Privacy

PROVISIONAL VERSION · UNDER LEGAL REVIEW · 2026-08-15

The site and the analysis

• What we collect. Your email; if you connect a ring or wearable (Oura, Whoop or Garmin), the nightly metrics its API provides; and what you state in the questionnaires.
• What for. To produce your analysis and, if you ask for it, your protocol. For nothing else.
• How it is stored. Your ring's access tokens are stored encrypted (AES-256-GCM). The data lives in Supabase.
• What we do not do. We do not sell your data. We do not publish anything that identifies you.
• Analytics and pixels. On the site's public pages, and only if you accept in the privacy notice, we load third-party tools. With your analytics consent: Google Analytics 4 and Microsoft Clarity (records the session — clicks, scrolling, mouse movement — and builds heatmaps). With your marketing consent: Google Tag Manager, Google Ads (conversion measurement and remarketing, that is, ads to people who already visited the site), the X (Twitter) pixel, and — once we turn them on — the Meta pixel, the TikTok pixel and the ChatGPT Ads (OpenAI) pixel, all to measure ad conversions and audiences. They receive browsing data: pages viewed, events, device and browser data, and cookie identifiers. Without your decision none of them loads; if your browser sends Global Privacy Control, marketing stays off. You can change or withdraw your decision under «Privacy preferences» at the foot of every page. [REVISIÓN LEGAL: consent notice copy, «do not sell or share» and GPC handling]
• Never on health pages. None of those tools loads on the pages that handle health data or your personal area: El Espejo (/el-espejo/…: ring connection, questionnaire, results and account), ORIGEN (/origen/…: the supplements door, the protocol, checkout and account), your account (/account/…: the Lab, ring biometrics, check-ins and your file), the daily check-in (/checkin) and the contact and adverse-event form (/contact). There is no third-party analytics, session recording, or Vercel Web Analytics or Speed Insights there. When you leave those pages, your browser only shares our domain, never the address of the health page. [REVISIÓN LEGAL — the per-route suppression is in the code; verify in production before opening sales.]
• Purchases and ad platforms (server side). If you accepted marketing consent, when a purchase is confirmed our server may tell Meta, TikTok, Google, OpenAI (ChatGPT Ads) and X that a purchase happened, to measure our ads: the generic type (purchase or subscription), the amount, the currency, an order identifier, the ad's click identifiers and, irreversibly hashed (SHA-256), your email, your phone and an internal identifier. Never what you bought within the protocol, your answers, your nights or any health data. Without marketing consent (or with the Global Privacy Control signal) nothing is sent. Renewals are not shared with anyone. Today this sharing is OFF for ORIGEN purchases pending legal review. [REVISIÓN LEGAL — does MHMDA require a separate consent to share a protocol purchase?]
• Consent. Connecting the ring requires explicit consent with a stated scope. You can revoke it whenever you want.
• Deletion. In your account you can revoke consent and request deletion of all your data.
• Payments. Stripe processes them. We never see or store your card.

BORRADOR — pendiente de revisión legal · DRAFT — pending legal review · 2026-10-18

ORIGEN purchases

This part describes what data we handle when you buy ORIGEN.

What data

• From your account: email and what you state.
• Health: your wearable metrics (the last 28 nights for the protocol), your answers to the health and safety questionnaire (medication, pregnancy or breastfeeding, conditions) and, if you upload it, your blood test. These are consumer health data: see consumer health data.
• From the purchase: name, shipping address, phone, the frozen plan (which bottles and when), the charges and your acceptance of the recurring charges.
• From an adverse event, if you report one: what you tell us about the product and your reaction.
• From Premium on the web, if you start a free trial or pay for Premium: a fingerprint of your email that cannot be turned back into it. See the Premium free trial.

Who we share it with, and why

• Stripe — payments: your email, name, billing address and your card details, which you enter directly with Stripe.
• Shopify and Supliful — preparing and shipping your box: name, shipping address, phone and the products in that box. Product names may reveal something about your health. [REVISIÓN LEGAL: data-processing agreements with both]
• Resend — sending you purchase emails: your email and the email's content (plan, charges, shipping).
• AI providers — DeepSeek writes the text of your analysis from metrics derived from your wearable; OpenAI reads the blood test you upload to extract its values; Groq and Anthropic answer in the Vault chat. The ORIGEN app's coach and photo analysis use AI providers. [REVISIÓN LEGAL: DeepSeek is based in China — international transfer of health data; verify exactly what data each flow and the ORIGEN app send, to which provider, and whether those providers train on it]
• Supabase and Vercel — hosting the database and the site.
• Authorities — when the law requires it; for example, a serious adverse event is reported to the FDA.

We do not sell your health data or share it with advertisers. We do not use it for advertising: advertising pixels do not load on the pages where we handle it. [REVISIÓN LEGAL: confirm it against the pixel suppression in production (FIX-SEG) and against the broad definition of «sharing» in Washington's My Health My Data Act]

Deletion and retention

• You can request deletion of your data from your account or by writing to us (contact).
• If you have an active Protocol or Premium, before deleting the account we cancel all your ORIGEN subscriptions in Stripe; if Stripe does not confirm the cancellation, the account is not deleted. [REVISIÓN LEGAL — depends on pending code: deletion from the ORIGEN app has to go through the same cancellation]
• Purchase records, records of consent to the charges and adverse-event records are kept as long as the law requires, even if you delete your account: proof of your consent to the recurring charges, at least 3 years; adverse-event records, 6 years. They are unlinked from your account. [REVISIÓN LEGAL: tax and consent periods]
• The Premium free-trial fingerprint is also kept even if you delete your account: see the Premium free trial.
• Depending on your state, you may have additional rights of access, correction, deletion and portability. [REVISIÓN LEGAL: rights by state and appeal procedure]

Questions: write to us and we will answer just as plainly.

The Premium free trial: a fingerprint of your email

• What we keep. When you start a Premium free trial or pay for Premium on the web, we keep a fingerprint of your email: a 64-character code computed with HMAC-SHA256 and a secret key that only our server holds, from your normalized email (no spaces, lowercase and, for Gmail, without dots or a «+alias»). Alongside it we keep only whether it was a trial or a payment, whether it was a live operation or an internal test, and the date. We do not keep your email, your name, your account, your purchase or any card data there.
• What it allows and what it does not. The fingerprint alone cannot be turned back into your email. It is not anonymous data but pseudonymized data: with the key and a specific email, one can check whether that email already had Premium on the web. We only check it when someone with that email asks for the Premium price while we offer the trial.
• What for. For one thing only: making the free trial one per person, so it cannot be repeated by deleting the account or writing the email differently. We do not use it for marketing, advertising or profiling, we do not share it with anyone and we do not link it back to your account. The basis is our legitimate interest in preventing fraud and abuse of our offers. [REVISIÓN LEGAL: confirm the basis and how it fits state privacy laws, e.g. the CCPA security and fraud-prevention exception]
• It survives the deletion of your account. If you delete your account or ask us to delete your data, the fingerprint is not deleted: if it were, the same person could repeat the trial. It is the only Premium record that remains, and nothing else can be rebuilt from it.
• How long. We keep it for at most 3 years from when it is recorded, and then it is deleted. [REVISIÓN LEGAL — founder decision and code pending: today the table is append-only and has no scheduled deletion, so in practice it is kept with no time limit; 3 years is the proposal, the same period as the proof of consent to the charges]