Laymen, Inc. (“Laymen”, “we”, “us”) builds tools that help you understand your own health. This Privacy Policy explains what we collect, why we collect it, where it lives, and what control you have over it.
The categories we collect
- Account data: email address, the OAuth provider you signed in with (Google, Apple), and a hashed identifier for that provider.
- Health graph data (Baseline only): the information you enter during onboarding (date of birth, biological sex, height and weight, ethnicity, conditions, medications, allergies, family health history, health goals), the lab results and wearable vitals you upload or connect, and the symptoms you log.
- Genomic data (Genome only): the raw and interpreted output of any sequencing you choose to do through us. Stored encrypted, only accessible to you and the smallest number of Laymen engineers strictly necessary to operate the service.
- Usage data: the questions you ask, the answers we generate, and coarse interaction events that we use to improve product quality. We track via Vercel Analytics with no third-party trackers and no question text in any event payload.
- Payment data: handled by Stripe. Laymen never sees your card number. We retain only the Stripe customer id and subscription status.
Where it lives
Health graph data is stored in a US-region Supabase Postgres database with row-level security enforced on every table. Encryption at rest is on by default; encryption in transit (TLS) is required. Genome raw files live in a separate object store with per-user customer-managed keys.
How we use it
- To answer your questions and personalize the responses you receive (Baseline tier and above).
- To surface insights and morning briefs based on patterns in your own data.
- To run the operational pieces of the product: rate limiting, billing, fraud detection, email and iMessage delivery, debugging when something breaks.
- To improve Laymen, only in aggregate. Anything that contributes to model training or public research is de-identified, requires your explicit opt-in, and excludes the categories listed under “What we never share” below.
What we never share
- We do not sell your data.
- We do not share identifiable health, genomic, or clinical data with advertisers.
- We do not share your data with insurers, employers, law enforcement, or any third party without a valid legal demand and your prior notification (where legally permitted).
- Aggregate, anonymized statistics may be published or shared with research partners only where the aggregation would not let anyone re-identify an individual.
Third-party services
- Supabase — database and authentication.
- Anthropic — large-language-model inference for the reasoning chain. Question text is sent to Anthropic under their API terms. Anthropic does not train on API traffic.
- Stripe — billing.
- Vercel — application hosting, edge caching, web analytics.
- AirNow / OpenWeather — environmental context (AQI, UV index) keyed on a coarse city identifier, never your precise coordinates.
Your rights
- Access: download a full copy of your health graph at any time from Settings → Data.
- Correction: edit any field of your health graph directly in the app.
- Deletion: delete your account from Settings → Data → Delete account. We remove your data within 30 days, with limited exceptions for billing records that law requires us to retain.
- Portability: the data export above is structured JSON and is yours to move anywhere.
- CCPA / California rights: California residents may also exercise the right to know what categories we have collected and to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information in the sense those terms are defined under the CCPA.
Retention
We retain your health graph for as long as you keep an account. Deleted accounts are purged from production within 30 days and from backups within 90. Anonymized aggregates used for product analytics may persist indefinitely.
Children
Laymen is intended for users 18 and older. We do not knowingly collect information from children under 13. Parents and guardians who learn that their child has signed up should email hello@laymen.com and we will remove the account.
Changes
We will notify you by email at least 30 days before any material change takes effect. Substantive amendments will be tracked in a public changelog.
Contact
Privacy questions and rights requests: privacy@laymen.com. Mail: Laymen, Inc., 100 Pine Street, San Francisco, CA 94111.