Your information is used to provide your own wellness record, reports and optional habit support. We do not sell it, give it to advertisers, insurers or employers, or use your health records to train AI models.
What we keep
Your sign-in email and profile; health information you enter; measurements and their sources; uploaded files; reports and actions; connected-device records; your preferences and habit check-ins. We also keep service events such as a completed cycle or a failed reminder, and feedback you deliberately submit.
AI processing is your choice
When you request a report, Visit Prep summary or document extraction, the relevant information is sent through Vercel AI Gateway to a model provider. Every request requires a provider with a no-prompt-training agreement, including fallback requests. If none is available, the request fails rather than relaxing that rule.
Using your history to write your next report is personalization, not model training. We do not pool members' health records for training or sell an anonymized health dataset. Limited authorized review may take place to investigate quality or safety issues.
You can turn off new AI processing in Settings. It does not erase previous reports or stop requests already in progress. You can still enter measurements, read saved reports, view charts and export your record. Provider processing and security retention are subject to their terms; we do not promise zero retention for every provider.
Usage, referrals and partners
We count signups, completed check-ins, invitations and provider-link visits to improve the product. These counts are not health measurements. Operational records remain linked to your account until deletion; removing a name alone would not make them anonymous. The product does not load advertising pixels or session-recording scripts.
If you accept a member invitation, we record the attribution for a new verified account. The sender sees a signup count, never your name or health record. Creator links also use first-party attribution. Where a creator-link cookie is used, it lasts 30 days; in the EU, EEA and UK the code stays in the URL instead.
Testing providers are optional. A paid referral is labeled with its commission disclosure. Following the link sends you to the provider; we do not include your email, measurements or account identifier in the link. The provider collects information you choose to give it under its own policy. We record which provider link was followed, not what you buy or your test results.
Storage and service providers
Supabase stores the account and health record in its US region, with account-specific access rules. Vercel hosts the application and routes AI requests. Resend delivers account and cycle emails. Browser push services deliver notifications you enable. Existing subscription payments are processed by Stripe; we never see your card number. Information can be processed outside your country by these services.
When you connect Google Health, Plus Bio reads your steps, weight, resting heart rate, heart-rate variability and sleep, read-only, to build your record and reports, including AI-written reports if AI processing is on. We do not share this data with anyone else, use it for advertising, or sell it. The use of information received from Google Health API will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements. Disconnecting stops new reads and revokes our access; deleting your account removes what was read.
Device credentials are kept separately from your health record. You can disconnect devices from the Data page. Notifications use fixed text without your health values or private notes. Optional daily reminders follow your time zone and quiet hours.
Ownership and portability
You retain your rights in the information you provide. Plus Bio needs permission to store and process it only to operate the features you choose. Your personal record and generated reports remain readable and exportable regardless of billing status.
Settings provides a portable ZIP export containing JSON records and original files with your account record, measurements, reports, preferences, habits, feedback and upload metadata. Device authorization tokens and sign-in credentials are excluded. Keep a backup or share it with a clinician, family member or another service you choose. An export does not transfer access to your account or include the underlying AI model.
Deletion and retention
Delete your account in Settings to remove its active records, uploaded files and device credentials, and erase the free text of your feedback. Existing subscriptions must be cancelled as part of deletion; if billing or deletion cannot be confirmed, the product reports the failure. Backups and providers' required security or financial records may remain under their retention policies. Deletion cannot recall a file you have already shared or information independently provided to a testing company.
To request access, correction, deletion, portability, or details of provider retention, contact mario@plus.bio. These requests are also available by email if you cannot sign in.
Who operates Plus Bio
Plus Bio is operated from Denmark, CVR 43049046, Centrifugevej 374, 2800 Kongens Lyngby, Denmark. It is an educational wellness service, not a medical provider or health plan. It does not operate on behalf of your clinician or insurer. Employer payment does not give an employer access to your record. We will notify affected members of a health-data breach as required by applicable law.