Privacy policy

What Rhythm is

Rhythm is a personal health record (PHR). You choose what to log — vitals, labs, medications, activity, and documents — so you can see your health picture in one place. Rhythm is educational software; it does not provide medical advice, diagnosis, or treatment.

Data we process

• Account data — email, display name, and authentication identifiers from Supabase Auth.
• Health data you enter — measurements, journal entries, medications, care events, and files you upload. Stored in our Postgres database (Supabase) with row-level security scoped to your tenant and health subject.
• Files — lab PDFs, images, and avatars in Supabase Storage under tenant/subject paths.
• Technical data — essential cookies for sign-in and consent; server logs without health payloads.

What we do not do

• We do not sell your personal or health data.
• We do not use third-party advertising SDKs or ad networks in the app.
• We do not put health information into analytics or error-reporting payloads.
• We do not use marketing cookies in Phase 1 — only essential cookies for authentication and remembering your consent choice.

Subprocessors

Rhythm relies on Supabase (authentication, database, storage) and hosting providers for the web application. A detailed subprocessor list will be published before general availability. Data is processed in regions configured for your Supabase project.

Your rights

Depending on your location (including GDPR in the EU/EEA), you may have rights to access, correct, export, or delete your data. Pro users can request a data export from the You hub. Account deletion flows are documented in the product roadmap. Contact support for requests we cannot yet self-serve.

Cookies

We use essential cookies for session management and to store your cookie consent preference (rhythm_consent). You can review or change this from You → Privacy when signed in.

Contact

Questions about this policy: use in-app support when available or contact the operator listed on the marketing site footer.