Privacy Policy

MyProtocol (myprotocol.in) · Last updated 9 October 2026

MyProtocol is a private dashboard that helps you record and organise your own health protocol — the compounds you track, your bloodwork, and biometrics you choose to import. This policy explains what we collect, how it is used, and the control you have over it.

Information we collect

Account details you provide: name, username, and optionally email, phone, age, sex, height and weight.
Information you enter: your protocol (compounds, doses, routes, schedules), dose logs, bloodwork/lab values, health conditions, your medical and surgical history (past illnesses, operations, implants, hospital stays, reactions and family history), and inventory.
Lab report files you choose to upload (PDF or photo), so your markers can be entered for you (see below).
Documents you choose to keep — photos or PDFs of OPD slips, prescriptions, discharge summaries, operation notes and scan reports (see below).
Apple Health (iPhone) or Health Connect (Android) data you choose to sync (see below).
WHOOP heart-rate variability, only if you connect a WHOOP account (see below).
Questions you ask the in-app assistant and its answers, and Progress summaries you generate, if you use them.
Notification token, only if you enable dose reminders, so we can deliver them.

Lab reports you upload, and AI reading

If you upload a lab report, we store the file only so your markers can be read out of it and entered on your dashboard. The file is deleted from our servers automatically the moment your markers are entered — we do not keep it.

To read a report, we may send it to Anthropic’s Claude API, which returns the values it reads so they can be filled in for you. Anthropic acts as our processor for that request.
Per Anthropic’s commercial terms, content sent through their API is not used to train their models.
AI reading is not automatic. It runs only when you choose it for a specific report, and the values it reads are always shown to you for review and confirmation first — nothing is written to your record unchecked. Because each read costs us money, it is limited to one report every 60 days per person; uploading reports and typing markers in by hand are not limited
If you would rather your reports were never sent to an AI service, don’t upload the file — enter your markers manually in the Labs tab instead, or email us to have AI reading disabled for your account.

The assistant and Progress summaries

If these are switched on for your account, using them sends information to Anthropic’s Claude API so it can answer — only at the moment you ask a question or generate a summary, never in the background.

What is sent: your question; your name and sex; your protocol (items, doses, schedules, how to take them, purpose, course dates and milestones) and how many scheduled doses were logged; your lab results with their reference ranges; any diagnosed conditions, allergies, and pregnancy, kidney or liver details you entered; the medical and surgical history you entered; and your recent messages, so a conversation can continue. For a family profile you manage, it is that profile’s information.
What is never sent: anything from Apple Health, Health Connect or WHOOP, or the health score calculated from it.
Anthropic acts as our processor. Per its commercial terms, content sent through its API is not used to train its models.

Apple Health (HealthKit)

If you turn on Health sync in the iPhone app, it reads selected metrics — weight, heart rate, resting heart rate, heart-rate variability, blood glucose, blood pressure, blood oxygen, respiratory rate, steps and sleep — with your explicit permission. From version 26, if you choose to, it also reads the medicines you pick in Apple’s own sheet from the Health app’s Medications, and the doses you logged as taken or skipped in the last 14 days, so those doses are marked in your protocol; medicines you do not pick are never visible to us. We access them read-only and never write to Apple Health. You control access in iOS Settings → Privacy & Security → Health, and can revoke it at any time.

Health Connect (Android)

If you turn on Health sync in the Android app, it reads selected records from Health Connect — weight, heart rate, heart-rate variability, blood glucose, blood oxygen, respiratory rate and steps — with your explicit permission. We access them read-only and never write to Health Connect. You control access in your phone’s Health Connect settings, and can revoke it at any time.

How device health data is used

These rules cover everything that reaches us from Apple Health, Health Connect or WHOOP:

It is used only to display and chart your metrics, and the health score calculated from them, on your own dashboard.
It is never sent to any AI service — including the in-app assistant and Progress summaries — not even as a score calculated from it.
It is never used for advertising or marketing, never sold, and never shared with third parties or data brokers. The only outside company that holds it is our hosting provider, which stores it.
It is never used to decide creditworthiness, insurance, lending or employment.
It is deleted with your account (see Retention and your controls below).

