Notice: This is a starter template. Have a licensed attorney familiar with health-data regulation (HIPAA, GDPR where applicable) review and adapt it before relying on it commercially.
This Privacy Policy explains what information Dose Deck ("we", "us") collects from you, how we use it, and the choices you have. We designed Dose Deck so that you remain in control of your protocol and health data.
1. Information we collect
Account information
- Email address (via Clerk, our authentication provider)
- Display name
- Role (client, coach, or admin)
- Timezone, preferred language, optional Telegram chat ID
Health and protocol information
- Peptides, doses, schedules, sites, time of day, start/stop dates
- Shot logs (taken, skipped, rescheduled) with timestamps
- Body measurements you choose to record (weight, waist, blood glucose, BP)
- Bloodwork and lab files you upload (PDF, JPG, PNG, HEIC)
- Coach notes, SOAP notes, and chart notes your provider creates
- Medication and supplement records (VIP tier)
Billing information
- Stripe customer ID and subscription status
- Plan tier and billing history
We do not store your credit card number, CVV, or full card details — those are handled directly by Stripe.
Technical information
- IP address, browser, device type (for security and abuse detection)
- Audit log of sensitive actions (logins, role changes, file uploads, etc.)
2. How we use it
- To operate the Service — log your shots, send reminders, generate sheets, run the AI assistant.
- To let your assigned coach see and update your protocol and notes.
- To process payments through Stripe.
- To send transactional messages (reminders, billing receipts, password resets).
- To protect the Service from fraud, abuse, and security incidents.
- To comply with legal obligations.
We do not sell your data, run advertising on it, or use it to train third-party AI models without your explicit permission.
3. Who can see your data
- You. Always.
- Your assigned coach and other members of the practice that owns your account (clients-of-coach relationship, scoped via row-level checks).
- Service providers we use to run Dose Deck: Clerk (authentication), Supabase (database hosting), Hetzner (server hosting), Stripe (billing), Anthropic (AI responses), Telegram (optional reminders). Each receives only what they need.
- Authorities if compelled by valid legal process; we will resist overbroad requests and notify you where lawful.
4. Where data lives
- Database: Supabase-hosted Postgres in AWS us-east-2.
- Uploaded files: Encrypted at rest on a server in Nuremberg, Germany (Hetzner). Each file is accessible only to your assigned coach and admins, via an authenticated download endpoint.
- Backups: Daily, encrypted, retained 30 days.
5. Retention
- Active accounts: data kept while your account is active.
- Cancelled accounts: protocol and shot-log history kept 12 months in case you reactivate, then anonymised or deleted.
- Audit logs: 24 months.
- Files: deleted when you delete them; otherwise alongside the account.
- Billing records: 7 years, as required by tax law.
6. Your rights and choices
- Access & export: request a copy of your data from Settings, or by emailing [email protected].
- Correction: edit your profile and protocols at any time.
- Deletion: email [email protected] from your account's email address with the subject "Delete my account" and we'll delete your account and associated data within 30 days, subject to legal retention (see Data Retention above).
- Withdraw consent: disconnect Telegram, stop the AI assistant, cancel your subscription.
- Complaint: contact us first. EU/UK residents may also lodge a complaint with their data protection authority.
7. Security
We protect your information with TLS in transit, AES at rest, scoped database access, encrypted backups, and per-resource authorisation checks (coach can only see their own clients; admins can see all). No system is perfect — if a breach ever materially affects you we will notify you promptly.
8. Children
Dose Deck is not intended for users under 18. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.
9. Changes to this Policy
We will post the updated policy here and update the "Last updated" date. Material changes will be announced via email or in-app notice.
10. Contact
Questions: [email protected].