PRIVACY POLICY

1. Introduction

Phoenix Protocol Pte. Ltd. (“Phoenix,” “we,” “us,” or “our”) operates the Phoenix website, web app and mobile apps (together, the “Service”). This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have.

By using the Service, you agree to this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

We collect information you give us when you use the Service, including:

• Account information: name, email address, age, and genetic status (such as APOE genotype)
• Application answers: what you tell us when you apply to join, such as your goals and your health context
• Payment information: processed by our payment provider, Stripe. We do not store your full card number.
• Messages and calls: emails you send us and notes from calls you have with us. We may record calls so we can keep accurate notes.

2.2 Health Data We Collect

Our Service collects the following categories of health data that you voluntarily provide or authorize:

• Blood tests and other health documents: when you upload a lab report, another health document or a screenshot from a health app, Phoenix's AI reads it and extracts the values (such as ApoB, HbA1c and lipid panels). We store the values to track your trends over time, and we keep the original file so you can refer back to it.
• Supplement and medication data: Names, dosages, and schedules of supplements and medications you log in the app.
• Daily check-in responses: Self-reported health information including mood, energy levels, sleep quality, cognitive function, and other wellness metrics you choose to report.
• Experiment and protocol data: Information about structured health experiments you participate in, including intervention type, duration, and self-reported outcomes.

2.3 Health Data from Connected Third-Party Services

With your explicit consent, we collect health and fitness data from connected third-party services. You control which services are connected and can disconnect them at any time.

From Apple Health (iOS): activity data (steps, distance, calories burned), sleep analysis (duration, stages), heart rate data, workout data, and other health metrics you authorize through the Apple Health permissions screen.

From Google Health Connect (Android): activity data (steps, distance, calories burned), sleep data (duration, stages), heart rate data, exercise sessions, and other health metrics you authorize through the Health Connect permissions screen.

We only access the specific data categories you grant permission for. We do not read health data beyond what you have explicitly authorized.

2.4 Device and Usage Information

Like most websites and apps, we automatically receive some technical information when you use the Service, such as your IP address, your browser and device type, and the pages and features you use. We use it to keep the Service running smoothly, fix problems and improve the experience. We do not collect your precise location. We also use analytics tools, including session replay, to understand how people use the app; these tools are set up to hide what you type and personal details such as your email and genotype.

2.5 Advertising and Lead Forms

When you respond to a Phoenix ad on Facebook or Instagram and submit your name and email through a Meta lead form, Meta shares that information with us so we can send you the guide you requested and follow up by email. We do not ask health questions in these ads or forms; we only collect your name and email. We do not currently use Facebook’s tracking pixel on our website, and we do not share your information back to Meta for advertising purposes.

After you submit a lead form, your name and email are stored in our systems (Supabase and Beehiiv, our email platform) and used to send you the content you requested and occasional relevant emails. We track whether you open or click our emails so we can tell what’s useful and stop sending what isn’t. If you later become a Phoenix member, we link your original ad response to your membership internally so we understand which content and channels actually help people; this link is for our own analytics only and is never sold or shared with advertisers.

You can unsubscribe from emails at any time using the link in every email, or ask us to delete your information entirely. See Section 9, Your Rights and Choices, below.

2.6 Cookies

Our website uses cookies and similar technologies to remember your preferences, understand how the site is used and measure our advertising. Depending on where you are, we either ask for your consent first or let you decline in the cookie banner. To change your choice later, clear this site's cookies in your browser and the banner will appear again.

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Read the lab reports you upload, display your health data, generate trend analyses, and personalize your experience based on your genetic profile and tracked metrics
• Generate health insights: Analyze your biomarker data, check-in responses, and connected device data to provide personalized health insights and recommendations specific to your APOE status
• Support structured experiments: Track your progress through health experiments, compare outcomes, and help you refine your personal protocol
• Facilitate community features: Match you with accountability pod members based on shared goals, genetics, and interests
• Process transactions: Handle subscription payments and send related information
• Communicate with you: Send administrative information, updates, security alerts, and relevant content
• Improve the Service: Analyze usage patterns to improve features and user experience
• Measure our advertising: Understand which of our ads and channels bring new members. We never share your health data with advertisers.
• Provide customer support: Respond to your inquiries and troubleshoot issues

4. Disclosure of Your Information

4.1 General Policy

We do not sell, rent, or share your personal data with third parties for their marketing purposes. We only share your health data with the service providers below, who process it on our behalf to run Phoenix, or with others when you explicitly ask us to, for example when you join a research study.

