Privacy Policy

Last updated: 2026-09-23

This policy explains what Rowan keeps on your device, what reaches our backend and AI providers, and how to control it. Your messages can include sensitive health information. AI chat sends your message, recent conversation history and saved health context to Anthropic, with OpenAI as an automatic fallback. The independent safety check also uses those providers. Microphone transcription sends your recording to OpenAI. These are separate from the local tracking and planning tools.

Who we are

Rowan is an iOS app from HyperSage AI Labs LLC. There is no account and no login. A random identifier generated on your device connects your requests to the records on our server. This does not make the content anonymous: the name you choose, your messages and your health details may identify you. Contact: support@hypersage.ai.

The short version

You choose whether to use AI. The AI data-sharing disclosure names the information and providers before you allow sharing. You can use the local tools without AI, or turn off AI sharing later.
Anthropic and OpenAI can receive health information. Both can process text for replies and the independent safety check. OpenAI also processes a voice recording when you choose microphone transcription.
Conversations and some symptom logs are stored on our server. Your saved profile, tracking record, patterns and visit brief are managed on your device. Selected profile and symptom details are nevertheless sent with AI messages.
We do not sell your data or share it for advertising. We share the information described here with service providers to operate Rowan. There are no advertising SDKs or third-party product analytics attached to your health content.
You can export and delete your data. Confirmed server deletion removes our active database records; the app reports incomplete cleanup so you can retry. Existing database backups expire within five days. AI providers have their own retention rules for information already received.

What is sent off your device — and why

1. AI replies and the independent safety check

When you send an ordinary AI chat message, including an explicit "Ask Rowan" action, the app sends it to our backend with your locale and selected saved context:

Your preferred name and recent saved notes under "What Rowan knows".
Conditions you marked as diagnosed or suspected.
Medication names, schedules and start dates. The separate medication dose field is not attached as ordinary profile context. It can appear in a visit-brief draft you choose to send, or in a message you write.
Allergies and their recorded reactions.
Recent symptom names, dates, severity and selected factors.

For a reply, the backend adds recent messages from the same stored conversation, up to about 14,000 characters. This can include earlier health details and Rowan's replies. Anthropic (Claude) is the primary reply provider. If its request fails to start, automatic fallback can send the same message, history and profile context to OpenAI. You are not asked again on each fallback; permission covers both named providers.

The optional AI intake sends your interview messages through the same service and provider routes after permission. It does not attach your saved profile list, but your answers and earlier interview messages can themselves contain health information.

The independent safety check can separately send your current message, up to six recent conversation messages and your registered conditions to Anthropic, or to OpenAI if that check falls back. OpenAI can therefore receive this safety context even when Anthropic generates the reply. A model may also receive the arguments and results of actions it proposes during the conversation, such as logging a symptom. This check helps route responses and emergency resources; it is not human monitoring or an emergency service.

Your random device identifier and App Store subscription identifiers go to our backend for record ownership, usage limits and entitlement checks. They are not included in the AI provider requests. Free-form messages and recordings can still contain identifying information you choose to include.

2. Local tools and memory notes

Your tracking views, patterns, monthly recap and visit brief are assembled on your device. Building or exporting a brief does not trigger a separate cloud analysis. Your saved questions, discussion points and appointment details form part of your local record.

Discuss with Rowan puts an excerpt of the visit brief in the message box for you to review and edit. It does not send the draft automatically. Depending on the brief and excerpt length, that text can include your name and pronouns, clinician and appointment details, visit purpose, conditions and allergies, symptom summaries and entry notes, medication doses and notes, and questions or discussion points you added. When you choose Send with AI sharing allowed, the visible text goes to our backend and the named AI providers, together with the ordinary profile context and recent conversation history described above. Photo files are not included. If you choose to discuss another local finding with Rowan, that AI message follows the same sharing rules.

Your phone holds the saved list of "What Rowan knows". Our server does not store a separate copy of that saved list. Up to 24 recent notes are, however, attached to each ordinary AI message and processed by our backend and the AI provider. Removing a saved note stops that note being attached as profile context on later turns; it does not erase an earlier conversation containing the same information, an existing backup or a provider's retained request.

Photos attached to log entries stay in Rowan's local record. On iPhone, Add a photo opens the system picker so you can choose an image or use the camera. Rowan receives only the image you choose; it does not browse or request broad access to your photo library. It stores a copy in its private app storage and shows it with the entry and visit brief. These attachments are not sent to Rowan's backend or AI providers. The system picker can also create temporary copies separate from Rowan's saved photo record; iOS manages their cleanup timing.

