Privacy Policy

The short version (the full policy is below; please read it too)

• Your health data is yours. We never sell it and never use it for ads.
• We only share it with the providers that run Steady (named below). None of our AI providers use your data to train their models.
• We’re a small team, and sometimes we look at your data, including chats and documents, to fix problems and make Steady better. Only the people who need to.
• We measure how the app is used, never your health information.
• You can export your data or delete everything, any time.
• You must be 18 or older.

Steady helps you hold your own health history: your records, your appointments, and the questions you want to ask your doctor. We built it because keeping all of that in your head is exhausting, and we know it means trusting us with some of the most private things about you. This policy explains exactly what we do with that trust.

Steady is a tool to help you understand and organise your own health information. Steady is not a doctor. We don’t provide medical advice, we don’t diagnose, and we’re not a covered entity under HIPAA. (More on what that means for you below.)

What we collect

About you. When you sign up, we collect your name and email through our sign-in partner.

The things you share with Steady. Your chat messages, the documents and labs you upload, the conditions and medications you record, and the symptoms and check-ins you log: all the things that make Steady useful to you. This includes the feedback you send us about Steady, which may itself include health details. When you send a voice note instead of typing, the audio and the text it becomes live here too.

Basic usage data. Which screens you open, the actions you take in the app, when you open the app, how often you check in, and when something errors out, along with diagnostic data and application logs. Measuring this is a normal part of running Steady, and it helps us see what’s working and what isn’t. This never includes your health details (see PostHog below).

How we use it

• To give you the Steady you signed up for: remembering what you’ve shared, making sense of your records, preparing you for your next appointment, and surfacing what’s worth raising.
• To make Steady better: understanding which features actually help and where we’re slowing you down, using usage data that carries none of your health details.
• To keep you safe: detecting unusual activity, fixing crashes, and answering your support questions.

We do not use your health information to advertise to you, and we do not sell it.

Who we share it with, and what each sees

We share as little as possible, and only with companies that help us run Steady.

• Clerk handles your sign-in. Clerk sees your name and email.
• Anthropic is the AI provider that generates Steady’s replies. It receives your chat messages and the content of documents you upload, only so it can produce the response you asked for. We use Anthropic under zero data retention terms: your content is not stored by Anthropic after your request is answered, and is never used to train their models.
• OpenAI, Inc. turns your voice notes into text. It receives the audio you record, only to transcribe it. OpenAI does not use your audio to train its models, and holds it only briefly for abuse monitoring before deleting it.
• Railway (Railway Corp.) runs our servers and database, in the EU.
• Cloudflare, Inc. stores the documents you upload, in the EU (Cloudflare R2).
• PostHog, Inc. is our product-analytics tool. It receives usage events like “opened the chat tab” or “submitted a check-in,” along with app opens, error and diagnostic data, and application logs, so we can understand how Steady is used. Those events carry a pseudonymous ID we generate for you, never your name, your email, or your sign-in account ID. PostHog never sees the words you typed, your lab values, your conditions, your medications, your symptoms, your prep briefs, or anything from your documents, including their titles.
• RevenueCat, Inc., Apple, and Google handle your subscription. They see that you have an account and which plan you’re on, never any of your health information.

We never share your health data with advertisers or data brokers, and we don’t give your data to anyone we haven’t named here.

What we don’t do with your data

• We don’t sell it.
• We never share your health data with advertisers or data brokers.
• We don’t send your health details to PostHog or any analytics or marketing tool. What PostHog never sees is listed in full above.
• Our AI providers never use your data to train their models. Anthropic keeps nothing after answering you, and OpenAI holds voice-note audio only briefly before deleting it.

Your choices and rights

• Delete your account and data. Tap your account icon → Delete account. This permanently removes your documents, your thread, your chat history, and your account from Steady’s servers. Usage events already sent to PostHog can take up to 30 days to fully clear from their systems.
• Get a copy, correct something, or ask us anything. Email hashim@withsteady.health and we’ll help.

Depending on where you live, you have additional rights, set out below.

Your health data (Washington, Nevada, Connecticut, and everywhere)

Because your health information deserves extra care, we keep a separate Consumer Health Data Privacy Notice that explains in detail what health data we collect, how we use it, who sees it, and how to exercise your rights over it. If you’re in Washington, Nevada, or Connecticut, that notice is written with your state’s law in mind. Please read it alongside this policy.

If you’re in the UK or EEA

Your health information is “special category data” under the UK GDPR / GDPR, and we treat it that way.

• Our legal basis for using your health information is your explicit consent, which you give when you sign up and start using Steady. For your name, email and running your account, the basis is our contract with you (providing the service you signed up for). For usage analytics, the basis is our legitimate interests in understanding how Steady is used and improving it. You can object to that at any time by emailing hashim@withsteady.health.
• You can withdraw your consent at any time, and you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or provide it in a portable format. Email hashim@withsteady.health.
• You have the right to complain to your data protection authority. In the UK that’s the Information Commissioner’s Office (ICO).
• We’re hosted in the EU. Where our providers process your data in the United States, we rely on an approved transfer mechanism, either the UK-US Data Bridge (where the provider is certified under it) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, and we’ve assessed those transfers. We flag your health information as sensitive when it’s transferred.

If you’re in California

Health information is “sensitive personal information” under California law. We use it only to provide and improve Steady for you, never to advertise to you, and we don’t sell or “share” it for cross-context advertising. You can request access, deletion, and correction, and you won’t be treated differently for exercising those rights. Email hashim@withsteady.health.

How we keep your data safe

Everything is encrypted in transit and at rest. We’re a small team, and some of us may access your data, including your conversations and documents, to run the service, fix problems, and improve Steady’s answers. That access is limited to those who need it and protected by multi-factor authentication. We don’t use real user data in development.

Children

Steady is for adults. You must be 18 or older to use it, and we don’t knowingly collect data from anyone under 18. If we learn that we have, we’ll delete it.

Where your data lives

Steady is hosted in the EU: our servers and database on Railway, and your documents in Cloudflare R2. Anthropic processes your messages, and OpenAI transcribes your voice notes, in the United States under the transfer protections described above. Our analytics provider (PostHog) runs in the EU, in Frankfurt.

Changes to this policy

If we make a meaningful change, we’ll tell you inside the app before it takes effect and, where the change affects how we use your health information, ask you to read and agree again.

Contact

Steady is operated by STEADY HEALTH LTD (company no. 17302077), registered office 30 Churchill Place, London, United Kingdom, E14 5RE. We are the data controller for your information.

Questions, requests, or concerns: hashim@withsteady.health.