Privacy policy

ProForta is a wellness product for people on a GLP-1. Its whole premise is that your health data stays yours. This policy explains, in plain language, what the ProForta website collects, what the ProForta app and your node handle, and how you stay in control. If anything here is unclear, write to us and we will explain it.

What this website collects

The marketing site and the beta application form collect only what you choose to send:

• Your beta application: your email address, your GLP-1 status, the phone platform you use, and any optional details you add (name, medication, whether you use a CGM, and a free-text note).
• Basic attribution: if you arrive from a campaign link, the campaign tags in that link (UTM parameters) are stored with your application so we know which outreach reached you.

This application data is stored in our own database on Cloudflare (a D1 database named proforta-beta). We do not sell it, and we do not share it with advertisers or data brokers.

No third-party analytics or trackers

The ProForta website runs no third-party analytics, no advertising pixels, and no cross-site trackers. We measure the beta funnel with our own first-party counts, not a vendor that follows you around the web. If you subscribe to the newsletter, that is handled by Substack under Substack's own terms.

The beta application form, on that page only, runs Cloudflare Turnstile, a check that tells a person from an automated script before your application is stored. Cloudflare reads signals from your browser for the check, such as your IP address and browser type, and its Turnstile privacy addendum says they are not used to identify, profile or target anyone.

How the app and your node handle your health data

ProForta is built on a different model from most health apps. Your raw health data is never pooled in a corporate cloud.

• Data stays at source and on your own node. On Android, your phone reads your data through Google Health Connect. A Dexcom Stelo, if you connect one, is read through time-boxed permissions. That data flows to your own node, your private corner of LifeCare.ID®.
• Interpretation happens next to your data. Your personal agent runs on your node, turns raw readings into interpreted results (scores, bands, trends, and plain-language guidance), and the raw values are then purged from a short-lived working buffer.
• The app only ever sees interpreted results. The ProForta app displays scores and guidance, never raw biometric values. It keeps no durable copy of your raw health data.
• You grant and revoke access. Every source and every agent that can read your data is listed in LifeCare.ID®, and you can revoke any of it in one tap.

We do not sell your data

We do not sell, rent or license your data, we do not use it for advertising, and no one pays us for access to it. Most of it is never ours to sell, because of how ProForta is built:

• There is no pile of raw health data. Your phone keeps its Health Connect readings and the device maker keeps its own. Your node keeps interpreted results, one value per measure per day and the measures you add yourself; a raw payload that reaches it is deleted within 24 hours.
• LifeCare.ID® holds no health values. The layer that holds your identity and your permissions has nothing of your health in it.
• No app or partner reads your record without your permission. Each one needs a permission you grant in LifeCare.ID®, and you can withdraw it there without asking us.
• Deletion is final. Deleting your account destroys the key your readings are encrypted under and deletes the rest of your record; 30 days later no backup from before the deletion remains.

One part rests on our commitment rather than on the design. Today we also run the node that holds your interpreted record (your scores, trends, journey entries and what your guardian wrote to you), so we could technically read it. That is why the commitments on this page are written down, including the next one.

If the company changes hands or closes

ProForta, LifeCare.ID® and the node that holds your record are run today by one company, HCVC.net (Enbarca Inc). If it is sold, merges with another company or closes, or if it hands the running of your node to someone else:

• Your record is not sold or transferred as a business asset.
• You hear from us first. We tell you at least 30 days before anything changes, and in that time you can ask for a copy of your record or have it deleted.
• Your record moves only under this policy. It passes to a new operator of your node only if that operator takes on this policy as written. If none will, your record is deleted by destroying its key.

What we use your information for

• To decide whether we can offer you a place in the beta, and to email you your invite link at the address you applied with.
• To contact you about the beta, including launch and platform-availability updates you asked for.
• To understand, in aggregate, how the beta funnel is working.

How long we keep your data

Different parts of ProForta hold different things, so here is each one, how long it stays, and what ends it.

