Privacy Policy

The short version (the full policy is below; please read it too)

• Your health data is yours. We never sell it and never use it for ads.
• We only share it with the providers that run Steady (named below). Our AI provider keeps nothing after answering you and never trains on your data.
• We’re a small team, and sometimes we look at your data, including chats and documents, to fix problems and make Steady better. Only the people who need to.
• You can turn off analytics, export your data, or delete everything, any time.
• You must be 18 or older.

Steady helps you hold your own health history: your records, your appointments, and the questions you want to ask your doctor. We built it because keeping all of that in your head is exhausting, and we know it means trusting us with some of the most private things about you. This policy explains exactly what we do with that trust.

Steady is a tool to help you understand and organise your own health information. Steady is not a doctor. We don’t provide medical advice, we don’t diagnose, and we’re not a covered entity under HIPAA. (More on what that means for you below.)

What we collect

About you. When you sign up, we collect your name and email through our sign-in partner.

The things you share with Steady. Your chat messages, the documents and labs you upload, the conditions and medications you record, and the symptoms and check-ins you log: all the things that make Steady useful to you. This includes the feedback you send us about Steady, which may itself include health details. When voice recording is available, the recordings and transcripts you choose to make will live here too.

Basic usage data. Which screens you open, how often you check in, and when something errors out. This helps us see what’s working and what isn’t. This never includes your health details (see PostHog below).

How we use it

• To give you the Steady you signed up for: remembering what you’ve shared, making sense of your records, preparing you for your next appointment, and surfacing what’s worth raising.
• To make Steady better: understanding which features actually help and where we’re slowing you down, using usage data that carries none of your health details.
• To keep you safe: detecting unusual activity, fixing crashes, and answering your support questions.

We do not use your health information to advertise to you, and we do not sell it.

Who we share it with, and what each sees

We share as little as possible, and only with companies that help us run Steady.

• Clerk handles your sign-in. Clerk sees your name and email.
• Anthropic is the AI provider that generates Steady’s replies. It receives your chat messages and the content of documents you upload, only so it can produce the response you asked for. We use Anthropic under zero data retention terms: your content is not stored by Anthropic after your request is answered, and is never used to train their models.
• Railway (Railway Corp.) is our hosting and storage provider; your data is stored securely there.
• PostHog is our product-analytics tool. It receives usage events like “opened the chat tab” or “submitted a check-in,” linked to your account so we can understand how Steady is used. PostHog never sees the words you typed, your lab values, your symptoms, your prep briefs, or anything from your documents.

When we add voice recording, transcription will be handled by a dedicated provider under the same zero-retention standard, and we’ll name that provider here before it goes live.

We never share your health data with advertisers or data brokers, and we don’t give your data to anyone we haven’t named here.

What we don’t do with your data

• We don’t sell it.
• We never share your health data with advertisers or data brokers.
• We don’t send your chat content, lab values, symptoms, prep briefs, or document content to PostHog or any analytics or marketing tool.
• Our AI provider doesn’t retain your content after answering you, and doesn’t use it to train their models.

Your choices and rights

• Turn off product analytics.Toggle the switch on the Privacy & data screen. New events stop immediately.
• Delete your account and data. Tap your account icon → Delete account. This permanently removes your documents, your thread, your chat history, and your account from Steady’s servers. Usage events already sent to PostHog can take up to 30 days to fully clear from their systems.
• Get a copy, correct something, or ask us anything. Email hashim@withsteady.health and we’ll help.

Depending on where you live, you have additional rights, set out below.

Your health data (Washington, Nevada, Connecticut, and everywhere)

Because your health information deserves extra care, we keep a separate Consumer Health Data Privacy Notice that explains in detail what health data we collect, how we use it, who sees it, and how to exercise your rights over it. If you’re in Washington, Nevada, or Connecticut, that notice is written with your state’s law in mind. Please read it alongside this policy.

If you’re in the UK or EEA

Your health information is “special category data” under the UK GDPR / GDPR, and we treat it that way.

• Our legal basis for using your health information is your explicit consent, which you give when you sign up and start using Steady. For your name, email and running your account, the basis is our contract with you (providing the service you signed up for).
• You can withdraw your consent at any time, and you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or provide it in a portable format. Email hashim@withsteady.health.
• You have the right to complain to your data protection authority. In the UK that’s the Information Commissioner’s Office (ICO).
• We’re hosted in the EU. Where our providers process your data in the United States, we rely on an approved transfer mechanism, either the UK-US Data Bridge (where the provider is certified under it) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, and we’ve assessed those transfers. We flag your health information as sensitive when it’s transferred.

If you’re in California

Health information is “sensitive personal information” under California law. We use it only to provide and improve Steady for you, never to advertise to you, and we don’t sell or “share” it for cross-context advertising. You can request access, deletion, and correction, and you won’t be treated differently for exercising those rights. Email hashim@withsteady.health.

How we keep your data safe

Everything is encrypted in transit and at rest. We’re a small team, and some of us may access your data, including your conversations and documents, to run the service, fix problems, and improve Steady’s answers. That access is limited to those who need it and protected by multi-factor authentication. We don’t use real user data in development.

Children

Steady is for adults. You must be 18 or older to use it, and we don’t knowingly collect data from anyone under 18. If we learn that we have, we’ll delete it.

Where your data lives

Steady is hosted in the EU (Railway). Our AI provider, Anthropic, processes your messages in the United States under the transfer protections described above, and voice transcription will work the same way when it launches. Our analytics provider (PostHog) runs in the EU.

Changes to this policy

If we make a meaningful change, we’ll tell you inside the app before it takes effect and, where the change affects how we use your health information, ask you to read and agree again.

Contact

Steady is operated by STEADY HEALTH LTD (company no. 17302077), registered office 30 Churchill Place, London, United Kingdom, E14 5RE. We are the data controller for your information.

Questions, requests, or concerns: hashim@withsteady.health.