Security & data handling
What we actually do, stated plainly — including the parts most apps leave out.
We would rather under-claim than have you discover later that a badge on a marketing page did not mean what you assumed. Everything below is either implemented today or explicitly labelled as not yet done.
Your data is encrypted
Your reports and health history are protected at every stage — moving between your phone and our servers, sitting in our database, and behind the lock on your own device.
In transit — always
Every byte between your phone and our servers travels over TLS 1.3. Plain HTTP is refused outright rather than redirected, so there is no unencrypted first hop to intercept.
Your health data in the database — encrypted
Sensitive health fields are encrypted before they are written, with a key held separately from the database itself. Someone who obtained a copy of the database would not be able to read them.
Your uploaded documents — isolated and access-controlled
Reports you upload are stored on encrypted infrastructure, partitioned per user, and written with permissions that make them readable only by the application process — never by other users, and never over a public URL. Downloads always go through an authenticated request tied to your account.
Locked to your device
Face ID or fingerprint gates the app itself, so a stolen unlocked phone still does not open your health history.
Also in place
Identifying details removed before upload
Your phone opens each report before it is sent and lets you black out your name, date of birth, address and insurance number. The blacking out destroys the pixels and strips the photo's metadata — camera, capture time, GPS — into a new file; the original never leaves your device. PDFs are rendered page by page and rebuilt from the redacted images, so the redacted copy has no text layer to recover anything from. It is a tool rather than a guarantee, so you review every page, but what we never receive cannot leak.
No sale of health data, ever
Revenue comes from Premium subscriptions. Your health data is not sold, rented, or shared with advertisers — this is a commitment in our Privacy Policy, not just a preference.
AI processing without model training
Insights are generated by Google Gemini under data-processing terms that prohibit using your data to train their models.
Export and deletion on demand
You can export everything we hold or delete your account permanently from inside the app — no email ticket, no retention period you have to argue about.
GDPR and CCPA rights
Access, rectification, erasure, portability and objection are all supported, for every user rather than only those in a covered jurisdiction.
What we don’t claim
Three things we are regularly assumed to be, and are not.
We are not end-to-end encrypted
Our servers can read your health data — they have to, in order to parse your reports and generate insights. Any app that offers server-side AI analysis and also claims end-to-end encryption is describing something other than what that term means.
We are not a HIPAA-covered entity
Yovitai is a consumer wellness app, not a healthcare provider, insurer, or clearinghouse. We apply comparable safeguards by choice, but using the app does not create a HIPAA relationship.
We are not a medical device
Nothing in the app diagnoses, treats, or is intended to replace advice from a qualified clinician. It is for information and self-understanding.
We do not call your uploads anonymised
The on-device redaction is a tool you drive, not an automatic guarantee — no automated pass can reliably find every identifier on every lab's stationery, which is why you review each page yourself. Where a file cannot be opened for review at all we say so and ask before uploading, rather than deciding for you.
Not done yet
Listed so you can hold us to it, and so nobody mistakes an intention for a certification.
Per-document encryption at rest
Not in placeDocument contents are currently protected by infrastructure encryption and strict file permissions, but are not individually encrypted the way database fields are. TODO(security): encrypt document bodies via app/core/encryption.py in LocalStorageService._write, then update the encryption section above.
SOC 2 Type II
Not in placeTODO(compliance): not started. Remove this entry or replace it with a real status — do not display a badge until the report exists.
Third-party penetration test
Not in placeTODO(compliance): not yet commissioned. State the firm and the date once it is.
AWS KMS envelope encryption
Not in placeSupport is implemented behind a flag (USE_KMS_ENCRYPTION) but is not enabled in production, so key rotation is currently manual.
Who else is involved
We rely on a small number of vetted providers to host the service, deliver mail and notifications, and generate AI insights. Each is bound by a data-processing agreement, none may use your health data to train their models, and none of them receives it for advertising. The full itemised list lives in our Privacy Policy.
Reporting a vulnerability
If you have found a security issue, email us before disclosing it publicly. We will acknowledge within two business days and keep you updated until it is resolved. We won’t pursue legal action against anyone who reports in good faith, avoids accessing other people’s data, and gives us reasonable time to fix the issue.
security@yovit.ai