4.2 Research and Clinical Trials

From time to time, we may offer opportunities to participate in research studies or clinical trials conducted by Phoenix or our partners. Participation is entirely voluntary. If you choose to participate, you will be required to provide separate, explicit opt-in consent for each study. Your data will only be shared with research partners after you have reviewed and agreed to the specific terms of that study.

4.3 Service Providers

We work with trusted service providers who help us run Phoenix:

• Hosting and database: Supabase and Netlify
• Payments: Stripe
• AI processing: Anthropic (Claude), with OpenAI as a backup, to read the documents you upload and prepare your insights
• Community: Circle
• Email and communication: Beehiiv, Resend, Google Workspace and Attio
• Reviews: Trustpilot, to send you one invitation to review Phoenix (your first name and email only)
• Analytics and error monitoring: PostHog, Sentry and Google Analytics
• Advertising measurement: Google Ads, to count the sign-ups that come from our ads
• Links and security: Dub (tracked links) and Cloudflare (spam protection on forms)

These providers may only use your information to provide their services to us, and they are contractually required to protect it. Our AI providers do not use your data to train their models.

4.4 Legal Requirements

We may disclose your information where required by law, regulation, legal process, or governmental request.

5. Data Retention

We keep your personal data and health data while your account exists, including after a subscription ends, so your history is still there if you come back. You can remove it at any time by asking us to delete your account (see Section 6).

Active accounts: All data (including health data, biomarker records, check-in history, supplement logs, and experiment data) is retained for the duration of your account’s existence to provide continuous trend analysis and historical insights.

After account deletion: When you delete your account, all personal data and health data is permanently deleted from our production systems within 30 days. Backups containing your data are purged within 90 days of account deletion.

Payment records: Transaction records may be retained for up to 7 years after your last transaction as required by applicable tax and financial regulations.

Anonymized data: Aggregated, anonymized data that cannot be used to identify you may be retained indefinitely for research and Service improvement purposes.

Advertising leads: If you submit your name and email through a Facebook or Instagram lead form, we retain that information in Supabase and Beehiiv until you ask us to delete it. Unsubscribing stops our marketing emails but does not delete the information we hold; to have it deleted, contact us as described in Section 9, Your Rights and Choices, below. Meta automatically deletes lead records from its own Lead Center system approximately 90 days after submission; our copy of your information is kept separately and is only removed upon your request.

6. Data Deletion

6.1 How to Delete Your Data

You can request deletion of your account and associated data at any time by emailing kevin@thephoenix.community. Kevin handles these requests, including your linked Circle account and any active subscription.

6.2 What Happens When You Delete

When you delete your account:

1. Your account is immediately deactivated and you will no longer be able to access the Service
2. All personal data, health data, biomarker records, check-in responses, supplement logs, experiment data, and community contributions are permanently deleted from our production database within 30 days
3. Your data is purged from all backup systems within 90 days
4. Any data shared with third-party services (Apple Health, Google Health Connect) remains on those platforms and is governed by their respective privacy policies. You can manage that data directly through those services.
5. Payment transaction records processed by Stripe may be retained by Stripe in accordance with their data retention policies and applicable financial regulations

6.3 Disconnecting Third-Party Services

You can disconnect Apple Health or Google Health Connect at any time through the app settings. Disconnecting stops all future data collection from that service. Previously synced data remains in your Phoenix account unless you separately request its deletion or delete your account.

7. Community Confidentiality

The Phoenix Community (hosted on Circle) is a private, members-only space. All content shared within the community is considered confidential. Members are strongly discouraged from sharing any information, discussions, or personal details of other members outside the community.

We enforce our community guidelines and take reasonable measures to keep the community confidential, but we can't control what other members do. If you prefer extra privacy, you're welcome to use a pseudonym in the community.

