Privacy Policy

Last updated: October 16, 2026

This policy explains what NavHealth.ai collects through our website and mobile apps, why, who processes it for us, and the choices you have. NavHealth.ai is for adults (18 and over) and provides educational information only. It does not diagnose or treat any condition.

1. Information We Collect

• Account information: your name, email address and account ID from Google Sign-In.
• Health information you provide: lab reports you upload (PDFs and photos), the biomarker values we extract from them, and anything you add to your profile, such as conditions, medications, supplements, family history, goals, and lifestyle details like diet, exercise, sleep, height and weight.
• Profile details: optional date of birth, sex, country and ethnicity, used to compare your results with the right reference ranges.
• Family profiles: if you add a family member, the details you enter about them. You must have their permission, or be their parent or legal guardian.
• Conversations: the questions you ask our AI guide, NavU, and its answers.
• Usage and diagnostics: in-app events (for example, that a report was uploaded), crash reports, and device and app-integrity identifiers. We do not record your screen or collect the content of your reports for analytics, and we do not use an advertising ID.
• Your region: to suggest a region at sign-in, the app reads your device's country setting (SIM or locale). Only the region you choose is sent to us. We do not collect your precise or approximate location.

2. How We Use Your Information

• To provide the service: extract and explain your results, compare them with population data, answer your questions, and track changes over time.
• To keep your account secure and the service reliable, including fixing crashes.
• To understand which features are used, in aggregate, so we can improve them.

We do not sell your data, use it for advertising, or share your health information with anyone for their own purposes.

3. Service Providers

These companies process data on our behalf, under contract, only to run the service:

• Google (Firebase and Google Cloud): sign-in, hosting, storage, crash reporting (Crashlytics), app analytics, app-integrity checks, and the Gemini AI models that read your reports and answer your questions.
• MongoDB Atlas: the database that stores your account and health data.
• PostHog: product analytics on in-app events. It receives your account ID and event names, not your health data.
• Tavily: web search for current health research. It receives search phrases our AI writes, not your identity or your reports.
• Razorpay: payments, on our website only, if you buy a subscription. Card details go directly to Razorpay and never reach us.

Some product suggestions include links to retailers. If you turn this on and follow a link, we may earn a commission. We pass no health data to the retailer.

4. Where Your Data Is Stored

Your account and health data are stored in the region of your account. For accounts in India, that is Mumbai, India. Processing can happen elsewhere: the Google AI models that read your reports and answer your questions may run outside your region, and analytics and crash reporting may process limited data in other countries, including the United States.

5. Security

We encrypt your data in transit using TLS/HTTPS (with certificate pinning in our mobile apps) and at rest. Health data cached on your device is stored in an encrypted database, and sensitive profile fields are additionally encrypted on our servers. Access is restricted to your authenticated account.

Because we generate AI interpretations of your results, your data is processed in readable form on our secured servers. We do not provide end-to-end (client-only) encryption that would prevent us from processing it to deliver your insights.

6. Retention & Deletion

Conversations are kept for up to 90 days. Your profile, reports and results are kept until you delete them or your account. You can delete individual reports and conversations at any time, or permanently delete your account and all associated data from within the app (Settings, “Delete All My Data”) or by request on our account deletion page. We complete deletion requests within 30 days. We may keep a minimal record that a deletion happened, with no health data, as required by law.

7. Your Choices and Rights

You can view and correct your information in the app, withdraw consent for optional features such as retailer links, and delete your data as described above. Depending on where you live, you may have further rights, such as to access a copy of your data or to complain to a data protection authority. To exercise any of these, contact us.

8. Children

NavHealth.ai is not intended for anyone under 18, and we do not knowingly let children create accounts. A parent or legal guardian may add a child as a family profile and manage it on the child’s behalf.

9. Changes to This Policy

We will post any changes here and update the date above. For material changes, we will notify you in the app or by email.

10. Contact

Questions or requests about your privacy: support@navhealth.ai