Privacy Policy

Prologa helps you put into words how you've been feeling, by voice or text, and turns it into a clear summary you can choose to share with your clinician. The things you tell Prologa are health information, and we treat them as protected health information (PHI). This policy explains what we collect, how we use and protect it, who we share it with, and the choices and rights you have.

This policy applies to the Prologa web app at prologa.io, the Prologa mobile app, and related services (together, the “Service”), operated by Prologa, Inc. (“Prologa”, “we”, “us”).

1. Information we collect

• Account information. Your sign-in email address, authentication identifier, and basic preferences you set during onboarding (your first name, tone preference, and the general condition area you choose).
• What you share with Prologa. The voice or text entries you record about how you feel and what's going on in your life, and the structured “moments,” tags, and summaries for your clinician that Prologa derives from them. This is health information.
• Voice audio. When you speak to Prologa, your audio is sent to our speech-to-text provider to produce a transcript. We store the resulting transcript and the structured data derived from it; we do not retain the raw audio recording after transcription.
• Connected device & lab signals (optional). If you choose to connect a wearable, glucose monitor, or other source, we receive the metrics you authorize (for example heart rate, sleep, steps). You control whether to connect a source, and you can disconnect it.
• Technical information. Standard logs needed to run and secure the Service, for example IP address, device/browser type, and timestamps. We use privacy-respecting product analytics to understand usage; we do not use advertising trackers.

2. How we use your information

• To provide the Service: transcribe your voice, organize what you share into structured moments, and generate summaries for your clinician.
• To authenticate you (email sign-in, Sign in with Apple, or a linked device) and keep your account and data secure.
• To share your information only with the clinician you choose, when you ask us to (see §3).
• To maintain, debug, and improve the Service, and to meet legal and safety obligations.

We do not sell your personal or health information, and we do not use it for advertising. Prologa does not diagnose, treat, or provide medical advice; it organizes what you tell it.

3. When we share information

• With a clinician you choose. You choose manual or automatic sharing in Profile. With manual sharing, you choose when to share your summary and its source entries. With automatic sharing, existing and future saved updates in your current summary, and connected health signals, can be shared with your linked clinician under the choice you approved. Unsaved drafts are not shared. A failed or offline share waits for recovery; it is not confirmation that your clinician received or read it. Each shared summary is a read-only snapshot. Switching to manual sharing stops automatic sharing and removes your care team's online access once confirmed. Other active shares can be stopped individually in Profile. Wait for the app to confirm that access has stopped. This cannot retrieve copies already printed, downloaded or saved.
• Caregiver observations. A caregiver you approve uses a separate account to add confidential observations for clinician review. Their observations are not shown in your patient app or patient export, and their account does not give them access to your words. You can stop the relationship in Profile. Helping you record your own words in your session is a separate activity: you review and confirm those words, and they remain your entry.
• Service providers (subprocessors). We use a small number of vetted providers to run the Service, listed in §4. They process information only on our instructions and under contract, and, where they handle PHI, under data-protection / business-associate agreements.
• Legal and safety. We may disclose information if required by law, or to protect the rights, safety, or property of users or others.
• Business transfer. If Prologa is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction, subject to this policy.

4. Subprocessors

We rely on the following providers to deliver the Service:

Before 28 September 2026 the Service ran on Supabase (authentication and storage), Vercel (hosting), OpenAI (structuring entries and generating summaries) and Resend (sign-in emails). Information processed before that date may remain with those providers until those accounts are closed.

5. How we protect your information

We apply administrative, technical, and physical safeguards appropriate to health information: encryption in transit (HTTPS/TLS) and at rest, passwordless sign-in with one-time codes, server-side access controls so the server derives your identity from your verified session (never from client-supplied IDs), role-based access on the clinician side, and audit logging of sensitive actions. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices.

6. Your rights and choices

• Access & export. You can export your data at any time from the app (Profile tab → “Privacy & data” → “Export my data”).
• Deletion. You can delete your account and associated data from the app (Profile tab → “Account” → “Delete my account”). This is permanent.
• Stop sharing. You can stop active online access from Profile. Turning off automatic sharing by switching to manual also stops care-team online access once confirmed. Other active shares have their own Stop control. Deleting an entry does not rewrite an already-shared snapshot. None of these actions retrieves copies saved elsewhere.
• Disconnect sources. You can disconnect a wearable or other connected source at any time.
• Correction & objection. Depending on where you live (for example, under GDPR or similar laws), you may have rights to correct, restrict, or object to certain processing. Contact us to exercise these rights.

7. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete your associated personal and health data, except where we must retain limited records to comply with legal obligations or resolve disputes. Raw voice audio is not retained after transcription.

8. Children

The Service is for adults. Do not use Prologa or provide information if you are under 18 or below the age of majority where you live.

9. International users

We and our providers may process and store information in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers. By using the Service, you understand your information may be processed in countries with different data-protection laws than your own.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll update the “Last updated” date above and, where appropriate, notify you in the app or by email.

11. Contact us

Questions about this policy or your data? Contact us at privacy@prologa.io.