Privacy Policy

1. Introduction

MyEval AI ("we," "our," or "us") is committed to protecting the privacy and security of your personal and health-related information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you access or use the MyEval AI platform, including our website, applications, and all related services (collectively, the "Platform").

MyEval AI is an educational health information platform that allows users to enter personal health data to receive educational health scores, insights, and AI-generated educational content. We are not a healthcare provider, medical device, or clinical diagnostic tool. The information provided through our Platform is for educational and informational purposes only and should not be considered medical advice, diagnosis, or treatment.

This Privacy Policy applies to all users of the Platform worldwide. By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of the Platform immediately.

2. Information We Collect

We collect several categories of information to operate the Platform, deliver our educational services, and improve your experience. The types of information we collect include:

2.1 Personal Information

When you create an account or interact with the Platform, we may collect the following personal information:

• Full name
• Email address
• Phone number
• Date of birth
• Gender
• Account credentials (password is stored in hashed form only)

2.2 Health-Related Information

To provide educational health scoring and AI-generated educational content, we collect health-related information that you voluntarily enter into the Platform. This may include:

• Symptoms: Self-reported symptoms, their duration, and severity.
• Vital signs: Blood pressure readings, heart rate, body mass index (BMI), temperature, and other self-reported vitals.
• Medical history: Past diagnoses, surgeries, hospitalizations, and chronic conditions as reported by you.
• Family medical history: Hereditary conditions and family health patterns as reported by you.
• Current medications: Prescription medications, over-the-counter drugs, and supplements you report taking.
• Lifestyle factors: Smoking status, alcohol consumption, exercise habits, dietary patterns, sleep quality, and stress levels.
• Documents and images you upload: Lab reports, medical documents, insurance cards and advance directives, in PDF, image, spreadsheet or text form. These are stored in private, access-controlled storage. To read the values out of them we use optical character recognition (see Section 5.1, Amazon Web Services), and the text extracted from medical documents is used to generate educational explanations (see Section 5.1, OpenAI). Documents may contain information you did not type yourself, such as a provider or facility name; before any extracted text is sent for AI explanation we remove direct identifiers from it.

Important: All health-related information collected by MyEval AI is voluntarily entered by you, the user, for educational purposes. This data is not clinical Protected Health Information (PHI) obtained from or created by a healthcare provider, health plan, or healthcare clearinghouse. It is self-reported data used exclusively to generate educational health scores and AI-powered educational content.

2.3 Usage Data

We automatically collect certain information about how you interact with the Platform, including:

• Pages and features viewed or accessed
• Features and tools used within the Platform
• Date and time of access
• Session duration and frequency of visits
• Referring URLs and navigation paths within the Platform
• Search queries performed on the Platform

2.4 Device Information

We collect technical information about the devices you use to access the Platform, including:

• Web browser type and version
• Operating system and version
• IP address (which may indicate general geographic location)
• Device type (desktop, tablet, mobile)
• Screen resolution and display settings
• Language and timezone preferences

2.5 Payment Information

If you purchase a subscription or any paid service on the Platform, your payment is processed by our third-party payment processor, Stripe, Inc. We do not store, process, or have access to your full credit card numbers, debit card numbers, or bank account details. Stripe handles all payment processing in compliance with PCI DSS (Payment Card Industry Data Security Standard) requirements. We receive only limited payment information from Stripe, such as the last four digits of your card, card brand, expiration date, billing address, and transaction status, solely for the purpose of managing your subscription and providing customer support.

2.6 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store certain information when you use the Platform. For detailed information about our use of cookies, please refer to Section 8 (Cookies and Tracking) of this Privacy Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Provide Educational Health Information and Scoring

Your health-related information is used to calculate educational health scores, risk assessments, and wellness indicators. These scores are intended solely for educational and informational purposes to help you better understand general health topics and patterns.

3.2 Generate AI-Powered Health Education Content

We use your health-related information in conjunction with artificial intelligence models to generate personalized educational content, explanations, and health information summaries. This AI-generated content is educational in nature and does not constitute medical advice, diagnosis, or treatment recommendations.