The JSON data export contains attachment references, not the photo files; visit-brief exports also exclude the images and say so. Show a photo in the app or share a separate copy yourself. Clearing or leaving an unfinished photo draft discards its stored copy; interrupted cleanup can be retried on a later app launch. Removing a saved entry can leave its photo until cleanup on a later launch, so Undo can still work. Delete everything also attempts to remove Rowan's stored photo copies and reports if their removal cannot be confirmed. It does not delete originals in your photo library or copies you have shared elsewhere.

Exports are copies you control. A PDF or text visit brief contains the selected summary and its patient context, questions and notes. On iPhone, file exports use a temporary copy in Rowan's cache for the system share sheet. Delete everything attempts to remove Rowan's cached export files, including copies made by earlier versions, and reports if cleanup cannot be confirmed. It cannot recall a share sheet that is already open or a copy you save to Files, send to another app or share with another person. Manage those separate copies where you saved or sent them. A text share may instead use the clipboard, depending on the available sharing controls.

3. Microphone transcription and read-aloud

Microphone transcription is optional. The AI-sharing disclosure explains the OpenAI recording transfer before you allow AI sharing. If sharing is off, choosing the microphone opens that disclosure first. After allowing AI sharing, you still choose when to record by tapping the microphone; iOS separately asks for microphone permission. There is no second Rowan audio-permission dialog, no background listening and no wake word. You can refuse microphone access or revoke it in iOS Settings and continue typing.

When you stop recording, the clip goes through our backend to OpenAI's transcription API. That provider receives the recording, which may itself contain health or identifying information. Your profile, saved notes and conversation history are not attached to the transcription request. Device and subscription identifiers are used by our backend, not passed to OpenAI with the audio.

The recording is held temporarily for transcription; Rowan does not save an audio file or put the recording in its database. The returned text goes into the message box for you to review and edit. It is not added to a conversation until you press Send. A transcription request can still leave usage counters and operational request metadata even if you never send that text. Once sent, the text is an ordinary AI message with the processing and retention described here. A recording is limited to about one minute.

Read-aloud uses your device's speech synthesis. Rowan does not send the reply text to our backend or an AI provider to speak it. The backend's cloud text-to-speech capability is disabled. Enabling cloud read-aloud would require a separate disclosure and permission for that use.

What we store and how long

Our database holds conversations and their messages, symptom logs created through the conversation, content-free safety events, usage counters and some subscription ownership records. A conversation title uses the first few words of its opening message. Records are linked to the device identifier, or to the separate pseudonymous App Store account token for subscription claims. There is no sign-in or cross-device account sync.

Conversations and messages: eligible for deletion after 90 days without a new message in that thread. Continuing a thread keeps its older messages until the whole thread has been inactive for 90 days.
Server symptom logs: 365 days from when the server stored them.
Safety events: 90 days. These contain a hashed device identifier, time, tier and bounded route/verdict/reason codes, not your message, symptom or condition text.
Usage and rate-limit counters: 35 days. These contain a day, resource and count keyed to a hashed device or network address, not health content.
Subscription ownership claims: an Apple transaction identifier, pseudonymous app-account token and creation time. These have no automatic expiry, to prevent reuse of the same receipt by another installation. The app's data-deletion request removes claims associated with its app-account token.

Expired rows are removed by a sweep scheduled every six hours. Database backups have a five-day retention period. A deleted record can remain in an existing backup until that backup expires; deleting active records does not rewrite those snapshots. Your on-device record remains until you remove it using the app's controls. These periods describe our database, not the separate AI-provider policies below.

AI-provider handling and retention

We use the providers' API services, not their public chat products. Their published API policies say inputs and outputs are not used for model training by default; opt-in and other stated exceptions are governed by those policies. We do not promise that every provider request is deleted immediately or within an unconditional 30-day maximum.

Anthropic: its standard API policy deletes inputs and outputs within 30 days, with exceptions including policy enforcement, legal requirements, certain features and separate agreements. Its published policy also describes longer retention for flagged content. API retention; model-training policy.
OpenAI: chat API abuse-monitoring logs can include request content and are normally retained for up to 30 days, with legal exceptions. Its current endpoint table lists no abuse-monitoring or application-state retention for the audio transcription endpoint Rowan uses. These are the retention terms OpenAI publishes for the API requests Rowan’s service sends. API data controls and endpoint retention.

