Privacy Policy

Lattice is run by Aya Caps LLC, and this describes the system we actually built rather than a system a template imagined. If we change the system, this document changes on the same day.

Who holds your data

Six companies, and I will name all of them.

Who	What they hold	Why
Supabase	Your account, your screening answers, your training logs	It is the database and the login system
Stripe	Your card payment details	It takes card payments. We never see a card number
PayPal	Your PayPal payment details, if you pay that way	It takes PayPal payments. We never see your PayPal login
Resend	Your email address and the emails we send you	It delivers email
Vercel	Server logs, IP address, request data	It hosts the site
Meta	That somebody viewed a marketing page, started a checkout, or bought	Conversion reporting for advertising. Covered in full below

That is the whole list. There is no analytics warehouse, no CRM, no data broker, nobody else. If we add one, this page changes and account holders get an email before it starts processing anything.

What we collect

Because you gave it to us. Your email address. Your display name if you set one. Your equipment path and timezone. Your rescan date if you enter one.

Because you answered the screening. Eight questions. Your T-score band, whether you have fractured in the last two years and the detail if you have, whether you have had a vertebral fracture, any spinal conditions you told us about, your bone medication status, a short list of health flags, whether a doctor has restricted your exercise, and whether you can get up off the floor unaided.

Because you trained. Every set. Weight, reps, RPE, timestamps, which sessions you completed, your technique checkpoints, your benchmarks and your streak.

Because you arrived from somewhere. Which landing page variant you saw, UTM parameters on your first visit, and the time of that first visit.

Because a web server logs things. IP address, browser, pages requested.

The screening answers deserve their own paragraph

Those eight answers are health information about you. Real health information, the kind you would tell a doctor.

We store them because the program cannot be safe without them. Bone density band, fracture history and specific spinal conditions are what determine whether high-intensity loading is appropriate for a given person, which is why the screening gates access rather than just decorating it. They are held in your own row in the database, and Supabase row-level security means your account can read your rows and nobody else's account can.

Two more things you should know. The screening table is append-only, so if you retake it we mark the old answers superseded rather than overwriting them, and we keep the trail. And a very small number of named people on our side can read individual member records through the admin tools, for support and for refunds. Every one of those reads is logged with the name of the person who made it.

We are almost certainly not a HIPAA covered entity, since we are not a provider, a plan, or a clearinghouse. We hold what you tell us in the screening to that standard anyway, because it is medical information whatever the statute calls us.

Payments

Stripe and PayPal handle checkout, and you choose which. Your card number never touches our servers and is never stored by us, and neither do your PayPal credentials.

If you pay by card, what we keep is a Stripe customer identifier and a payment method token, which is what makes the one-click upgrade offer work without asking you to type your card again. That token can charge your card. It only ever does so when you press a button showing the total.

If you pay by PayPal, we keep PayPal's identifiers for the order. PayPal does not permit a stored one-click charge of that kind, so every subsequent payment sends you back to PayPal to approve it.

No programme we sell is a recurring charge. Two things we sell are: the Membership and The Door Frame. Neither starts unless you buy it, both name their price and their period where they are sold, and both are cancelled from your account page.

Email

Resend sends everything: your magic link, the welcome email, the milestone emails, and the rescan reminders.

You can unsubscribe from the lifecycle emails at any time. You cannot unsubscribe from the magic link, because that is how you log in.

Advertising and tracking

Here is the line we drew.

On the public marketing pages, meaning the advertorial, the quiz, the sales pages and the checkout, we run advertising pixels and conversion tracking. Meta is the only ad platform we report conversions to. Those pages are the only ones that carry it, and it stops at the sign-in screen.

Two things are worth being exact about, because "we use a pixel" hides them.

We report from our own servers as well as from your browser. When you view a marketing page, begin a checkout or complete a purchase, we send Meta a record of that event directly, not only through the script in your browser. Blocking scripts in your browser does not stop the server-side copy.

What goes in that record is the event, the value of any purchase, and identifiers Meta uses to match it to an account. Specifically:

• Your email address, hashed. Hashed means Meta receives a scrambled version rather than the address itself, and it is still personal data
• An account identifier of ours, also hashed
• Your IP address and your browser's user agent, not hashed
• Meta's own _fbp and _fbc cookies if your browser has them, not hashed

Both copies of each event carry the same identifier so that Meta counts it once rather than twice.

What we never send is what the event was about. Meta is told that a purchase happened and what it was worth. It is not told your screening answers, your tier, your T-score band, your fracture history, whether you take any medication, or which programme you bought.

No ad-network pixel fires on any authenticated route. Once you are logged in and inside the app, no advertising platform receives an event from us. Not your session completions, not your screening tier, not the fact that you were on a page about osteoporosis. That was a deliberate build decision and it is enforced in code, not in policy.

What we never do

We do not sell your data. Not to anyone, at any price, including on a change of control. We do not rent it, trade it, or hand it to a data broker. We have never received a payment of any kind for personal information and we do not intend to.

What we do do, and it is worth naming rather than hiding behind the word "sell", is share the advertising events above with Meta. Several US state privacy laws treat that as "sharing for targeted advertising" whether or not money changes hands, and you can switch it off. See Your control, below.

We do not send your health answers to an advertiser. Not to Meta, not to anyone, in any form, hashed or otherwise.

We do not use your training logs or your screening answers to target advertising at you.

Your control

Three things you can ask for by email, and we will do all three:

Export. Everything we hold on you, in a machine-readable file. Screening answers, every set you logged, orders, the lot. You get it within seven days.

Stop the advertising reporting. The Meta events described above are, under California law and the laws of a growing number of other states, "sharing" your personal information for targeted advertising. You have the right to tell us to stop, and this is us telling you that rather than waiting to be asked. Write to support@latticehealth.online with the email address you use here and we will exclude it from every conversion event we send, browser and server both, within seven days. It costs you nothing and it changes nothing about your access. There is no toggle for it in the app yet, so the address above is the mechanism.

Deletion. We delete your account, your screening answers and your training history. Financial records tied to a purchase have to survive for tax and accounting reasons, and Stripe and PayPal each keep their own transaction records independently of us. So deletion means the health and training data is gone and a payment record remains. I would rather say that plainly than promise a clean wipe I cannot deliver.

Depending on where you live you may also have the right to correct your data, object to processing, appeal a decision we make about a request, or complain to a regulator. California, Colorado, Connecticut, Virginia and a number of other states each give their residents some version of this, and the UK and EU give another. We honour those requests wherever you are, rather than checking which statute covers you first, and we do not charge for them or ask you to create an account to make one.

Write to support@latticehealth.online and say what you want done. If we ever refuse a request we will tell you why in writing, and you can reply to argue with it.

How long we keep things

Active accounts keep everything, because a strength chart is worthless without three years of history behind it. Dormant accounts are deleted after three years with no sign-in, and we email you before we do it. Server logs are kept for 30 days.

Security

Magic link login, so there is no password of yours to leak. Row-level security on every member table. Encrypted in transit and at rest by our providers.

No system is perfectly safe. If we suffer a breach that affects your data we will tell you, and we will tell you what was in it rather than sending you a paragraph of nothing. We will tell you within 72 hours of knowing.

Children

This is a program for postmenopausal women. Nobody under eighteen should have an account and we do not knowingly keep data on anyone under eighteen.

Changes

If we add a provider or change what we collect, this page changes and account holders get an email. The version at the top of this page changes with it.