Privacy policy

1. Information we collect

We collect information you provide directly to us:

• Account information: Email address, display name, and password (stored securely as a hash).
• Health profile: Tube type, duration of use, age group, primary concerns, and formula type. This is used to personalize your cards.
• Chat conversations: Messages you send to our AI assistant and the generated responses.
• Card data: The health information cards generated for and saved to your board.

2. How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate personalized health information cards based on your profile
• Respond to your questions through the AI chat assistant
• Suggest relevant card topics based on your tube type and concerns
• Send you important service-related communications

3. How we protect your information

• Passwords are encrypted using bcrypt hashing and are never stored in plaintext.
• All data is transmitted over encrypted HTTPS connections.
• Authentication uses secure JSON Web Tokens (JWT).
• Database access is restricted and queries are parameterized to prevent injection attacks.
• We do not sell your personal information to third parties.

4. Third-party services

We use the following third-party services to operate Lugano Health:

• AI content generation: We send your chat messages and profile context (tube type, age group) to an AI service to generate card content. Messages are not used to train AI models.
• Hosting: Our infrastructure is hosted on Vercel (frontend) and Railway (backend/database).
• Payment processing: If applicable, payments are processed by Stripe. We do not store your credit card information.

5. Data retention

We retain your account and card data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. When you delete a card, it is soft-deleted (archived) first and may be permanently removed after 30 days.

6. Your rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information in your profile
• Request deletion of your account and personal data
• Export your card data

7. Children's privacy

Lugano Health may be used by caregivers of pediatric patients, but the Service is intended for use by adults (age 18+). We do not knowingly collect personal information from children under 13.

8. Changes to this policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

9. Contact us

If you have questions about this privacy policy or how we handle your data, please contact us at privacy@luganohealth.ai.