Deleting data in Rowan or withdrawing AI permission does not recall requests already sent or directly delete records held by an AI provider. Contact us if you need help with a request about that processing.

Protection and operational data

Connections from Rowan to our backend and from the backend to AI providers use HTTPS/TLS. Our database runs on Fly.io's private encrypted network, and its storage volume is encrypted at rest. Provider credentials remain on the server. Database reads, exports and deletes are scoped to the requesting device's identifier. This is not end-to-end encryption: our backend and the AI provider must process readable content to provide the requested feature.

We minimize operational logs and do not intentionally log message or audio bodies. Service logs can include connection metadata, timestamps, status codes and error details; they are separate from the content-free safety-event table. Third-party crash reporting to Sentry is disabled.

Rowan does not request access to your contacts, calendar, precise location, Apple Health record or iPhone medication list. Its optional photo picker handles only the image you select, as described above. Information you type, record or add to Rowan can include those details. We do not require an email address or account credentials, and do not use an advertising identifier.

Rowan is a consumer wellness app; we make no claim that it is a HIPAA-covered service. If a breach requires notification under applicable law, we will provide the required notices. Because Rowan does not require contact details, in-app and public notices may be necessary.

Third parties

The providers' published data-processing terms describe restrictions on processing purposes, confidentiality, security measures, assistance with privacy rights and protections when they use subprocessors. Read the Anthropic data-processing terms and OpenAI data-processing terms alongside the retention limits above.

Anthropic: primary AI replies and independent safety checks. Privacy policy.
OpenAI: automatic fallback for replies and safety checks, and optional microphone transcription. Privacy policy.
Fly.io: backend, database and backup hosting. Privacy policy.
Apple: app distribution and purchases. Apple handles billing; Rowan receives signed subscription information to verify access. Privacy policy.

Same or equal protection. Anthropic and OpenAI receive only the data they need to answer your requests, under commercial API terms that limit their use of it to providing that service to us (and to abuse monitoring and legal compliance) and that require confidentiality and security. We confirm that they protect your data to the same or an equal standard as this policy describes and as Apple’s App Store Review Guidelines require. None of them may sell it or use it for advertising. Fly.io hosts our servers under terms that let it use hosted data only to provide and improve its hosting service; it has no right to sell that data or use it for advertising.

Your choices and rights

AI sharing: review the disclosure under You › Settings & privacy › About the AI › AI data sharing › Review. Choose to use Rowan without AI or allow sharing with the named providers. Turn off AI sharing under You › Settings & privacy › Privacy › Turn off AI sharing to stop later chat and transcription requests. Withdrawal does not undo processing already started or delete previous records.
Memory notes: view, edit or remove an individual note, or clear the saved list under "What Rowan knows". Earlier conversations are separate records.
Export: the app creates a JSON file containing its local record and the server rows tied to its identifiers, including any associated subscription ownership claims. If the server is unavailable, the export says so and includes only the local copy.
Delete: Delete everything stops current AI requests, attempts to erase the saved local record, conversations, attached photos and Rowan's cached exports, cancels medication reminders, and asks the backend to delete the associated conversations, messages, symptom logs, safety events, device usage counters and subscription claims. Confirmed local cleanup also clears unsent chat, brief and Log drafts. Successful server deletion returns a per-table receipt. If local removal or server deletion cannot be confirmed, the app identifies the incomplete part and asks you to retry; "Erased on this device" means the local cleanup was confirmed but the service has not confirmed erasure. A counter keyed to a network-address hash is not tied to one device and is not included; it expires under the 35-day rule. Already-shared copies, existing backups and provider records follow the separate limits above. Removing the app alone does not send a server deletion request.
Privacy requests: you can use the in-app controls or contact support@hypersage.ai to request access, correction, export or deletion, or to withdraw consent. Applicable rights may depend on where you live. We rely on explicit consent for AI processing of health information and use limited operational data to secure and operate the service. We do not sell personal information or share it for cross-context advertising.

Children

Rowan is intended for adults 18 and older and is not directed at children. We do not knowingly collect data from children. If you believe a minor has used the app, contact support@hypersage.ai.

Changes

If we change this policy we will update the date above and post the new version here. Material changes will be noted in the App Store update notes.

Contact

Questions about privacy: support@hypersage.ai

In an emergency, don't type — call 911. Rowan is not an emergency service and is not monitored by a human. If you are having a medical emergency, call 911 or your local emergency number. If you are thinking about harming yourself, call or text 988 (US Suicide & Crisis Lifeline). Never delay care because of something in this app.