3.3 Improve Platform Accuracy and Features

We analyze aggregated and anonymized usage patterns to improve the accuracy of our scoring algorithms, enhance existing features, develop new features, and improve the overall user experience. Individual health data is never used in its identifiable form for product development without your explicit consent.

3.4 Process Payments and Manage Subscriptions

We use your account and limited payment information to process transactions, manage your subscription status, handle billing inquiries, issue refunds when applicable, and send payment-related notifications such as receipts and renewal reminders.

3.5 Send Account Notifications and Newsletters

We use your contact information to send you important account notifications (such as password resets, security alerts, and service updates), as well as optional newsletters and educational health content updates. You may opt out of non-essential communications at any time through your account settings or by using the unsubscribe link provided in each email.

3.6 Comply with Legal Obligations

We process certain information as necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests. This includes maintaining records required by tax laws, responding to lawful subpoenas or court orders, and meeting regulatory reporting requirements.

3.7 Detect Fraud and Security Threats

We use technical data, usage patterns, and account information to detect, investigate, and prevent fraudulent activity, unauthorized access, abuse of the Platform, and other security threats. This includes monitoring for unusual login patterns, suspicious account activity, and potential violations of our Terms of Service.

4. Health Data Handling

This section addresses how we handle the health-related data you provide to us. Given the sensitive nature of health information, we want to be transparent about our obligations, practices, and the protections we apply.

4.1 Our Status Under HIPAA

MyEval AI is not a "covered entity" or "business associate" as defined under the Health Insurance Portability and Accountability Act (HIPAA). HIPAA applies to healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates. Because MyEval AI is an educational health information platform and does not provide healthcare services, health insurance, or healthcare billing, we do not fall under HIPAA's regulatory scope. The data you enter is self-reported educational information, not clinical PHI generated through a provider-patient relationship.

4.2 HIPAA-Equivalent Safeguards as Best Practice

Although we are not legally required to comply with HIPAA, we recognize the sensitivity of health-related data and voluntarily treat all health information with the highest level of security as a best practice. We implement safeguards that meet or exceed HIPAA-equivalent standards, including:

• Encryption at rest: All health-related data is encrypted at rest using AES-256 (Advanced Encryption Standard with 256-bit keys), one of the strongest encryption standards available.
• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (Transport Layer Security), preventing interception during transmission.
• Role-based access controls: Access to health data is strictly limited to authorized personnel who require it for legitimate operational purposes. Access permissions are granted on a least-privilege basis.
• Audit logging: We record an audit trail of account and administrative activity, and of staff access to clinical records through the interfaces built for that purpose. We are extending this logging to cover every internal interface that can reach health data; until that work is complete, not every internal read is individually recorded.
• Regular security assessments: Automated checks run continuously against our codebase and infrastructure: secret scanning on every code change, weekly dependency, container and web-application vulnerability scans, and a quarterly automated penetration-testing baseline. These are automated assessments; where we commission an independent manual penetration test, we will say so here.

4.3 FTC Health Breach Notification Rule

MyEval AI complies with the Federal Trade Commission (FTC) Health Breach Notification Rule (16 CFR Part 318), which applies to non-HIPAA-covered entities that handle personal health records. In the event of a breach of unsecured personally identifiable health information, we will notify affected individuals, the FTC, and, where required, the media, in accordance with the timelines and procedures specified by the Rule.

4.4 Permitted Uses of Health Data

Your health-related data is used exclusively for the following purposes:

• Generating your educational health scores and risk indicators within the Platform.
• Providing AI-generated educational content and health information summaries personalized to your entered data.
• Improving the accuracy and relevance of our educational scoring models using anonymized and aggregated data.

We do not share, sell, lease, or otherwise disclose your health-related data to advertisers, data brokers, or any third party for marketing or advertising purposes. Your health data will never be used to target advertisements to you.

