Privacy Policy

Breast Implant Illness Tracker is an independent education and personal-tracking tool. It is not a medical provider, and using it does not create a doctor–patient relationship.

• It does not diagnose Breast Implant Illness or any condition.
• It does not tell you whether to explant.
• It does not tell you to stop or change any medication.
• It does not recommend an individual surgeon, provider, or treatment.
• Diagnoses you record are diagnoses you report receiving from a clinician — never diagnoses made by the Tracker.
• Timing relationships shown by the Tracker (for example, a symptom before or after an implant date) do not establish that implants caused anything.

We collect only what you enter and what your account needs:

• Account: your email, a password (stored only in hashed form by our authentication provider), and an optional display name.
• Implant / device history: the implant devices and surgical events you choose to enter.
• Symptoms & measurements: the reported symptoms you track, their severity and frequency, and your check-ins over time.
• Reported diagnoses: diagnoses you report having received from a clinician.
• Medical journey: optional summary details (for example, an approximate number of specialists seen).
• Whole-Person Context (optional): if you choose to add it, wider context such as reproductive stage, hormone therapies, sleep, lifestyle, and self-reported concerns. This is always optional and never required.
• Lab results & reports: lab values you enter, and lab reports (photos or PDFs) you upload. If you use the Holistic AI reader, the report is sent to our AI provider solely to extract values for you to review and confirm — you decide what is saved.
• Medical records: documents you upload to your private records vault — for example operative reports, implant cards, pathology, and imaging. We store them; we do not read or interpret them.
• Journal: free-text notes you choose to write, and their dates.
• Community content: posts, replies, reports you submit, and an optional display name — this is content you intentionally write and share with other members. Community participation is separate from research/community-data consent.
• Membership status: if you subscribe, your subscription status and plan (monthly or annual). Your payment card details are handled entirely by Stripe — we never see or store them.
• Research consent status: whether you have opted in to contribute de-identified data (see below).

• To show you your own assessment result, dashboard, and symptom trends.
• To operate and secure the service.
• Only if you opt in: to include de-identified information in future community-reported, observational analyses (see “Research & community data”).

We do not sell your personal health information. We do not display your private tracking information publicly. We do not place advertising trackers on your private health pages, and we do not send your symptom information into marketing analytics.

We use a small number of trusted infrastructure providers to run the Tracker:

• Supabase — database, sign-in, and storage.
• Vercel — website hosting and delivery.
• Resend — sending account emails (sign-in confirmation, welcome, and password reset).
• Anthropic (Holistic AI) — only when you use the Holistic AI features. A lab report you ask it to read, or a question you type into “Ask the Tracker,” is sent to Anthropic to generate the response and then returned to you; it is not used to train their models. If you never use those features, nothing is sent.
• MailerLite — only if you subscribe to the newsletter: your email, to send the emails you signed up for.
• Stripe — subscription billing and payments, only if you choose a paid Membership. We send Stripe only the minimum needed to manage your subscription (your email and an account identifier). We never send Stripe your symptoms, diagnoses, implant, surgery, or other health information, and Stripe handles your card details directly — we never see or store them.

These providers process data on our behalf to provide the service. We do not otherwise share your personal information for others’ independent use.

• The site is served over encrypted HTTPS connections.
• Database access rules restrict each account to its own records; other users cannot read your private data.
• The privileged administrative key used to delete an account runs only on our servers and is never exposed to your browser.

No online service can promise perfect security, and we do not.

Contributing data for community-reported observational analysis is entirely optional and separate from normal use of the Tracker. See the full Research / Community Data Consent document for details. In short:

• You can use the tracker fully without contributing.
• Contribution is opt-in, and you can withdraw it later.
• When you opt in, contributed data is tied to a random pseudonym rather than your identity.
• We do not publish community statistics during the private beta.

• Reset your password at any time.
• Withdraw research consent at any time from your dashboard.
• Delete your account and private data. See the Account & Data Deletion document.

If de-identified aggregate statistics are ever produced in the future, they are not personal data and generally cannot be reversed back into individual records; those aggregates would not be affected by deleting your account.

Accounts we use for internal testing are flagged as test data and are excluded from any analytics or aggregate statistics.

During the private beta, the Tracker is intended for users who are 18 or older and located in the United States. Some features (such as the Explant Access Fund applications and community posting) are not active yet and are marked “Coming later.”

We may update this draft as the Tracker develops. Material changes will be reflected here with a new “last updated” date. This is a draft prepared for the private beta and has not been reviewed by an attorney.