Privacy policy.

When you use Nalura, we may collect:

• Account information. Your name, email address, and password (stored securely via Supabase Auth).
• Health profile information. Conditions you manage, medications, health goals, and preferences — provided voluntarily during onboarding to personalise your research.
• Health questions and context. Questions you submit and any context you provide.
• Usage data. Pages visited, features used, and interaction patterns — used to improve the service.
• Payment information. Billing details are processed and stored by Stripe. Nalura never stores your card details directly.

• To generate your personalised health research reports.
• To personalise your weekly newsletter content.
• To process subscription payments via Stripe.
• To send service-related emails (report ready, payment issues).
• To improve Nalura's AI research quality over time.

Your health data is never sold. Ever.

Your data is stored securely using Supabase (PostgreSQL with encryption at rest). All data is transmitted over HTTPS. We apply row-level security to ensure your data can only be accessed by your account.

Health information is treated with HIPAA-equivalent care. While Nalura is not a covered HIPAA entity, we apply the same principles of privacy and data minimisation.

• Access. Request a copy of all data we hold about you.
• Deletion. Request deletion of your account and all associated data.
• Export. Request an export of your health questions and reports.
• Correction. Update or correct your health profile at any time from Settings.

To exercise these rights, email privacy@nalura.health.

• Supabase — database and authentication
• Stripe — payment processing
• Resend — email delivery
• Anthropic — AI report generation (queries are processed but not retained for training)

We use essential cookies only — to maintain your session and authentication state. We do not use advertising or tracking cookies.

Questions about this policy? Email us at privacy@nalura.health.