Privacy Policy

Lattice is run by Aya Caps LLC, and this describes the system we actually built rather than a system a template imagined. If we change the system, this document changes on the same day.

Who holds your data

Nine companies, and I will name all of them.

Who	What they hold	Why
Supabase	Your account, your screening answers, your training logs	It is the database and the login system
Stripe	Your card payment details	It takes card payments. We never see a card number
PayPal	Your PayPal payment details, if you pay that way	It takes PayPal payments. We never see your PayPal login
Resend	Your email address and the emails we send you	It delivers email
Zoho	The emails you send us	It runs our support mailbox
Anthropic	The text of your chat and email conversations with us	Its AI assistant, Claude, reads them to answer you. Covered below
Google	Your answers to the bone quiz, with no name or email address	Its AI model, Gemini, writes the opening of your quiz result page from them
Vercel	Server logs, IP address, request data	It hosts the site
Meta	Which of our pages you viewed, which checkout you started, and what you bought and for how much	Conversion reporting for advertising. Covered in full below

Those nine are the whole list. There is no analytics warehouse, no CRM, no data broker, nobody else. If we add one, this page changes and account holders get an email before it starts processing anything.

What we collect

Because you gave it to us. Your email address. Your display name if you set one. Your equipment path and timezone. Your rescan date if you enter one.

Because you answered the screening. Eight questions. Your T-score band, whether you have fractured in the last two years and the detail if you have, whether you have had a vertebral fracture, any spinal conditions you told us about, your bone medication status, a short list of health flags, whether a doctor has restricted your exercise, and whether you can get up off the floor unaided.

Because you trained. Every set. Weight, reps, RPE, timestamps, which sessions you completed, your technique checkpoints, your benchmarks and your streak.

Because you took a quiz. Your answers to the quiz questions. They stay in a cookie on your own device for thirty days, so your result page can be read again, and we do not store them in our database. For the bone quiz they are also sent to Google, with nothing that says who you are, to write the opening of your result page.

Because you arrived from somewhere. Which landing page variant you saw, UTM parameters on your first visit, and the time of that first visit.

Because a web server logs things. IP address, browser, pages requested.

The screening answers deserve their own paragraph

Those eight answers are health information about you. Real health information, the kind you would tell a doctor.

We store them because the program cannot be safe without them. Bone density band, fracture history and specific spinal conditions are what determine whether high-intensity loading is appropriate for a given person, which is why the screening gates access rather than just decorating it. They are held in your own row in the database, and Supabase row-level security means your account can read your rows and nobody else's account can.

Two more things you should know. The screening table is append-only, so if you retake it we mark the old answers superseded rather than overwriting them, and we keep the trail. And a very small number of named people on our side can read individual member records through the admin tools, for support and for refunds. Every one of those reads is logged with the name of the person who made it.

We are almost certainly not a HIPAA covered entity, since we are not a provider, a plan, or a clearinghouse. We hold what you tell us in the screening to that standard anyway, because it is medical information whatever the statute calls us.

Payments

Stripe and PayPal handle checkout, and you choose which. Your card number never touches our servers and is never stored by us, and neither do your PayPal credentials.

If you pay by card, what we keep is a Stripe customer identifier and a payment method token, which is what makes the one-click upgrade offer work without asking you to type your card again. That token can charge your card. It only ever does so when you press a button showing the total.

If you pay by PayPal, we keep PayPal's identifiers for the order. PayPal does not permit a stored one-click charge of that kind, so every subsequent payment sends you back to PayPal to approve it.

No programme we sell is a recurring charge. Two things we sell are: the Membership and The Door Frame. Neither starts unless you buy it, both name their price and their period where they are sold, and both are cancelled from your account page. If you have a plan that renews once a year, we email you 35 days before each renewal with the date, the amount and how to cancel.

Email

Resend sends everything: your magic link, the welcome email, the milestone emails, and the rescan reminders.

Every reminder and nudge we send has a link at the bottom that stops them in one visit, with no sign-in. Your email program may also show its own Unsubscribe button, which does the same. The emails about your own money and your own account keep coming: a receipt, a refund, a renewal notice, a way to sign in. You cannot unsubscribe from the magic link, because that is how you log in.

Conversations

When you write to us in the chat on our pages, or by email, we keep the conversation. That means your words, our replies, and when each one was sent.

An AI assistant reads it so it can answer you. The assistant is Claude, made by a company called Anthropic.

We also read these conversations to learn from them. First we take out names, email addresses, phone numbers and links. Then we look at what women ask before they buy, what worries them, and what they hope for. That helps us decide what our pages and our ads say. What we keep from this is short phrases, with nothing in them that says who wrote them.

We never quote a conversation in an ad. Not your words, and not your name.

After you buy, the app may ask you two short questions: what made you decide, and what nearly stopped you. You do not have to answer. If you do, we read your answers in the same way, and we never quote them in an ad either.

Advertising and tracking

Here is the line we drew.

On the public pages, meaning every page you can open without signing in, we run advertising pixels and conversion tracking. That includes the home page, the advertorial, the quiz, the sales pages, the checkout, the offer pages straight after it, and pages like this one. Meta is the only ad platform we report conversions to. The pixel stops at the sign-in screen: it never runs on the sign-in pages or anywhere inside the app.