5. Data Sharing and Disclosure

We do not sell your personal information or health-related data. We may share your information only in the limited circumstances described below:

5.1 Service Providers

We engage trusted third-party service providers to help us operate and deliver the Platform. These providers have access to your information only to the extent necessary to perform their services and are contractually obligated to protect your data. Our key service providers include:

• Supabase: Provides our database infrastructure, authentication services, and backend functionality. Your account data and health-related information is stored in Supabase's secure, encrypted databases.
• Amazon Web Services (AWS): Provides our application hosting, document processing, email delivery, file storage and secrets management. Hosting processes technical request data (such as IP addresses and request headers) to serve the Platform to you. When you upload a lab report or medical document, AWS performs optical character recognition on it to extract your results; large documents are briefly staged in AWS storage while that runs. AWS also delivers our transactional and newsletter emails. AWS machine translation is used to translate our public marketing pages only — it is not used on signed-in pages, so it does not receive your health information.
• Stripe: Processes all payment transactions. Stripe receives your payment details directly and handles them in accordance with PCI DSS standards. We do not store your full payment card information on our servers.
• Anthropic: Provides AI processing for educational health content, including the health assistant chat, medication review, weekly focus and vitals pattern features. Anthropic is contractually prohibited from using your data to train their models and processes it solely to return results to us.
• OpenAI: Provides AI processing for educational health content, including lab result and health record explanations, dashboard summaries, nutrition and mood insights, and personalised newsletters.
• What AI providers receive: Before a request is sent to Anthropic or OpenAI we remove direct identifiers from it — your name, email address, date of birth, exact dates and our internal account identifiers. Exact ages are replaced with an age range. The request therefore describes health values and patterns rather than a named person. Free text you write, and text extracted from documents you upload, is additionally scanned to remove names, dates, contact details and record numbers before it is sent. No automated process is perfect, so please avoid entering information you would not want processed by these providers.
• What AI providers do with it: We access these providers through their commercial APIs. Under those terms your requests are not used to train their models. They may retain a request for a limited period — generally up to 30 days — for security and abuse monitoring, after which it is deleted. We do not permit either provider to use your data for any other purpose, and we do not receive or store anything from them beyond the response shown to you.

Which features send data, and what leaves:

5.2 Legal Requirements

We may disclose your information if we believe in good faith that such disclosure is necessary to:

• Comply with applicable laws, regulations, or legal processes.
• Respond to lawful requests from public authorities, including law enforcement.
• Enforce our Terms of Service or other agreements.
• Protect the rights, property, or safety of MyEval AI, our users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or other sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Platform prior to your information being transferred and becoming subject to a different privacy policy. The acquiring entity will be required to honor the commitments made in this Privacy Policy with respect to your data.

5.4 With Your Consent

We may share your information with third parties when you have given us your explicit consent to do so. You may withdraw this consent at any time by contacting us at privacy@myeval.ai.

5.4 Affiliates, Referral Partners and Partner Pharmacies

Some people reach MyEval AI through an affiliate or referral partner — a clinician, organisation or individual who promotes the Platform under their own referral link — and some of our pages are operated in partnership with healthcare and pharmacy organisations. Where that applies to you:

• Affiliates and referral partners can see that a sign-up came from their link, together with the referred person's name, email address, account status and the commission earned. They are shown this so they can be paid correctly. They do not receive your health data, assessments, lab results or medications.
• Partner hospitals and pharmacies: if you ask to be introduced to a partner organisation, or you complete an enquiry form on a page operated with one, we pass on the information needed to act on that request — your contact details and the details you submitted in the enquiry, which may include the condition or medication you are asking about, insurance details and your prescriber's information. We share this only for the request you made.
• Analytics and funnel tooling used on those partner pages may record the pages you viewed and the form entries you submitted, in order to measure and improve the enquiry process.

You can ask us at any time which partners have received information about you, and ask us to stop sharing it, using the contact details in Section 13.

5.5 We Never Sell Your Data

To be clear and unambiguous: we never sell, rent, lease, or trade your personal information or health-related data to any third party for any purpose, including marketing, advertising, or data brokerage. This applies to all categories of information we collect.

6. International Data Protection Compliance

MyEval AI serves users worldwide. We are committed to complying with applicable data protection laws in the jurisdictions where our users are located. This section outlines our compliance with specific international data protection frameworks.

