Privacy Policy

We collect only the data necessary to provide health literacy features:

• Lab results — values, dates, reference ranges, and flags from documents you upload.
• Journal entries — symptom logs and free-text health notes you write.
• Supplements — names, dosages, and goals you enter.
• Visit records — upcoming and past doctor visits, prep questions, and follow-up actions you create.
• Account information — your name and email address provided by your OAuth provider (Google or Facebook) at sign-in. We do not store your OAuth password.
• Vitals and wearable data — if you connect a data source such as Oura Ring or Epic MyChart, we receive the data you authorize.

Your data is used exclusively to provide the Ashley service to you. We never sell your personal health data to advertisers, data brokers, or any third party.

• AI interpretation — your lab results and health context are sent to Anthropic Claude to generate plain-language explanations and insights.
• Document extraction (OCR) — uploaded PDFs and images are sent to OpenAI Vision to extract structured lab values. Raw document content is not retained by OpenAI beyond the request.
• Service improvement — aggregated, de-identified usage patterns may be used to improve the platform. No individual health data is used for this purpose.

We do not use advertising networks, analytics trackers, or any sub-processor not listed above.

You have the following rights over your data at any time:

• Access — view all data associated with your account within the Ashley application.
• Export — download your lab results and health data in CSV format from the Trends page.
• Delete — permanently delete your account and all associated data from Settings. Deletion is immediate and irreversible.
• Correction — contact us to correct inaccurate account information.

We implement the following safeguards:

• All data in transit is encrypted with TLS 1.2 or higher.
• Database queries are scoped to your account identifier — your data cannot be accessed by other users.
• Authentication is handled by NextAuth.js with signed, encrypted session tokens. No passwords are stored by Ashley.
• API endpoints enforce session authentication via server-side middleware before executing any data operations.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at the address below.

Ashley is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us and we will delete the account promptly.

If you are a Washington State resident, additional rights apply under the My Health My Data Act (MHMD):

• We do not sell your consumer health data to third parties.
• We do not use your consumer health data for targeted advertising.
• You may request access to, correction of, or deletion of your consumer health data at any time by contacting us or using the in-app deletion feature.
• We will not take adverse action against you for exercising your MHMD rights.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete — request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out — we do not sell your personal information, so there is nothing to opt out of.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.

To exercise any CCPA right, use the in-app deletion feature in Settings or contact us at the address below.

For privacy questions, data requests, or to report a concern, contact us at:

We will respond to verifiable requests within 45 days as required by applicable law.