Two things are worth being exact about, because "we use a pixel" hides them.

We report from our own servers as well as from your browser. When you view a marketing page, begin a checkout or complete a purchase, we send Meta a record of that event directly, not only through the script in your browser. Blocking scripts in your browser does not stop the server-side copy.

What Meta is told. Which page an event happened on, and so which programme or offer that page sells. The page's address goes with every event, for example /o/pelvic or /checkout?line=pelvic. Most events also carry a short label for the page: the sales page and the version of it you were shown, the checkout, the quiz, or an offer after checkout such as a year of a programme or The Door Frame. A purchase event says that you bought, what it was worth and how many items it had. So Meta can tell which programme you looked at and which one you bought.

To match an event to a Meta account, the copy from our servers can also carry:

• Your email address, hashed. Hashed means Meta receives a scrambled version rather than the address itself, and it is still personal data
• Your phone number, your first and last name, and your city, state, zip code and country, hashed, when you gave them to the payment provider
• An account identifier of ours, or a visitor identifier if you have no account, also hashed
• Your IP address and your browser's user agent, not hashed
• Meta's own _fbp and _fbc cookies if your browser has them, not hashed

Both copies of each event carry the same identifier so that Meta counts it once rather than twice.

What Meta is never told. Your screening answers, your tier, your T-score band, your fracture history, whether you take any medication, or your quiz answers. Your quiz result travels in a cookie on your device and never in a page address. And before any page address goes to Meta, we take out your email address and anything in it that looks like one.

No ad-network pixel fires on any authenticated route. Once you are logged in and inside the app, no pixel runs and nothing you do there is reported. Not your session completions, not your screening tier, not the fact that you were on a page about osteoporosis. That was a deliberate build decision and it is enforced in code, not in policy. The one thing that still reaches Meta from our servers is a purchase, wherever you made it.

What we never do

We do not sell your data. Not to anyone, at any price, including on a change of control. We do not rent it, trade it, or hand it to a data broker. We have never received a payment of any kind for personal information and we do not intend to.

What we do do, and it is worth naming rather than hiding behind the word "sell", is share the advertising events above with Meta. Several US state privacy laws treat that as "sharing for targeted advertising" whether or not money changes hands, and you can switch it off. See Your control, below.

We do not send your health answers to an advertiser. Not to Meta, not to anyone, in any form, hashed or otherwise.

We do not use your training logs or your screening answers to target advertising at you.

Your control

Three things you can ask for by email, and we will do all three:

Export. Everything we hold on you, in a machine-readable file. Screening answers, every set you logged, orders, the lot. You get it within seven days.

Stop the advertising reporting. The Meta events described above are, under California law and the laws of a growing number of other states, "sharing" your personal information for targeted advertising. You have the right to tell us to stop, and this is us telling you that rather than waiting to be asked. Write to support@latticehealth.online with the email address you use here and we will exclude it from every conversion event we send, browser and server both, within seven days. It costs you nothing and it changes nothing about your access.

Or let your browser say it. We honour the Global Privacy Control signal. If your browser sends it, we treat it as the same request. The Meta pixel does not load, and no event about your visit is sent from your browser or from our servers. If you give us your email address at checkout on that browser, we add it to the same list, so later events about your purchase are not sent either. There is no switch for this in the app yet, so the signal and the address above are the two ways to ask.

Deletion. We delete your account, your screening answers and your training history. Financial records tied to a purchase have to survive for tax and accounting reasons, and Stripe and PayPal each keep their own transaction records independently of us. So deletion means the health and training data is gone and a payment record remains. I would rather say that plainly than promise a clean wipe I cannot deliver.

Depending on where you live you may also have the right to correct your data, object to processing, appeal a decision we make about a request, or complain to a regulator. California, Colorado, Connecticut, Virginia and a number of other states each give their residents some version of this, and the UK and EU give another. We honour those requests wherever you are, rather than checking which statute covers you first, and we do not charge for them or ask you to create an account to make one.

Write to support@latticehealth.online and say what you want done. If we ever refuse a request we will tell you why in writing, and you can reply to argue with it.

Your health data. The screening answers, the quiz answers and the training you log are health data under the laws of Washington, Nevada and Connecticut, and we treat them that way for everybody. Your health data says what we collect, why, who receives it and why, and how to see it, delete it or withdraw your consent.

How long we keep things

Active accounts keep everything, because a strength chart is worthless without three years of history behind it. Dormant accounts are deleted after three years with no sign-in, and we email you before we do it. Server logs are kept for 30 days.

Security

Magic link login, so there is no password of yours to leak. Row-level security on every member table. Encrypted in transit and at rest by our providers.

No system is perfectly safe. If we suffer a breach that affects your data we will tell you, and we will tell you what was in it rather than sending you a paragraph of nothing. We will tell you within 72 hours of knowing.

Children

This is a program for postmenopausal women. Nobody under eighteen should have an account and we do not knowingly keep data on anyone under eighteen.

Changes

If we add a provider or change what we collect, this page changes and account holders get an email. The version at the top of this page changes with it.