Your health data, held with care.
Northstar handles personal health information carefully and honestly. Here is exactly how we protect it, what we do with it, and what we will never do.
The safeguards under every result.
Encrypted in transit and at rest
Your lab results, vitals, and profile are encrypted with TLS in transit and AES-256 at rest. Nothing moves or rests unprotected.
Strict access controls and least privilege
Only the parts of Northstar that need your data for a specific job can read it. Access is scoped to the minimum required, logged, and reviewed.
Isolated data storage
Your data lives in an isolated store. No other Northstar user can see or reach it, by any path.
Your data is never sold
We do not sell your health data or any personal information, ever, to data brokers, advertisers, or any third party.
Export anytime
You can download a complete copy of everything Northstar holds about you, in plain JSON, from Settings whenever you want.
Delete anytime
You can permanently delete your account and all your data from Settings. Deletion is real and complete: we do not keep hidden copies.
How AI providers handle your data.
Not used for training
Your data does not train public AI models.
Processing under data agreements
When Northstar uses an AI model to explain a lab result or generate a summary, your data is sent to that model provider under a data processing agreement. The provider processes it only to fulfil your request and may not use it for any other purpose.
Your data does not train public models
Northstar's agreements with AI model providers prohibit your personal health data from being used to train or improve any public foundation model. What you enter stays yours.
Minimum necessary data
Northstar sends only the context needed for the specific task: the values relevant to the explanation being generated, not your entire history. We share the minimum needed to do the job.
Subprocessors kept minimal
We maintain a current list of every vendor that may process your data. We keep that list as short as possible. If it changes in a material way, we update this page and notify you.
Export and delete on your terms.
You can download a complete JSON export of your results, vitals, and profile from Settings at any time. You can also permanently delete your account and all associated data. Deletion is permanent and complete. See Your data for a plain-language walkthrough.
Where we are as a Pre-Seed company.
Northstar is a Pre-Seed company and we are honest about that. We have not yet pursued SOC 2 certification. SOC 2 Type II is on our engineering roadmap as we grow, and we will communicate progress publicly. What we can tell you now is what we actually do: the specific technical controls described on this page. We do not claim certifications we do not hold.
Responsible disclosure
If you find a security issue in Northstar, please tell us before disclosing it publicly. Write to security@northstars.health with a description of the issue and steps to reproduce it. We will respond promptly, work with you to understand and address the issue, and credit you if you would like.
Questions about how we protect your data?
We are glad to explain our practices in plain language.