6.1 General Data Protection Regulation (GDPR) — European Union / European Economic Area

If you are located in the European Union (EU) or European Economic Area (EEA), the following provisions apply to the processing of your personal data under the GDPR:

Legal Basis for Processing: We process your personal data based on the following legal bases:

• Explicit consent (Article 9(2)(a)): For the processing of health-related data (classified as "special category data" under the GDPR), we obtain your explicit, informed, and freely given consent before collecting or processing such data. You may withdraw this consent at any time.
• Contractual necessity (Article 6(1)(b)): For processing necessary to provide you with our services under the terms of your account agreement.
• Legitimate interest (Article 6(1)(f)): For processing necessary for our legitimate business interests, such as fraud prevention and Platform security, provided such interests do not override your fundamental rights and freedoms.
• Legal obligation (Article 6(1)(c)): For processing necessary to comply with legal obligations to which we are subject.

Your Rights as an EU/EEA Data Subject: Under the GDPR, you have the following rights:

• Right of access (Article 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data along with information about how it is processed.
• Right to rectification (Article 16): You have the right to have inaccurate personal data corrected without undue delay.
• Right to erasure (Article 17): You have the right to have your personal data deleted ("right to be forgotten") when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to restriction of processing (Article 18): You have the right to request the restriction of processing of your personal data under certain circumstances.
• Right to object (Article 21): You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Data Protection Authority Contact: To exercise any of your GDPR rights, please contact our Data Protection Officer at privacy@myeval.ai. We will respond to your request within 30 days.

International Data Transfers: Your data may be transferred to and processed in countries outside the EU/EEA (including the United States). When such transfers occur, we ensure appropriate safeguards are in place through the use of Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms recognized under the GDPR.

Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal data violates the GDPR. A list of EU supervisory authorities is available at edpb.europa.eu.

6.2 Lei Geral de Proteção de Dados (LGPD) — Brazil

If you are located in Brazil, the following provisions apply under the LGPD (Lei nº 13.709/2018):

• Explicit consent for sensitive data: Health-related data is classified as "sensitive personal data" under the LGPD. We obtain your explicit, specific, and informed consent before collecting or processing your health data, in accordance with Article 11 of the LGPD.
• Data subject rights: Under the LGPD, you have the right to confirmation of processing, access to your data, correction of incomplete or inaccurate data, anonymization or deletion of unnecessary data, data portability, deletion of data processed with consent, information about sharing with third parties, information about the possibility of denying consent, and revocation of consent.
• Supervisory authority: The Autoridade Nacional de Proteção de Dados (ANPD) is the supervisory authority responsible for overseeing compliance with the LGPD. You have the right to file a complaint with the ANPD.
• No sharing for economic advantage without consent: We do not share your sensitive health data with third parties for their economic advantage without your explicit consent, in compliance with LGPD requirements.

6.3 Digital Personal Data Protection Act (DPDP Act) — India

If you are located in India, the following provisions apply under the Digital Personal Data Protection Act, 2023:

• Consent-based processing: We process your personal data, including health-related data, based on your free, specific, informed, unconditional, and unambiguous consent, provided through a clear affirmative action.
• Data fiduciary obligations: As a data fiduciary, we are committed to processing your data only for lawful purposes for which you have given consent, maintaining data accuracy, implementing reasonable security safeguards, and deleting data once the purpose of processing has been fulfilled.
• Breach notification: In the event of a personal data breach, we will notify the Data Protection Board of India and affected data principals (users) in the form and manner prescribed by the Act.
• Cross-border transfer compliance: We transfer personal data outside India only to jurisdictions not restricted by the Central Government under Section 16(1) of the DPDP Act, and in compliance with any conditions prescribed for such transfers.

