Privacy and data-processing policy

1. What never leaves your device

If you are not signed in, the values you enter, the context about you (sex, age, diet type and so on), the resulting interpretation and your saved history live in your browser's local storage. We have no access to them. Clearing site data in the browser deletes them irreversibly.

2. What we store once you register

• Your email address — needed for sign-in, account recovery and service messages.
• Your password as an irreversible cryptographic hash (scrypt). The original password is not stored and cannot be recovered.
• Saved lab snapshots: values, units and the test date.
• The context you provide for accuracy: sex, age, height and weight, diet type and duration, pregnancy and breastfeeding, menstruation, intense training, supplement use. This is health-related information, processed solely to build your interpretation.
• Session records (a token in an httpOnly cookie and its expiry) and one-time tokens for email sign-in links.
• The text of any feedback you send and the contact details you supply with it.
• Technical usage counters: a record that a report was built, a lab form was read, a snapshot saved or a lab email received — date and action type only. They contain no content and no IP address, and exist solely to gauge how much the service is used.

3. Uploaded lab reports — important

We do not store the uploaded PDF or photo: the file is processed in memory and never written to disk. To read the values from it, however, the file is transmitted to a third-party recognition service — Google Gemini or Anthropic Claude, depending on configuration. This happens only at the moment of upload and only when you initiate it.

Note that a lab report normally carries your name, date of birth and order number. We do not need any of it — the tool extracts only marker names, numbers and units. We recommend masking or cropping personal details before uploading: the interpretation is unaffected, and nothing extra leaves your device.

If you would rather not involve a third party at all, enter the values manually. Manual entry is always available and calls no external service.

4. Email you send us

Mail for the domain is received through Resend. This covers ordinary correspondence as well as messages sent to the automatic-interpretation address: if you forward a lab email with a report attached, we read the attachment, extract the values and send the interpretation back by reply.

We do not store the message or its attachments ourselves — they are processed in memory for the duration of the request. A copy remains with the receiving provider (Resend) for its retention period, as with any email at any provider. As with uploads on the site, only marker names, numbers and units are taken from the report: name, date of birth and order number are ignored.

Note that ordinary email is not end-to-end encrypted. If you would rather not send a report by mail, use the upload on the site or manual entry — the result is the same.

5. Who receives data

• The recognition service (Google Gemini or Anthropic Claude) — only the contents of the file you upload, only at the moment of upload.
• The email delivery service (Resend) — the recipient address and the body of a service email on registration, link sign-in or password recovery.
• Yandex.Metrica — anonymised visit statistics (see the next section).
• We do not sell data, do not pass it to ad networks and do not use it for advertising profiling.

6. Cookies and analytics

We use strictly necessary cookies for the sign-in session, and Yandex.Metrica for traffic statistics. Metrica collects anonymised visit data: pages, referrer, device and browser type, approximate location from IP, and records on-page behaviour (Webvisor). The fields where you enter values and personal details are excluded from recording.

You can disable analytics with your browser — an ad blocker, "Do Not Track", or by blocking third-party cookies. The service works regardless.

7. Retention and deletion

Account data is kept for as long as the account exists. History can be cleared from the interface at any time. For full deletion of the account and all associated data, write to us — we will delete it and confirm. Sessions and one-time tokens expire and are removed automatically.

8. How data is protected

• The connection to the site is always encrypted (HTTPS).
• Passwords are stored only as scrypt hashes; the original cannot be recovered.
• Session cookies are httpOnly and transmitted only over a secure connection.
• The service runs under an isolated, least-privilege server account; its database is not reachable by other applications on the host.

9. Your rights

You may request information about the data we process, ask for it to be corrected, restricted or deleted, and withdraw your consent. A message to the address below is enough. Withdrawing consent means deletion of the account and its data.

10. Changes to this policy

The current version is always published on this page with its update date. We will announce material changes on the site.

11. Contact

Questions about data handling, deletion requests and consent withdrawal: info@vegalysis.ru.

FAQ