WHOOP

If you connect a WHOOP account, we read one number: your heart-rate variability (HRV), once per day. We do this because WHOOP does not send HRV to Apple Health — WHOOP measures it as RMSSD while Apple Health stores SDNN — so for a WHOOP wearer it is otherwise missing from your dashboard entirely.

We request read-only access to your recovery and cycle data, and store only the HRV value and its date. We do not store your recovery score, resting heart rate, blood oxygen or skin temperature from WHOOP, even though the response contains them.
It is shown as its own reading, kept separate from any Apple Health HRV, because the two are different measurements and should not be read as one trend.
We never write anything to WHOOP, and never share this data with third parties or use it for advertising.
You can disconnect at any time in Settings, which deletes the stored access from our server. To revoke it at WHOOP's end as well, remove the app from your WHOOP account.
Connecting is entirely optional — you sign in at WHOOP, and we never see your WHOOP password.

Family profiles

An account holder can keep a profile for someone in their care — a parent or a child — who doesn’t use the app themselves. That person has no login; the account holder enters and manages the information, and must have the right to do so (see section 3 of the Terms of Use).

Reminders for the profile go to the account holder’s devices, with the person’s name in front.
AI features used for the profile — the assistant, Progress summaries and lab reading — run through the account holder’s account and count against its limits, under the same rules as above.
Deleting the account holder’s account deletes their family profiles and all of the profiles’ data.
Handing a profile over. The account holder can give the person their own login. We email them a link; they set their own password and accept these terms themselves. From then on the information is theirs: the account holder can no longer see or change it, and any share links made for it stop working. Assistant conversations and Progress summaries go with it.

Letting a family member help with your account

Someone with their own MyProtocol account can ask to help manage yours. Nothing is shared unless you accept, from your own signed-in account.

Once you accept, they can open your Today, Protocol, Labs, Stock and Health pages — including Health readings synced from your phone, and the health details in your profile (conditions, allergies, pregnancy) that those pages use — and log doses, change your protocol, stock and labs for you. A dose they log is marked with their name.
The request shows their username and the start of their email, so you can tell who is asking. If you decline, they can’t ask again for 30 days. When you accept, we email you to confirm.
Your dose and reorder reminders also go to their devices, with your name in front. If a dose still has nothing logged four hours after it was due, they get one “missed” alert for it (they can turn these off).
They cannot see your assistant conversations or Progress summaries, change your profile, email or password, make share links, or export your data.
You keep your own login, and your AI features count against your own limits.
Either of you can end it at any time on the Family page; access stops immediately, and their device no longer keeps copies of your pages for offline viewing. Changing your password does not end it — Settings shows who can open your account. Deleting either account ends it too.

If your account comes through a clinic

Some accounts are set up through a clinic or doctor. If yours is:

Your clinic’s name, and its logo if it has one, appears in the app, on any share link you create, and on account emails such as password resets.
Your clinic can ask us to show or hide parts of the app for your account — for example the assistant or the health score. We make that change. It changes what you see, not what is stored: nothing is deleted, and it can be switched back.
Your clinic can suggest medicines to start with. When you first open the app they appear as a list to tick; nothing is added unless you tick it, and you can change the dose and time first. Your choices are not sent to the clinic.
Your clinic does not get a login to MyProtocol and cannot open your account. A clinician sees your information only through a share link you choose to create, and only what that link includes, until it expires or you revoke it.
To have the clinic removed from your account, contact us. Your information is not affected.

Visits to the public website

When someone who is not signed in opens one of our public pages — the home page, the research library, compare, half-life, calculators, glossary or support — we add one to a daily count of page views and visitors. This is counted on our own server. There is no third-party analytics service and no tracking cookie.

