Encrypted when sent and stored
Member data is scrambled while it travels and while it is stored, using current industry-standard encryption.
The encryption keys are changed on a schedule.
Trust & security
How we protect your members' data
Your platform runs on Google Cloud, health data is handled to HIPAA standards, and nothing your members tell you is ever sold. If you ever leave, you take a full copy of it with you.
What we promise about your data
- Encrypted when sent and stored
- HIPAA-ready
- Access limited by role
- Each view is logged
- Never sold
- Yours to take
How it's protected
Encrypted at each step, from the app to storage
Member data is encrypted the moment it leaves the app, stays encrypted while we store it, and is only opened by people with a reason to. You can take a full copy whenever you want.
Our promises
What we promise about your data
HIPAA-ready
If you handle health data, we sign a business associate agreement (BAA), the contract HIPAA requires, as standard and at no extra charge.
Signed before any work starts.
Access limited by role
Your staff see only what their role needs. Our own team needs a physical security key to get in.
Everyone has their own login, and passwords are never shared.
Each view is logged
Every time someone views or changes a member record, it is logged with their name. Nobody can edit the log.
You can take the log with you, along with everything else.
Never sold
Your members' data is never sold, and it is never used to train AI for another business.
The AI on your account learns from your members' data only.
Yours to take
A full copy of everything, any time you want it, without asking us first.
In standard formats any other provider can open.
Your data
What we do with your data
What we keep
Only what your app needs to work.
- Member profiles and the account details your app collects.
- Activity: classes, workouts, health intake steps, messages sent.
- Message history, and what happened after each one.
- Cortex's scores for each member, kept inside your account.
What we never keep
Some things we never hold at all.
- Card or bank details. Payments stay with your payment processor.
- Readable passwords. They are scrambled so even we cannot see them.
- Anything bought from or sold to data brokers.
- Advertising trackers we have no use for.
What you can take
Any time, without asking us first.
- Every member record and their full activity history.
- Every message sent, and how each one landed.
- Each Cortex decision and score, with its reason and the data behind it.
- A dated, written confirmation when you ask us to delete it all.
Cortex AI
How Cortex decides who hears from you
Cortex is the AI that picks which members get a message, what it says and when it goes out. These are the rules it works inside.
Your team approves the campaigns
Cortex suggests campaigns and your team approves them before anything goes out. If you turn on autopilot for a goal, such as fewer cancellations, it works inside the limits below.
Limits it stays under
Quiet hours and a weekly cap on messages for each member. Cortex checks both before each send, and sends less to members who have started ignoring messages.
A reason saved with each decision
Each decision is stored with the reason for it and the member data it used, so you can see why someone got a message, or why they didn't.
Your members' data stays with your app
Cortex uses your members' activity for your app only. It is never used to train AI for another business, and it is never sold.
Time online
99.99%
across the last 12 months
Devices our apps reach
120M+
each one on an encrypted connection
AI decisions a day
4.2B
each one written to a log
Time per AI decision
<50ms
including the security checks
What happens to member data, start to finish
Encrypted on the device
Before anything leaves a member's phone, watch or TV, the connection is encrypted.
Stored in one safe place
Encrypted in storage and kept separate from every other business we work with. Your data is not copied around between systems.
Opened only when needed
Staff see only what their role allows, and every look is logged with a name against it.
Yours to take or delete
Ask for a full copy and you get all of it, in a standard format. Ask us to delete it and you get it confirmed in writing.
Health data
Health data is handled to HIPAA standards, and our security controls are aligned with SOC 2, the common checklist for how tech companies protect data. The full documentation and the BAA are available to your team under a confidentiality agreement.
If something goes down
Your platform runs on Google Cloud, on infrastructure we have operated since 2012, and has held 99.99% uptime over the last 12 months. If something does go wrong, our own team handles it and keeps you informed.
Ask for our full security documents
Health data handled to HIPAA standards · full copy any time · your data stays yours