact us at [email protected] with any privacy questions
– You are never locked in

Technical Privacy & Security Details

Server Infrastructure

– Server provider: Hetzner Online GmbH (German company, EU jurisdiction)
– Server location: Helsinki, Finland (EU/GDPR jurisdiction)
– Server type: Dedicated virtual private server (VPS) — not shared hosting
– Operating system: Ubuntu 24.04 LTS with automatic security updates enabled
– Your data does not pass through or reside on AWS, Google Cloud, Microsoft Azure, or any US hyperscaler infrastructure

Data Routing & Transit

– All data in transit is encrypted via TLS 1.2+ (HTTPS)
– DNS is managed by Cloudflare — they see domain lookups but not your health data
– SSL certificates are issued by Let’s Encrypt (non-profit certificate authority)
– WordPress frontend is hosted on SiteGround (Iowa, USA) — stores only your WordPress account credentials, not health data
– Health data flows directly from your browser to api.herclarity.ai (Helsinki server) over encrypted HTTPS

Database & Storage

– Database: PostgreSQL — open source, no vendor lock-in
– Database is not publicly accessible — accepts local connections only
– Encryption at rest: enabled — PostgreSQL data is stored on a Hetzner encrypted Volume (AES-256-XTS), encrypted at the infrastructure level

– Field-level encryption: custom health metrics (including lab values) are encrypted at the application layer before database storage — they cannot be read directly from the database without the application encryption key
– Automated encrypted backups: daily, stored separately from primary server
– Backup retention: 30 days

AI & Third Party Services

– AI insights are currently generated via the Anthropic API (Claude) — anonymized metric summaries only, no personally identifiable information is sent
– Anthropic’s API data handling is governed by their privacy policy and zero data retention options
– Roadmap: migrate to a self-hosted LLM on our own infrastructure so no health data leaves our server for AI processing
– No analytics platforms (Google Analytics, Meta Pixel, etc.) are installed

Access Controls & Security Hardening

– SSH access: key-based authentication only — password login disabled
– Root login: disabled
– Firewall: UFW — only ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open
– Brute force protection: automated IP blocking after repeated failed login attempts
– Rate limiting: Nginx rate limiting at the network layer, plus application-level rate limiting backed by Redis
– API authentication: all browser-to-server API calls are authenticated via short-lived signed JWT tokens (HS256)
– Automatic security updates: enabled for OS and system packages

GDPR & Regulatory Compliance

– Server jurisdiction: EU (Finland) — subject to GDPR
– HerClarity is a direct-to-consumer wellness platform and is not currently classified as a HIPAA covered entity
– We implement HIPAA-grade security practices by design including encryption at rest, encryption in transit, access controls, and audit logging
– Right to access: you can request a full export of your data at any time
– Right to erasure: you can request full deletion of your account and all data
– Data breach notification: we will notify affected users within 72 hours of discovering any breach

Contact

For any privacy or security questions: [email protected]

Last updated: March 2026