← Back to Hygeia

Privacy Policy

Last updated: July 2026

This Privacy Policy explains what information Hygeia — an AI wellness companion created by Sue Van Raes of Boulder Nutrition — collects, how we use it, who we share it with, and the choices you have. Hygeia is intended only for adults 18 years of age or older.

If you are a Washington, Nevada, or Connecticut resident, please also read our dedicated Consumer Health Data Privacy Policy, which covers consumer health data specifically.

1. Information we collect

  • Account information — your name and email address, handled through our authentication provider (Clerk) when you create an account.
  • Your conversations and content — the messages you send Hygeia, and any files, meal photos, journal entries, or metabolic-quiz responses you provide.
  • AI-derived memories — to personalize your experience, Hygeia automatically extracts and stores short "memories" (facts and insights) from your conversations. See section 3.
  • Usage data — token usage and activity needed to operate your plan and apply usage limits.
  • Phone number (optional) — only if you opt in to SMS security alerts.
  • Consent and technical records — your consent choices and timestamps, plus limited technical data such as a hashed (not plain-text) IP address and browser identifier recorded at the moment you consent.

2. How we use your information

We use your information to provide and personalize Hygeia's wellness guidance, operate your subscription and usage limits, keep the service safe (including detecting messages that indicate a crisis so we can surface professional resources to you), send you account and security notifications, and meet our legal obligations.

We do not sell your data. We do not use your conversations to train any AI models.

3. AI memory extraction

So that Hygeia can remember helpful context across sessions (for example, a goal you mentioned or a food you're working with), it extracts brief facts from your conversations and stores them tied to your account. These memories are encrypted at rest, are used only to personalize your own experience, and are permanently deleted when you delete your account.

4. How your conversations are stored

Your conversations are stored while your account is active so that your chat history is available to you across sessions. Message content, chat titles, AI memories, and summaries are encrypted at rest using an application-managed key. Meal photos and uploaded files are also encrypted at rest. When you delete your account, this data is permanently and fully deleted (see section 6).

5. Service providers (sub-processors)

Hygeia is operated by Boulder Nutrition. We share the minimum data necessary with the following service providers so the app can function. We do not sell data to any of them, and none of them use your conversations to train their models.

  • Cloudflare — hosting, database, file storage, and AI infrastructure (stores your encrypted data).
  • OpenRouter — routes your messages to the AI language-model providers that generate responses (currently Anthropic, Google, DeepSeek, and Moonshot AI). These are configured for Zero Data Retention, meaning providers do not retain your messages beyond the time needed to generate a response.
  • Clerk — account authentication and identity.
  • Stripe — subscription payment processing (Hygeia never sees your full card details).
  • Resend — transactional email (e.g., welcome, security, and account notices).
  • Twilio — SMS delivery, only if you opt in to text security alerts.
  • Brave Search — only when you turn on web search for a message; it receives that search query.
  • Kit (ConvertKit) — beta waitlist signups only (name and email).

6. Data retention

We retain your information for as long as your account is active. When you request account deletion, your data enters a short grace period (30 days, during which you can cancel) and is then permanently purged, including your conversations, memories, quiz results, journal entries, meal analyses, uploaded images, and usage records. We retain only the minimum legally required records, such as consent timestamps.

7. Your rights and choices

You can exercise the following rights at any time:

  • Access & portability — download a copy of your data from Profile → Your data → Download my data.
  • Deletion — delete your account and all associated data from Profile → Account Settings → Delete account.
  • Correction — update your account details, or email us to correct information.
  • Withdraw consent — you can withdraw consent (for example, to SMS alerts) in your settings, or by contacting us.

To make any of these requests directly, email [email protected].

8. Security

Sensitive data — including conversations, AI memories, phone numbers, and uploaded images — is encrypted at rest using AES-256 (AES-GCM). AI providers are configured for Zero Data Retention. No system is perfectly secure, but we work to protect your information with appropriate technical and organizational measures.

9. Children

Hygeia is for adults 18 and older. We do not permit anyone under 18 to use the service, and we do not knowingly collect information from anyone under 18. Hygeia does not knowingly collect data from children under 13, consistent with COPPA.

10. Consumer health data

Because Hygeia discusses food, body, and wellbeing, some of the information you share may be considered "consumer health data" under laws such as Washington's My Health My Data Act. We describe how we handle that category in a separate Consumer Health Data Privacy Policy.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date, and where appropriate we will notify you in the app or by email.

12. Contact

Questions about your privacy? Email [email protected].

Terms of Service Consumer Health Data Privacy Policy Back to Hygeia