Privacy notice

Who this covers

Voodoo is an informational, advisory product about the musculoskeletal body. It is not a medical device and it does not connect to any clinical system. It does hold health-related data: a pin that says “sharp pain, outer left knee, worse on stairs” tied to an account is data concerning health, whatever the product is called. This notice says how that data is handled. It covers everyone who signs in during the closed pilot.

Voodoo runs on servers operated for it by Cantan Group, where your data is stored. The person responsible for your data (the controller) and how to reach them are given under Contact.

The short version

• We keep the minimum, and only to run the product for you.
• Your pins, notes and profile leave our servers for one purpose only: to produce a report you asked for, through a Google model running in our own Google Cloud project.
• The sign-in email, and any reminder you ask for, is delivered by Mailgun, which sees your address and the message.
• We run no advertising and no third-party analytics or tracking scripts, and we sell nothing. Product metrics are counters on our own server.
• Deleting your account removes everything at once. Encrypted backups keep a copy for up to 14 days, then it is gone.

What we keep, and why

Each line says what it is, what it is for, the legal basis we rely on, and how long it stays.

Your email address

To recognise your account and send you sign-in links. Basis: the agreement between us. Kept until you delete your account.

Your consents

Which of the four agreements you gave, the policy version they referred to and when. Basis: the law requires us to be able to show that you agreed. Kept until deletion; a de-identified trace stays in the audit log.

Your body profile

The body model you chose and, if you give them, an age band, an activity level and context flags such as recent surgery or pregnancy, so that the report can be safer and more relevant. Basis: your explicit consent. Kept until deletion.

Pins, episodes, check-ins and notes

The product itself, including the daily check-ins you record against a plan: which movements you did, how it felt, whether a danger sign applied, and a short note if you add one. Basis: your explicit consent. Kept until deletion.

Pins and notes parked with a pending sign-in link

When you ask for a sign-in link, the pins and notes kept on that device travel with the request, so that whichever device opens the link brings them into your account. They are held with the link until it is used or expires, a day at most, then deleted. Basis: your explicit consent, given on the sign-in form.

Analyses

What was sent to the model, the exact prompt and reply, and the report, so that advice Voodoo gave can be reproduced and audited. Basis: your explicit consent, and our legitimate interest in being able to account for what Voodoo said. Kept until deletion.

Sessions and passkeys

To keep you signed in. Basis: the agreement between us. Sessions expire on their own; passkeys stay until deletion.

Audit events

Identifiers only, never free text or the content of a pin, so that access to data can be shown. Basis: our legitimate interest in security and transparency. De-identified when you delete.

Usage counters and cost

How many analyses you have run and what they cost, for the limits and so that you can see them. Basis: the agreement between us. Rolling; deleted with the account.

Messages you send us through the contact form

Your name if you give it, your address, what the message is about and your words, with a hashed form of your network address, so that a person can read it and reply. Basis: our legitimate interest in answering you; a privacy request is something the law requires us to act on. Kept until it is handled, then for up to 12 months.

Server logs

Request identifiers and a hashed form of your network address, for security and debugging. Basis: our legitimate interest. Kept for 30 days.

Reminder preferences

Whether you asked for a daily check-in reminder or a notice when a plan refresh is ready, the hour and the time zone you chose, and the language. Basis: your consent, which you withdraw by turning them off or with the link in any reminder. Kept until you turn them off or delete your account.

Your plan

Which plan your account is on. During the pilot everything is free and this says so. If you ever subscribe, Stripe takes the payment and we keep only the subscription's state and Stripe's identifiers for it, never card details. Basis: the agreement between us. Kept until deletion.

What we do not collect

Names, postal addresses, dates of birth (you confirm you are 18 or older; we store the confirmation, not the date), payment details, device identifiers, biometric identifiers of any kind, clinical records, or your precise location. Nothing identifies a body rather than an account.

Your consent

On the sign-in form, before a link is sent, you give four separate agreements, each in its own words: to the Terms of use (terms-v1); to Voodoo processing your health data; to your pins and notes being sent to Google Vertex AI when you ask for an analysis; and that you are 18 or older. Each is recorded with the policy version it referred to, today 2026-10-21, and the time you gave it. Your account page lists them.

An existing account re-affirms the same four each time it asks for a link; we record them again only when this notice or the terms have changed since. Withdrawing is one action: delete your account from your account page.

A fifth agreement is optional and lives on your account page: reminders by email. Turning a reminder on records it; turning both off, or using the link in any reminder, withdraws it.

Where your data goes

Google Vertex AI, to produce your report

When you ask for an analysis, your pins, notes and body profile go over an encrypted connection to Google’s Gemini model running in Voodoo’s own Google Cloud project. Google’s terms for its generative models on Vertex AI exclude using customer prompts and responses to train or improve Google’s models; Google describes how it handles this data on its data governance page. Nothing goes there at any other time.

Mailgun, to deliver your sign-in link and any reminders you asked for

Mailgun sees your email address, the one-time link it carries and, if you turned reminders on, the reminder itself, which names no pin, note or pain level. Mailgun processes this in the United States.

Stripe, if you ever subscribe

Not during the pilot, when everything is free. If a paid plan opens, the payment page is Stripe's own: Stripe sees your email address and your card, and tells us only that the subscription is active or not. No pin, note or report ever goes to Stripe.

Nowhere else

The services that build and ship Voodoo (Google Cloud Storage, Pub/Sub and Cloud Build) carry releases and 3D anatomy, never your data. Let's Encrypt, which issues our certificates, sees domain names only.

How long, and how deletion works

Everything stays until you delete your account. Deletion is immediate and complete in the live database: one operation removes every row of your account's data and signs out every session. Messages you sent through the contact form are kept separately, as described under Contact. The audit trail keeps its identifiers with you removed from them.

Encrypted backups are taken nightly and kept for 14 days, so data you deleted can persist in a backup for up to 14 days before it is overwritten. Server logs are kept for 30 days.

How we protect it

• The tables that hold your account's data are isolated at the database itself, and the service that answers requests cannot bypass that isolation. The two that are not hold contact messages and pins parked with a pending sign-in link, which only administrators and the link itself can reach.
• An administrator sees the metadata of analyses only. Opening the content of an analysis requires typing a reason, which is written to the audit log.
• Secrets never enter the code; keys and passwords live outside it with restricted permissions.
• Every connection to and from Voodoo is encrypted.

Cookies, and what stays in your browser

Session cookie

Keeps you signed in. Marked httpOnly, Secure and SameSite, so scripts and other sites cannot read it. Strictly necessary.

Theme preference

Dark, light or system, remembered in your browser's local storage. It never leaves your browser.

Pins before you sign in

Pins you place without an account stay in your browser's own storage. When you ask for a sign-in link they travel with it (see the table above); once the sign-in has brought them into your account, the copy here is cleared.

No third-party cookies, ever.

Your rights

• See it: export everything we hold about you from your account page, or ask us through the contact form below.
• Correct it: your pins, notes and profile are yours to edit at any time.
• Delete it, or withdraw consent: delete your account from your account page; both happen in the same action.
• Take it with you: the same copy, in a machine-readable form.
• Complain: you can take a concern to the data protection authority where you live.

We answer requests within a month.

What changed

privacy-v1: First published version, written for the closed pilot.

A new version gets a new id and date here, and the consents that depend on it are asked again at your next sign-in.

Contact

Privacy notice privacy-v1, effective 21 October 2026.