Your IP address is never stored. To tell visitors apart within a single day, we keep a one-way scrambled code made from your IP address and browser, mixed with a random key that is replaced every day. The key and the codes are discarded when the next day's counting begins, so a visit cannot be linked to another day or traced back to you. Only the daily totals are kept.
We record which public page was opened and, if you followed a link, the name of the website it came from (for example google.com) — never the full link.
Signed-in members and the MyProtocol app are not counted, and none of this is ever connected to an account or to health data.

How we use your information

Solely to operate the service for you: to display your dashboard, chart trends, and send the dose reminders you enable. We do not use it for profiling or advertising.

How it is stored and protected

Your data is stored on our server and transmitted over encrypted HTTPS connections. Access to your account requires your login — see Who can see your data. Sensitive configuration is kept outside the public web root.

Who can see your data

You, anyone you give a share link to (only what that link shows, until it expires or you revoke it), anyone you have let help manage your account (see Letting a family member help), and — for a family profile — the account holder who manages it. That includes a clinic your account comes through: it sees only what you share by link (see If your account comes through a clinic).

Our administrators can also open an account, to answer a support request, fix a problem, or enter the markers from a lab report you uploaded. Opening an account needs a separate administrator sign-in with a password and a one-time code sent by email. Any change made while an administrator has your account open is recorded in a log. We don’t open accounts for any other reason.

Documents you keep

Unlike lab reports, documents are kept — that is what they are for — until you remove them or delete your account.

Photos are stored as a fresh copy made by our server: the location, camera and time details a phone adds to a photo are not kept. PDFs are stored as you uploaded them.
Only you can open them — and, for a family profile, whoever manages it, or anyone you have let help manage your account. A doctor or hospital can open them only through a link you share that includes Documents: read-only, until the link expires or you revoke it, and every page they open is listed in that link’s access history. They are never on your emergency card.
Documents are never sent to an AI service. They are stored for you to open, and nothing in them is read, extracted or analysed.
Removing a document deletes its pages from our server. They are included when you download your data.

Sharing

We do not sell or rent your personal or health information, and we never share it for advertising or marketing. There is no third-party advertising or analytics tracking of your health data. Your email and phone number are never used for marketing.

The only third parties that ever process your data are the service providers needed to run the app, strictly on our instructions and only for that purpose:

Anthropic — only when a lab report you uploaded is read with AI, when you use the assistant or a Progress summary, or when, at your request, an administrator reads a photo of your prescription to add it to your protocol (the photo is not kept). Only the information described above. Never anything from Apple Health, Health Connect or WHOOP. Not used to train their models.
Our hosting provider — stores the app and your data, and sends our account emails (sign-up codes and password resets).
Google Fonts — our pages load their typefaces from Google, so your browser contacts Google’s font servers, which see your IP address and browser details. No health information, account details or page content is sent to Google.
Apple / Google — only to deliver dose reminders to your device, if you enable them.

Retention and your controls

We keep your information until you delete it. You can permanently delete your account and all associated data at any time from Settings → Delete account, in the app or on the website — you do not need the app: sign in at myprotocol.in/delete_account.php. This removes your account record and your protocol, logs, bloodwork, synced health metrics, reminders and inventory. One narrow exception survives deletion: a one-way cryptographic hash of your email address and the date you last used AI lab reading. We keep it only so the 60-day fair-use limit cannot be reset by deleting and re-creating an account. A hash cannot be turned back into your email address, cannot be used to contact you, and is not linked to any health data — it can only be matched if the same address signs up again. Apart from that hash, nothing else is retained — with one delay: copies of deleted data can remain in backups — ours and our hosting provider’s — for up to 60 days, until those backups are replaced.

Children

MyProtocol is intended for adults (18+) and is not directed to children.

Changes

We may update this policy; material changes will be reflected by the “Last updated” date above.

Contact

Questions? Email support [at] myprotocol [dot] in.

Not medical advice. MyProtocol records and organises what you enter — medicines, supplements, lab results and anything else you track. It does not prescribe, recommend, or endorse any substance, dose, or protocol, and nothing here is diagnosis or treatment. Some things people track, such as research peptides, are not approved by the U.S. FDA or other regulators for those uses. Always consult a licensed clinician before making any health decision.

← Back