8. Data Storage and Security

Your data is stored on secure servers provided by Supabase in Singapore. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Row-level security on all database tables
• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest
• Access controls limiting employee access to personal data

While no online service can guarantee perfect security, we work hard to keep your data safe.

9. Your Rights and Choices

You have the right to:

• Access the personal data and health data we hold about you
• Correct inaccurate data by updating your profile or contacting us
• Delete your data by emailing us to request deletion at any time (see Section 6 above)
• Withdraw consent for data processing where consent is the basis for processing
• Disconnect third-party integrations (Apple Health, Google Health Connect) at any time through app settings
• Export your data by contacting us at kevin@thephoenix.community

To exercise any of these rights, contact us at kevin@thephoenix.community. We will respond to your request within 30 days.

If you only submitted your name and email through a Facebook or Instagram lead ad and are not a full Phoenix account holder, you can request access, correction, or deletion of that information the same way: email kevin@thephoenix.community. We will confirm within 15 business days.

10. Age Restrictions

The Service is intended for users who are at least 18 years of age. We do not knowingly collect personal data from individuals under 18. If we learn that we have collected personal data from a person under 18, we will delete that information promptly. If you believe we may have collected information from a person under 18, please contact us.

11. International Data Transfers

We store your data in Singapore. Some of our service providers process it in other countries, mainly the United States. Wherever your data is processed, we make sure it is protected as described in this Privacy Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Effective Date” at the top. We encourage you to review this Privacy Policy periodically for any changes.

13. Community Research

Phoenix looks at member data in aggregate — patterns across the whole community — to understand what actually helps APOE4 carriers, and we share what we learn with the community and the wider public, for example in our newsletter, on our blog, or in periodic research reports.

• Group-level only. We look at trends across groups of members — how biomarkers, habits, and protocols play out for the community as a whole — never at any one member’s journey.
• Always anonymous. Anything we share leaves out your name, your email, and your personal details.
• Community-sized findings. We only share findings drawn from groups large enough that they describe the community, not any individual.
• Your results stay yours. Your personal numbers and answers are never published.
• Easy to opt out. If you’d prefer your data not be part of community research, just email us at kevin@thephoenix.community and we’ll leave it out going forward.

This is separate from the opt-in studies described in Section 4.2, Research and Clinical Trials — those always ask for your explicit consent first.

14. Phoenix in AI Assistants

Ask Phoenix lets you use Phoenix inside AI assistants such as ChatGPT and Claude, and in other assistants that support the Model Context Protocol. Its general answers work without a Phoenix account; members can also sign in to see their own Phoenix data there.

• What we receive. When you ask a question that needs Phoenix, the assistant sends us only the details needed to answer it, such as your age range, APOE genotype, sex, menopause status, health conditions, lab values or the name of a supplement or trial location you mention. We do not receive your name, email, or your conversation with the assistant.
• What we do with it. We use those details to compute your answer and return it to the assistant. We do not store them, log them, link them to your identity or a Phoenix account, or use them to train any model. Our server records only that a request happened and how long it took.
• If you sign in as a member. Signing in is optional and happens on a Phoenix page, where you approve the assistant by name. After that, when you ask about your own data, we send that assistant what it asked for from your Phoenix account: your profile basics (first name, age, sex, APOE genotype, menopause status), lab results, Phoenix Score, roadmap, supplement stack, studies and pod. The assistant can also save a daily check-in when you ask it to. It sees only your own data, with the same access rules as the Phoenix app, and we do not log what is sent. You can disconnect Phoenix in the assistant’s settings at any time, or email us to revoke its access.
• “Carriers like you.” Some answers include what other Phoenix members do. These figures are aggregated from at least 20 members, each item reflects at least 5 members, and counts and percentages are rounded, so no individual can be identified. Members who opt out of community research (Section 13) are never included.
• The assistant’s own policy. The AI assistant you use (for example OpenAI or Anthropic) handles your conversation under its own privacy policy, not this one.
• Links back to Phoenix. Links in Ask Phoenix answers carry campaign tags so we can see that a visit came from an AI assistant. They contain nothing about your question.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Our Data Protection Officer is Dr. Kevin Tran, who you can reach at the same email address.