Privacy Policy
Last updated: July 21, 2026 · Your back data is health data, and we treat it as the most sensitive kind there is. This is the full policy, in plain language.
The essentials in 20 seconds
We collect the minimum. Your data lives on your phone first. Your medical reports are processed and discarded — never stored. Nothing about your health is used for ads or sold. And you can delete everything whenever you want.
What we collect
Account: your email. Health: your assessment answers, pain check-ins and progress. Technical: device model and app errors. Subscription: your plan status — Apple processes the payment and we never see your card.
Where your data lives
The app is local-first: your plan and history live on your phone. With an account, we also keep an encrypted cloud backup so you never lose progress when switching phones; only your account can read it.
Your reports and photos
When you upload the text of a report or a posture photo, it travels encrypted, the AI processes it to give you the explanation, and it is discarded. It is never stored on our servers or used to train any model.
How we use AI
To build your plan and explain your studies we send the minimum data needed to AI providers (Google Gemini, with OpenAI as backup), which act as processors and are prohibited from using your data to train their models.
Who we share with
Only providers that make the app work: Supabase (account and backup), Apple and RevenueCat (subscription), PostHog (usage metrics, never health data) and the AI providers. We do not sell data and there are no third-party ads.
Security
Everything travels encrypted (TLS) and is stored encrypted at rest. The database enforces row-level rules: each user can only read their own data. If a breach ever affects you, we will notify you as the law requires.
Retention and deletion
We keep your data while you have an account. In the app, under Profile → Account, you can export it and delete your account with its cloud backup in one step; local data disappears when you uninstall the app. Reports are never kept.
Your rights
Access, correct, export, delete, and withdraw consent — wherever you live (GDPR, CCPA and equivalents). Most of it you can do yourself in the app; for the rest, write to [email protected] and we will respond.
Minors and changes
SpinalAI is for adults 18+: we do not knowingly collect data from minors and we remove accounts that are. If this policy changes in a significant way, we will tell you inside the app before it takes effect.