6.4 Personal Data Protection Act (PDPA) — Thailand

If you are located in Thailand, the following provisions apply under the PDPA (B.E. 2562):

• Explicit consent for sensitive data: Health data is classified as sensitive personal data under the PDPA. We obtain your explicit consent before collecting, using, or disclosing your health-related data, in accordance with Section 26 of the PDPA.
• Data Protection Officer (DPO): We have appointed a Data Protection Officer to oversee compliance with the PDPA. You may contact our DPO at privacy@myeval.ai.
• Data subject rights: Under the PDPA, you have the right to access your data, obtain a copy of your data, request correction of inaccurate data, request deletion or de-identification of data, request suspension of processing, request data portability, object to the collection or processing of your data, and withdraw consent.

6.5 United States — State Consumer Health Privacy Laws

MyEval AI is an educational platform, not a healthcare provider, health plan or healthcare clearinghouse, and is therefore generally not a “covered entity” under HIPAA (see Section 4). Several US states regulate consumer health data held by companies in exactly that position, and those laws apply to us.

• Washington — My Health My Data Act: If you are a Washington resident, or your consumer health data is collected in Washington, we collect and use that data only with your consent or as necessary to provide a product or service you have requested. We do not sell consumer health data. You may withdraw consent, request a list of the third parties we have shared your consumer health data with, and request deletion of that data; we will honour a deletion request by removing the data from our systems and directing our processors to do the same.
• Nevada — SB 370 (consumer health data): Nevada residents have equivalent rights of consent, access, and deletion in relation to consumer health data, and we do not sell that data.
• California — CCPA/CPRA: Health information you provide is “sensitive personal information.” We use it only to deliver the service you asked for and the purposes described in Section 3, never to infer characteristics about you for advertising. California residents may exercise the rights in Section 9, and we do not sell or share personal information as those terms are defined by the CPRA.
• Other state privacy laws: Residents of states with comprehensive privacy legislation — including Colorado, Connecticut, Virginia, Texas, Oregon, Montana and Utah — may exercise the access, correction, deletion, portability and opt-out rights described in Section 9. Where those laws treat health data as sensitive and require opt-in consent before processing it, we obtain that consent.

To exercise any of these rights, contact us using the details in Section 13. We will not deny you service, charge you a different price, or provide a lower quality of service because you exercised a privacy right.

6.6 Other Jurisdictions

MyEval AI also serves users in other jurisdictions with emerging or established data protection frameworks. We are committed to complying with applicable local data protection laws, including but not limited to:

• Vietnam: We comply with the provisions of the Law on Cybersecurity and the Decree on Personal Data Protection (Decree 13/2023/ND-CP), including requirements for consent, data localization assessments, and cross-border data transfer impact assessments where applicable.
• Bangladesh: We adhere to applicable data protection principles under the Digital Security Act and any subsequent personal data protection legislation, including obtaining appropriate consent for the collection and processing of personal and sensitive data.
• Kazakhstan: We comply with the Law of the Republic of Kazakhstan on Personal Data and Its Protection (No. 94-V), including requirements for consent-based processing of personal data, cross-border data transfer safeguards, and the rights of data subjects to access, correct, and delete their personal data.

If you are located in a jurisdiction not specifically listed above, we will process your data in accordance with the highest applicable standard among the frameworks described in this section and in compliance with your local data protection laws.

7. Data Retention

We retain your information only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. Our specific retention periods are as follows:

7.1 Active Account Health Data

Health-related information associated with an active account is retained for the duration of your account lifecycle. If you submit a request to delete your account, your health data will be permanently deleted within 30 days of the deletion request, except where retention is required by law or for the establishment, exercise, or defense of legal claims.

7.2 Inactive Accounts

If your account has been inactive (no login or Platform activity) for a continuous period of 12 months, we will permanently delete your health-related data. Before deletion, we will attempt to notify you at your registered email address, providing you with an opportunity to reactivate your account and retain your data. Personal account information (name, email) may be retained for a longer period to facilitate account recovery, unless you request deletion.

7.3 Payment Records

Payment transaction records, invoices, and related financial information are retained for 7 years from the date of the transaction, as required by applicable tax and financial reporting laws. This includes transaction amounts, dates, subscription details, and limited payment identifiers (such as last four digits of your card).

7.4 Audit Logs

Security audit logs, access logs, and system event logs are retained for 3 years from the date of creation. These logs are used for security monitoring, incident investigation, and compliance purposes. Audit logs are stored in a secure, tamper-resistant manner.

