Privacy Policy

1. What We Collect

We collect different categories of data depending on which features you use. Here is the complete list:

• Profile data -- name, email address, date of birth, gender, time zone. Collected when you create your account.
• Biomarker data -- test results, blood count values, health scores. You enter them manually or upload lab reports.
• Supplement and medication data -- what you take, dosage, frequency, schedule. You log this yourself.
• Sleep data -- sleep duration, quality, timing. Entered manually or synced from wearables.
• Nutrition data -- meals, macronutrients, food preferences. You log this yourself.
• Exercise data -- workouts, activity type, duration, intensity. Entered manually or synced from wearables.
• Voice data -- audio recordings when you use voice input. The audio is transcribed and then processed. See Section 4 for details.
• Device data -- browser type, operating system, screen size, IP address. Collected automatically for security and compatibility.

We do not collect data from any source other than what you explicitly provide or what your browser sends automatically. We do not buy data from data brokers nor scrape data from other platforms.

2. Legal Basis for Processing (LGPD Art. 7 / Art. 11)

Brazilian law (LGPD) requires us to have a specific legal basis for processing each category of personal data. Health data is considered "sensitive" and requires explicit consent under Article 11. Here is the complete mapping:

3. Disclosure Regarding AI Processing

4. Voice Data

When you use voice input, your audio is sent to OpenAI Whisper or Deepgram for transcription. We do NOT send your name, email, user ID, or any other identifying information along with the audio. The audio is processed exclusively to convert speech to text.

The resulting text transcription is stored in your account and may be processed by the AI to generate insights. The original audio file is deleted from our servers after successful transcription.

You can disable voice features at any time. You can also delete individual transcriptions from your data history.

5. Data Sharing

We use the following service providers (subprocessors) to operate TwinSelf. Each receives only the minimum data necessary for its function:

6. Your Rights (LGPD Art. 18)

Under the Brazilian General Data Protection Law, you have the following rights regarding your personal data:

• Access -- Request a copy of all personal data we hold about you. Available under Settings > Export Data.
• Correction -- Correct any inaccurate or incomplete data. You can edit your profile and health records directly in the app.
• Deletion -- Request the permanent deletion of your data. Go to Settings > Account > Delete Account. We process deletions within 30 days.
• Portability -- Export your data in a structured, machine-readable format (JSON/CSV). Available under Settings > Export Data.
• Withdraw consent -- Withdraw your consents at any time, without affecting the lawfulness of prior processing, by emailing privacy@twinself.health or deleting your account. The three sign-up consents are required to use TwinSelf, so withdrawing them ends the use of the account.
• Disable AI -- Pause all AI features while keeping health tracking active. Go to Settings > Privacy ("Pause Twin").
• Information -- Learn which entities we share data with (see the subprocessor table above) and the purpose of each disclosure.
• Objection to processing -- Object to processing based on legitimate interest if you believe your situation warrants it.

To exercise any of these rights, use the app settings or send an email to privacy@twinself.health. We respond to all requests within 15 business days (the LGPD allows up to 15 days for simple requests, with a possible extension for complex cases upon notification).

If you believe we have not adequately addressed your request, you have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD).

7. Data Retention

• Health data -- Retained for as long as your account is active. Deleted within 30 days after account deletion.
• Data exports -- Generated export files are automatically removed from our servers after 48 hours.
• Usage analytics -- Anonymous analytics data is removed after 365 days.
• Audit logs -- Access and security logs are retained for 6 years to comply with Brazilian recordkeeping requirements.
• Voice recordings -- Deleted immediately after transcription. Only the text transcript is retained.
• Payment records -- Retained by Stripe in accordance with its data retention policy and applicable financial regulations.

8. Security

We implement the following technical and organizational measures to protect your data:

• Encryption in transit -- All connections use TLS 1.3. No unencrypted HTTP requests are accepted.
• Encryption at rest -- The database and backups are encrypted with AES-256.
• Row-Level Security (RLS) -- PostgreSQL RLS policies ensure that each user can access only their own data at the database level.
• Access logging -- All data access is logged for audit purposes.
• Authentication -- JWT tokens are stored in HttpOnly cookies, preventing JavaScript from accessing authentication tokens.
• Secret detection -- Pre-commit hooks check for the accidental inclusion of secrets or credentials in source code.
• Identifier minimization -- We filter text health data to remove recognized identifiers before sending it to AI. These filters do not guarantee anonymity; identifiers may remain in free text and context. Document images are sent as captured with consent.

9. Cookies

TwinSelf uses essential cookies and analytics cookies. Essential cookies (HttpOnly) securely store your session token and are strictly necessary for the platform to function.

To measure site usage we use two tools, and only on public pages (such as home, pricing, blog, sign-up and legal pages) — never inside your account. Plausible Analytics counts visits without cookies and without personal data. PostHog is only turned on if you accept cookies in the banner; it receives the page address reduced to its template (no e-mail, code, token or health question) and is never linked to your identity. We do not use Google Analytics.

To know which campaign brought each sign-up, we keep in your browser, for up to 90 days, where your first visit came from: the campaign parameters, the referring site's domain and the landing page — never the full address or an e-mail. When you open the sign-up page, the campaign and the button that brought you are included in the sign-up counts of Plausible (and of PostHog, if you accepted cookies), without your name or e-mail. If you create an account, this origin is stored with it at TwinSelf.

Change my cookie choice

10. Minors

TwinSelf is not designed, marketed, or intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at privacy@twinself.health and we will promptly delete it.

11. International Data Transfer

Your data is stored on servers in the United States (Railway) and processed by AI providers in the United States (Anthropic, OpenAI, Google Gemini, Deepgram). This constitutes an international data transfer under the LGPD.

This transfer is carried out under Art. 33, II(a) of the LGPD -- with your specific and informed consent, provided when creating your account. We are in the process of formalizing contractual clauses (Data Processing Agreements) with our subprocessors to reinforce the protection of your data at a level equivalent to the LGPD.

You can withdraw your consent for the international transfer of data at any time, by emailing privacy@twinself.health or deleting your account. Since the hosting and the AI providers are outside Brazil, this consent is required to use TwinSelf: withdrawing it ends the use of the account.

To enable AI processing, health data is transferred to servers of Anthropic, PBC (and, when unavailable, OpenAI or Google), located in the United States. The international transfer is based on your specific and informed consent (Art. 33, II "a" of the LGPD), provided at sign-up. The Data Processing Agreements (DPA) with these providers are being formalized. The data is not used by these providers to train AI models. You may request detailed information about this transfer at any time via dpo@twinself.health.

12. Data Protection Officer (DPO)

For any questions, requests, or complaints regarding your personal data, please contact our Data Protection Officer:

13. Policy Version

This Privacy Policy was last updated in April 2026. Version 1.0.

When we make material changes to this policy, we will notify you by email and in-app notification at least 15 days before the changes take effect. You will be asked to review and accept the updated policy.