Draft. This policy hasn’t been reviewed by a lawyer yet and isn’t in effect. firstlife is in testing and isn’t collecting real health information.
Privacy Policy
firstlife is an app that helps you keep track of your symptoms, records and doctor visits, so you can bring clear evidence to your care team. It is run by Velez Health, Inc. (“we”, “us”). This policy explains what we collect, why, who helps us run the app, and how you can see, export or delete your information.
- We never sell your information and never use it for ads.
- Only you can see your health information. Our database is set up so each account can read only its own entries.
- You can export or delete everything at any time in Settings. Deleting your account removes your entries and files from our servers.
- firstlife isn’t medical advice. In an emergency, call 911.
If you live in Washington, Nevada, Connecticut or another state with a health-data law, our Consumer Health Data Privacy Policy also applies to you and explains your rights in more detail.
1. What we collect
What you give us
| Type | Examples |
|---|---|
| Account | Email address, password (stored only as a scrambled hash we can’t read), first name, whether you live in the US or Canada, and your confirmation that you’re 18 or older. |
| Sign-up answers | Why you’re using firstlife, ongoing conditions, family health history and which relatives it applies to. These are optional. |
| Health entries | Symptoms and how severe they were, how they affected your day, medications and doses, what a provider told you, and whether you asked for something to be noted in your chart. |
| Visits and care team | Upcoming and past appointments, visit notes and next steps, questions for your provider, and the names, phone numbers and addresses of providers you save. |
| Files | Test results, imaging reports and other records you upload (PDF or photos). |
| Recordings | Audio of a visit or call that you choose to record, its length, the moments you marked, and the summary you write. |
| Consents | When you agreed to this policy and to us storing your health information. |
| Messages to us | Anything you send to support@healthbyvelez.com. |
What you can choose to connect
- Google Calendar (optional, read-only). If you connect it, the app looks at your events for the next 90 days on your device, picks out ones that look like medical appointments, and shows them to you. We save only an appointment you choose to keep. We can’t change your calendar, and we don’t store your Google sign-in on our servers.
- Pasted emails and calendar files. If you paste an appointment confirmation or open a calendar file, the app reads it on your device to find the date, time and provider. Only the appointment you save is kept.
What we don’t collect
- We don’t read your email, texts or phone calls. When you tap “Call”, your phone’s dialer handles the call.
- We don’t track your location, and we don’t use advertising or cross-app tracking tools.
- We don’t get information about you from data brokers.
What stays only on your device
Some things are kept only on your phone and are never sent to us: articles you save or vote on in Learn, your newsletter preference (no newsletter is sent yet), and a recording until you save it to your timeline.
2. How we use it
- To run the app for you: show your timeline and graphs, build visit summaries and PDFs you export, and keep your information in sync across your devices.
- To sign you in, keep your account secure, and send the codes that confirm your email.
- To answer your messages.
- To meet legal duties, such as responding to a valid legal request or notifying you of a data breach.
We don’t use your health information to train AI models, for advertising, or to build a profile about you for anyone else.
3. Who helps us run firstlife
We use a small number of service providers. They may handle your information only to provide their service to us, under contracts that limit what they can do with it.
| Provider | What they do | What they handle |
|---|---|---|
| Supabase | Database, sign-in and file storage | Your account, entries, files and recordings. Stored in the US for US accounts and in Canada for Canadian accounts. |
| Resend | Sends sign-in and confirmation emails | Your email address and the one-time code |
| Cloudflare | Hosts our website and domain | Basic visit data such as your IP address when you open our website |
| Calendar, only if you connect it | Handled under Google’s own privacy policy | |
| NPI Registry (US government) | Doctor search | The name, specialty and place you search for. Not your identity or health information. |
We share your information with anyone else only if you ask us to (for example, when you send a visit summary to someone), or if the law requires it. If the company is ever sold or merged, we’ll tell you before your information moves to a new owner, and this policy will keep applying to it.
4. Where it’s stored
Your information is stored in your own country. If you chose the United States at sign-up, it’s stored in the US. If you chose Canada, your account, entries, files and recordings are stored in Canada (Montréal).
A few things still pass through the United States for everyone: sign-in emails are sent through Resend, our website is hosted by Cloudflare, and doctor searches go to the US government’s NPI Registry. None of these involve your health entries, files or recordings.
5. How long we keep it
- While your account is open, we keep what you’ve added until you delete it.
- When you delete an entry, file or recording, it’s removed from our database and storage right away.
- When you delete your account (Settings → Delete my account), your account, entries, files and recordings are removed right away. Encrypted backup copies are erased automatically within 30 days.
- Consent records are deleted with your account.
6. How we protect it
- Information is encrypted while it travels and while it’s stored.
- Each account can read only its own rows and files. Files are private and open only through links that expire after 10 minutes.
- You can lock the app on your phone.
- Signing out clears your information from that device.
No system is perfectly secure. If a breach affects your information, we’ll notify you and the authorities as the law requires, including under the US Federal Trade Commission’s Health Breach Notification Rule.
7. Your choices and rights
- See and correct: everything you’ve added is in the app, where you can edit it.
- Export: Settings → Export my data downloads a copy.
- Delete: remove single entries from your timeline, everything in Settings → Delete my data, or your whole account in Settings → Delete my account.
- Withdraw consent: deleting your account withdraws your consent and removes your information.
- Disconnect Google Calendar at any time from your Google account’s security settings.
Depending on where you live, you may have more rights, such as the right to know what we’ve shared and with whom. Email support@healthbyvelez.com and we’ll respond within 30 days (45 days where the law allows). We won’t treat you differently for using your rights. If you live in Canada, you can also contact the Office of the Privacy Commissioner of Canada.
8. Health privacy laws
firstlife is a personal tool you use for yourself. We aren’t your doctor, hospital or health plan, so the US health privacy law HIPAA generally doesn’t apply to us. We still treat everything you add as sensitive health information and protect it as this policy describes.
9. Age
firstlife is for adults 18 and older. We don’t knowingly collect information from anyone younger. If you think a child has made an account, email us and we’ll delete it.
10. Changes
If we make a meaningful change, we’ll tell you in the app or by email before it takes effect. If a change would let us use your health information in a new way, we’ll ask for your consent first.
11. Contact
Velez Health, Inc.
Email: support@healthbyvelez.com