7.5 Analytics Data

Usage analytics data is anonymized after 26 months from the date of collection. Once anonymized, the data can no longer be linked to any individual user and may be retained indefinitely for statistical analysis and Platform improvement purposes. Prior to anonymization, analytics data is treated with the same security protections as other personal data.

8. Cookies and Tracking

We use cookies and similar technologies to enhance your experience on the Platform. A cookie is a small text file stored on your device by your web browser. Below is a description of the types of cookies we use:

8.1 Essential Cookies

These cookies are strictly necessary for the Platform to function and cannot be disabled. They include:

• Session cookies: Maintain your active session while you navigate the Platform, ensuring continuity of your interactions.
• Authentication cookies: Keep you securely logged into your account and verify your identity across page requests.
• Security cookies: Help detect and prevent fraudulent activity and protect your account from unauthorized access.

8.2 Analytics Cookies

These cookies help us understand how users interact with the Platform so we can improve its performance and usability. Analytics cookies collect information such as:

• Aggregated usage patterns and feature popularity
• Page load times and performance metrics
• Navigation flows and common user journeys
• Error rates and technical issues encountered

Analytics data is anonymized and aggregated. It is not used to personally identify you or track your individual behavior across other websites.

8.3 No Third-Party Advertising Cookies

We do not use third-party advertising or tracking cookies. We do not allow advertising networks, social media platforms, or data brokers to place cookies on the Platform to track your behavior or serve targeted advertisements. Your activity on MyEval AI is never shared with advertisers.

8.4 Cookie Consent

In compliance with the GDPR, the ePrivacy Directive (Directive 2002/58/EC), and other applicable cookie consent regulations, we implement a cookie consent mechanism that allows you to:

• View a clear explanation of the cookies used before they are set.
• Accept or reject non-essential cookies (analytics cookies).
• Modify your cookie preferences at any time through your account settings.
• Essential cookies cannot be disabled as they are required for the Platform to function.

9. Your Rights

Regardless of your location, we are committed to providing you with meaningful control over your personal data. You have the following rights:

9.1 Right to Access Your Data

You have the right to request a copy of the personal information we hold about you, including your health-related data, account information, and usage data. We will provide this information in a commonly used electronic format.

9.2 Right to Correct Inaccurate Data

You have the right to request the correction of any personal information that is inaccurate, incomplete, or outdated. You can update most of your information directly through your account settings, or you may contact us for assistance.

9.3 Right to Delete Your Data

You can delete your account at any time from Settings → Data & Privacy. This happens immediately, not on a queue, and it is not reversible. Here is exactly what it does:

• Your health information is permanently deleted. Lab imports and results, medications, mood and sleep logs, assessments and intake submissions, clinical documents and the text read out of them, AI-generated summaries and explanations, messages, reminders and appointments — together with every file you uploaded, including lab reports, medical documents, insurance cards, advance directives and your profile photo. The deletion is verified afterwards; if anything could not be removed we tell you rather than reporting success.
• Your identity is anonymised. Your name, phone number and address are erased and your email address is replaced with a placeholder, so the remaining record no longer identifies you. Your sign-in is disabled at the same time.
• Two things are deliberately kept. Payment and invoice records, which tax and accounting law requires us to retain; and the audit record showing that a deletion was requested and completed, which is the evidence that we honoured your request. Neither contains your health information, and the payment records are tied to the anonymised account rather than to your name.
• A one-way code of your email address is kept so that we do not contact you again after you have left. It cannot be turned back into your address.

If you would prefer to make the request by writing to us instead, contact us using the details in Section 13 and we will complete it within 30 days.

9.4 Right to Export Your Data (Portability)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV). You may also request that we transmit your data directly to another service provider where technically feasible.

9.5 Right to Withdraw Consent

Where our processing of your data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to the withdrawal. After withdrawal, we will cease processing the relevant data, unless another legal basis for processing exists.

9.6 Right to Object to Processing

You have the right to object to the processing of your personal data where processing is based on our legitimate interests. Upon receiving an objection, we will cease processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defense of legal claims.