• On your phone. The ProForta app keeps no durable copy of your health data, raw or interpreted. It shows interpreted results fetched from your node and caches only the app shell and static files, never your data. Something you log yourself (a note, a weigh-in, a skipped recommendation) rests on your phone only while it is waiting to reach your node, and is removed the instant it sends. On Android, the app reads Health Connect (the last 30 days) each time it syncs, works out what the readings mean on the phone, sends those conclusions and one derived value per measure per day, and keeps no copy of the readings. What it does keep on the phone: your sign-in session and refresh token, the dates of any body scans you have added, your height, and a scan you added while offline until it is sent. Uninstalling the app removes it from the phone. Android's own device backup may keep the app's small settings store (your sign-in token and sync state, never health data) under your Google account until you clear that backup or sign out.
• On your node. Your interpreted record (scores, bands, trends, journey entries, what your guardian wrote to you, one derived value per measure per day from your phone, and the weigh-ins, body scans, lab imports and health events you add yourself) is kept for as long as you have an account, because a twelve-week programme and a muscle trend need history. Any raw provider payload that reaches the node is held in a working buffer for at most 24 hours and then deleted. Nothing else on your node expires on its own: it is kept until you ask us to delete it.
• Deleting it. Deletion is key destruction. Your record is encrypted with a key that is yours alone; we destroy that key, which makes everything encrypted under it unreadable, and plain-delete the rest. We do it within 30 days of your request, usually the same week. What survives is listed on the deletion page: the shape of the record with no content, a note that a deletion happened, and anonymised learning already made.
• Backups. Your node is backed up nightly. Backups are kept for 7 days on the node's own disk and 30 days offsite (Google Drive). The master key that unlocks records never travels in a backup. Your readings and daily values are encrypted under your key inside the backup and cannot be read from it; the rest of your record travels in the backup as it is, protected by where the backups are held and by the 7-day and 30-day limits. A backup taken before your deletion still holds your record as it stood that day, so if we ever restore one, we re-run every recorded deletion against it before the node is used again. After 30 days, no backup from before your deletion exists.
• Your LifeCare.ID® identity. LifeCare.ID® holds your identifier, the public half of your device key, your recovery email if you gave one, your permission diary, your resource registry, which version of the terms you accepted, and the passkeys and sessions issued to you. No health values. Access tokens expire within 20 minutes and sign-in sessions within 24 hours; the installed app's connection to your identity lasts at most 90 days, or 30 days unused, and ends when you sign out. On request your identifier is retired and your passkey unbound; your permission diary and resource registry stay as the record of what was permitted and withdrawn. The full list and your rights are in the LifeCare.ID® privacy notice.
• Demo visits. If you try the demo, LifeCare.ID® mints a visitor identity flagged as demo and removes it, with its sessions, after 7 days. What the demo wrote on the node under that identity stays flagged as demo, is excluded from every count, and is not deleted on its own.
• Your beta or challenge application. Kept in our own database (Cloudflare D1) for the duration of the beta and a reasonable period after, so we can honour invites and follow up, and deleted on request to privacy@proforta.com. A copy of this database rides in the nightly backup, with the same 7-day and 30-day limits. If you applied through the conversation on the app's join page, what you said there is held on the node with your record and deleted with it.
• App errors and usage events. When the app hits an error or you complete a step (an onboarding step, a consent, a card done or skipped), it records the event on our node in a store separate from your health data, with no readings or scores in it, although some events say what you logged (a dose, a protein check, how you felt). Some events carry your identifier; some are deliberately anonymous. This store has no fixed expiry and is kept as the operational record of the beta. Deleting your account does not currently clear it.
• Email. Email you send to privacy@proforta.com stays in our mailbox as the record of your request and our answer.

Your choices and your rights

• Deletion on request. Email us and we will delete your application and associated beta data. We will confirm when it is done.
• Revoke data access. You can revoke any app's or agent's access to your health data at any time through LifeCare.ID®, independently of us.
• Access and correction. Ask us what we hold about your application, or to correct it.

Children

ProForta is for adults. It is not directed at anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

This is an early beta and this policy may change as the product matures. We will update the date at the top and, for material changes, tell beta participants directly.

Contact

For any privacy request, including deletion, write to privacy@proforta.com. Deleting your account and your data has its own page, which explains exactly what is destroyed and the little that is kept: how to delete your account and data. LifeCare.ID® is a registered trademark of Enbarca Inc. (doing business as HCVC.net).

Read the beta terms · Back to home