Delete your account and your data

You can have your ProForta account and the health data held for you deleted, at any time, without giving a reason. This page explains how to ask, what gets destroyed, what is kept, and why.

How to ask

Email privacy@proforta.com from the address you gave when you joined, and say you want your account and data deleted. That address is the one we can match to your account, so asking from it is what lets us act without demanding more proof of who you are.

If you no longer have that address, write from any address and say so. We will ask you for something that ties you to the account. We would rather make that slightly awkward than delete the wrong person's record.

You do not need the app installed to ask, and you do not need to sign in.

We confirm when it is done, and we do it within 30 days. In practice it is usually the same week.

What gets destroyed

Everything we hold that is about you personally:

• Your interpreted health record: your scores, your bands, the weights and body composition you logged or your scale sent, your journey entries, and everything your guardian ever wrote to you.
• Your profile: sex, height, the medication context you gave, your recovery email.

Your raw health readings were never ours to delete. The app reads Health Connect on your phone, works out what the readings mean there, and sends only the conclusions. Individual sleep records, heart rate samples and glucose readings never left your device. Deleting those means deleting them in Health Connect or uninstalling the app, and that is entirely in your hands.

Your LifeCare.ID® identity

Your identity is retired rather than destroyed. On request we retire the identifier, so it can no longer be used to sign in, and we unbind the passkey from it, so the key on your phone opens nothing here.

What stays is the record of permissions: what you granted, what you withdrew, and which holder was told to erase what. It carries no health content. A procedure that removes the identifier itself is with our counsel, and we will say so here when it exists rather than imply it already does.

How the deletion works, and why it is worth explaining

Your record is encrypted with a key that belongs to you alone. Deletion destroys that key.

Once it is gone, your content cannot be read again by anyone, including us, and including by someone who steals the whole database. There is no copy of the key elsewhere and no way to recompute it. This is stronger than deleting rows, because deleted rows can survive in backups for months. A destroyed key takes every live copy with it at once.

Backups are the one place where timing matters, so here is all of it. We keep backups for 30 days. A backup made before your deletion still holds your key as it stood on that day, so for up to 30 days a restore of that older copy would bring the key back with it. Two things close that window. The backups expire on their own at 30 days, and if an older copy is ever restored, the node re-runs your erasure against it before the system is used again, working from the deletion record it keeps for exactly this purpose. After 30 days there is no copy of your key left anywhere to restore.

What is kept, and why

Three things survive. None of them holds your content, and none of them names you:

• The shape of the record, with no content. The system keeps a tamper-evident chain proving that entries existed, in what order, and that nothing was altered. After deletion the links remain and every payload is unreadable. This is what lets us prove we have not quietly rewritten history, which is the same property that makes the record trustworthy while you are using it.
• A note that a deletion happened. Who asked, when, and how many entries were affected. Never what they said. Without this we could not prove a deletion was carried out.
• Anonymised learning already made. While you were using ProForta, your entries may have fed things that no longer point at anyone: examples used to test the guardian, learned parameters inside the models, and group figures. None of it carries your name or your identifier, and none of it can be taken apart afterwards to lift one person's share back out. Anonymised learning already made is permanent. You can keep your future entries out of shared learning with one switch in your profile, and until that switch reaches your app, by writing to privacy@proforta.com.

Counts that never named you, such as how many people took part in a programme, stay as counts.

Deleting less than everything

You do not have to choose all or nothing.

You can withdraw an app's permission to read your record and keep the record, from your LifeCare.ID® panel, which also shows you every access anyone has made. You can disconnect Health Connect on your phone and stop new data arriving while keeping what is there. Or you can delete everything, as above. Ask for whichever you want.

Questions

Write to privacy@proforta.com. Our privacy policy covers what is collected and why.

ProForta is operated by Enbarca Inc., doing business as HCVC.net.