9.7 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at privacy@myeval.ai. Please include the following in your request:

• Your full name and the email address associated with your account.
• A clear description of the right you wish to exercise.
• Any additional information that may help us verify your identity and locate your data.

We will acknowledge your request within 5 business days and fulfill it within 30 days. If we require additional time (up to a maximum of 60 additional days for complex requests), we will inform you of the extension and the reasons for the delay. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

10. Children's Privacy

The MyEval AI Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.

In compliance with the Children's Online Privacy Protection Act (COPPA) and equivalent international laws protecting minors, if we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such information from our systems. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us immediately at privacy@myeval.ai so that we can take appropriate action.

Users must affirmatively confirm that they are at least 18 years of age during the account registration process. Any account found to belong to an individual under 18 will be terminated and all associated data will be promptly deleted.

11. Security Measures

We take the security of your personal and health-related information seriously and implement comprehensive technical and organizational measures to protect it. Our security practices include:

11.1 Encryption

All data is encrypted in transit using TLS 1.2 or higher. All sensitive data, including health-related information, is encrypted at rest using AES-256 encryption. Database backups are also encrypted to ensure data protection at every stage.

11.2 Access Controls

We implement strict role-based access controls (RBAC) to ensure that only authorized personnel can access user data. Access is granted on a least-privilege basis, meaning individuals are given only the minimum level of access required to perform their job functions. Two-factor authentication using a one-time code sent by email is available on all accounts and can be enabled at any time from Account Settings; we recommend it for everyone with access to health information.

11.3 Regular Security Audits

We run automated security checks on a continuous schedule. Every change to our code is scanned for accidentally committed credentials before it can be merged. On a weekly cycle we scan our dependencies and container images for known vulnerabilities, generate a software bill of materials, and run an automated web-application security scan. A broader automated penetration-testing baseline runs quarterly. Dependency updates with security fixes are raised automatically.

These are automated assessments performed by tooling, not manual testing by an independent security firm. If and when we commission an independent manual penetration test or a formal third-party audit, we will update this section to say so rather than leaving the distinction to inference.

11.4 Incident Response Procedures

We maintain a documented incident response runbook that defines severity levels and the steps to be taken in the event of a security incident or data breach: detection and triage, appointing an incident commander, containment, eradicating the root cause, recovery under heightened monitoring, and publishing a summary with corrective actions. Each incident is required to produce a timeline, a record of impacted assets and users, and remediation actions with named owners.

Where an incident triggers a notification duty — including under the FTC Health Breach Notification Rule described in Section 4.3, or under applicable state law — we will notify affected users and the relevant authorities within the periods those rules require.

11.5 Supabase Row Level Security (RLS)

Our database infrastructure leverages Supabase's Row Level Security (RLS) policies to enforce data isolation at the database level. RLS ensures that each user can only access their own data, providing an additional layer of protection beyond application-level access controls. This means that even in the event of an application-level vulnerability, database-level policies prevent unauthorized cross-user data access.

11.6 Secure Development Practices

Our development team follows secure coding practices, including code reviews, static analysis, dependency vulnerability scanning, and adherence to the OWASP Top 10 security guidelines. We maintain separate development, staging, and production environments to prevent accidental exposure of production data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will:

• Update the "Last updated" date at the top of this Privacy Policy.
• Provide at least 30 days' advance notice before material changes take effect, by posting a prominent notice on the Platform.
• Send an email notification to the email address associated with your account for any material changes that affect how your personal or health-related data is collected, used, shared, or protected.
• Where required by applicable law (such as the GDPR), obtain your renewed consent before processing your data under the updated terms.

Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you should discontinue use of the Platform and may request deletion of your account and data.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the information below:

For EU/EEA Users — Data Protection Officer (DPO):

If you are located in the European Union or European Economic Area and have questions or concerns about how your personal data is processed, or if you wish to exercise your GDPR rights, you may contact our designated Data Protection Officer directly at:

We strive to respond to all inquiries within 5 business days and to resolve all requests within 30 days of receipt.