Your data, your program.

What we store

• Your account email and display name.
• Daily logs, journal entries, lab markers, biometrics, and program-plan adherence.
• Optional notes and photos you choose to attach.
• OAuth tokens (e.g., Oura) only if you explicitly connect them.

How it's protected

• Encrypted in transit (HTTPS/TLS) and at rest on our managed backend.
• Row-level security policies enforce that only you can read or modify your records. Server checks revalidate every request.
• Note attachments live in a private storage bucket; the app generates short-lived signed URLs only when you view them.
• Demo sessions are isolated from production data and cannot create, edit, or delete other users' records.
• Database errors never expose internal details to your screen.

Who can see your data

• You, when signed in.
• No other user — including admins — can read your logs, notes, journal, or labs.
• AI analysis you request is sent to our AI provider strictly to produce the response. It is not used to train external models.

Third parties

We use a managed Postgres backend, an AI gateway for analysis, and (optionally) the Oura API if you connect your ring. We do not sell your data and there are no advertising trackers.

Sub-processors

The following third parties process limited data on our behalf under written data-processing agreements:

• Supabase (Postgres + Auth + Storage) — application database, authenticated sessions, and private file storage. Hosted in the US.
• Cloudflare Workers — serves the app and runs our server functions.
• Lovable AI Gateway — routes AI analysis requests you initiate. Prompts and responses are not used to train external models.
• Oura — only if you explicitly connect your ring. We store OAuth tokens and the metrics you consent to share.

We update this list when sub-processors change. If you'd like advance notice, email info@avernova.com.

Breach notification

If we ever confirm unauthorized access to your personal data, we will notify affected users by email within 72 hours of confirmation and describe the scope, the data involved, remediation steps we've taken, and actions you should take. Where required, we'll also notify applicable regulators within statutory windows (e.g., 72 hours under GDPR).

DMCA & copyright

Dose Compass respects intellectual property rights. If you believe content on this app infringes your copyright, send a written notice to info@avernova.com including: (1) identification of the copyrighted work; (2) the URL or location of the allegedly infringing material; (3) your contact information; (4) a statement of good-faith belief that use is unauthorized; (5) a statement under penalty of perjury that the notice is accurate and you are authorized to act; and (6) your physical or electronic signature. Counter-notices follow the same channel.

Minors & household use

Dose Compass is intended for adults 18 or older. We do not knowingly collect data from anyone under 18. If you share a device with a minor, keep your account signed out when they use it, and do not enter another person's health information under your account. If you believe a minor has created an account, contact info@avernova.com and we will delete the account and associated data.

Compliance posture

Your rights

• Export or delete your data on request.
• Revoke the Oura connection at any time from your account.
• Delete your account to remove all associated records.
• Request a copy of the data we hold about you.

Security contact

To report a security issue, request a vulnerability disclosure policy, or ask a privacy question, email info@avernova.com. We review reports promptly and work with researchers to resolve issues responsibly.

Medical disclaimer

Dose Compass is not a medical device and does not provide medical advice. Always discuss medication, program, supplement, and treatment decisions with the clinician supervising your care.