Legal

PRIVACY POLICY

Veris is a longitudinal health intelligence platform owned and operated by Artemyx Labs. This Privacy Policy explains what data Veris collects about you, how Veris uses that data, who Veris shares it with, and the choices you have about your data.

If you do not agree with this Privacy Policy, do not use Veris.

1. What We Collect

1.1 Information You Give Us Directly

• Account information. Email address, password (stored as a salted hash, never in plaintext), name, age, biological sex, and any profile data you choose to enter.
• Health and fitness data you log or enter manually. Workout records, strength performance (1RMs, PRs), aerobic test results, race results, body composition measurements, subjective wellness ratings, training notes, goals, and any other observations you type into Veris or describe to its AI agent.
• Files you upload. Lab reports (PDFs, images), workout photos, screenshots, progress photos, and other artifacts you choose to upload. The contents of these files are extracted and stored as structured observations in your profile alongside the original file.
• Conversations with the AI agent. All messages you send to the AI agent, all messages it sends back to you, and any structured data it proposes to write on your behalf (which you confirm, edit, or discard).
• Payment information. Payment information is processed by Stripe. Veris does not store your full credit card number or banking information.

1.2 Information We Collect Automatically

• Usage data. Pages you visit within Veris, features you use, time of access, device type, browser type.
• Technical data. IP address (for security purposes only; not used to track you), session identifiers.
• Error logs. When the app encounters an error, we log details to debug. These logs may include your account identifier to correlate the error with your session.

1.3 Information from Third Parties (With Your Consent)

When you connect a third-party data source through Veris's connections feature, we receive data from that source on your behalf. This may include:

• Wearable device data (from Whoop, Garmin, Apple Health) routed through Terra, our data aggregator: heart rate, sleep stages, HRV, training load, recovery scores, activity data.
• Other connected services as we add them.

You control which connections are active. You can connect, disconnect, or revoke access at any time in Settings. Disconnecting a service stops new data from coming in but does not automatically delete data already received. To delete that data, use the data-deletion options in Section 7.

2. How We Use Your Data

2.1 To Provide Veris's Core Service

• Display your health and fitness data back to you (Profile, Home, dashboards)
• Compute scores, percentiles, and insights based on your data
• Power the AI agent's responses to your questions and its proactive observations
• Compare your data to anonymized cohort statistics (e.g., "78th percentile vs. men 35–40")
• Track program adherence if you are enrolled in a coaching program

2.2 To Improve Veris

Your data may be used in anonymized and aggregated form to improve cohort statistics, train and improve the AI agent (only with your explicit consent — see Section 3), and identify product issues. Aggregated and anonymized data cannot be re-identified to you.

2.3 To Communicate With You

We may use your email address to send account-related messages, product updates, and respond to support requests. Marketing emails are sent only if you opt in. You can opt out at any time.

2.4 To Comply With Legal Obligations

We may use your data to comply with applicable laws, respond to lawful requests from public authorities, and defend legal rights and prevent fraud.

3. Your Consent Scopes

Veris's data handling is structured around four explicit consent scopes you control independently in Settings → Privacy:

1. Data storage. Permission to store your observations. Required for Veris to function. Revoking triggers full deletion of your data.
2. Agent access. Permission for the AI agent to read your observations and propose insights.
3. Coach visibility. Permission for a Cerus coach assigned to you to see your data. Without this, no human at Artemyx Labs or Cerus can see your data.
4. Anonymous benchmarks. Permission to include your data, anonymized and aggregated, in cohort statistics. Your individual data is never visible to other users in any form.

On signup: data storage and agent access are required. Coach visibility and anonymous benchmarks default to off.

4. Who We Share Your Data With

4.1 Service Providers (Under Contract)

• Anthropic, Inc. — Powers Veris's AI agent. Relevant content is sent to Anthropic's API when you converse with the agent. Anthropic does not train its models on Veris user data per its commercial terms.
• Supabase — Hosts our database, file storage, and authentication.
• Amazon Web Services (AWS) — Hosts backend services and uploaded files.
• Cloudflare — Hosts the Veris frontend and provides CDN, DNS, and security services.
• Terra — Aggregates data from third-party fitness apps and wearables you connect.
• Stripe — Processes payments. Stripe's privacy policy applies to your payment information.
• Resend — Delivers transactional email.

We do not sell your data. We do not share your individual data with advertisers or marketers.

4.2 Cerus Coaches (With Your Explicit Consent)

If you have granted "coach visibility" consent and are paired with a Cerus coach, that coach can see your data within Veris's coach interface. Coaches are bound by professional confidentiality. You can revoke coach visibility at any time.

4.3 Legal Requirements

We may disclose your data if required by law, subpoena, or other legal process; to protect rights, property, or safety; or in connection with a merger or acquisition (you will be notified and given the opportunity to delete your account before any transfer).

5. Data Security

We protect your data using:

• Encryption in transit (TLS for all connections)
• Encryption at rest (Supabase, AWS S3)
• Strong password hashing (bcrypt; no plaintext storage)
• Access controls and audit logs for production systems
• Row-level security policies isolating your data from other users

No system is perfectly secure. If we discover a breach affecting your data, we will notify you in accordance with applicable law.

6. Your Rights and Choices

6.1 Access

You can view all data Veris has stored about you within the app. You can request a complete data export in JSON format via Settings → Data → Export.

6.2 Correction

You can correct or update most data directly in the app. For data you cannot edit directly, contact us at privacy@artemyxlabs.com.

6.3 Deletion

You can delete your account from Settings → Data → Delete Account. Deletion follows a tiered model:

• Within 24 hours: Authentication credentials disabled. PII (name, email, profile) purged from active database. Uploaded files hard-deleted from AWS S3.
• Within 30 days: All data linked to you deleted from active systems and backups.
• Retained indefinitely (anonymized only): Individual observation data, stripped of all identifying information, may be retained for cohort statistics. This data cannot be linked back to you. To opt out, contact us within 30 days of account deletion.

6.4 Revoking Consent

You can revoke any consent scope at any time in Settings → Privacy. Revoking consent stops future processing under that scope but does not retroactively undo prior processing.

6.5 Data Portability

Your data export (Section 6.1) is in JSON format suitable for porting to another service.

6.6 Lodging a Complaint

If you believe we have mishandled your data, contact us first at privacy@artemyxlabs.com. If you are not satisfied with our response, you may have the right to lodge a complaint with a data protection authority in your jurisdiction.

7. Children

Veris is not intended for use by anyone under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us at privacy@artemyxlabs.com and we will delete it promptly.

8. International Data Transfers

Veris's primary infrastructure is hosted in the United States (AWS us-west-2; Supabase us-west-1). If you access Veris from outside the United States, your data will be transferred to and processed in the United States. By using Veris, you consent to this transfer. For users in the EEA or UK, we rely on Standard Contractual Clauses or other approved transfer mechanisms with our service providers.

9. AI and Automated Decision-Making

Veris's AI agent makes recommendations and surfaces patterns based on your data. These recommendations are advisory only and do not produce legal effects on you. You can override, ignore, or dispute any agent recommendation. The agent does not autonomously make decisions that affect your finances, healthcare, or legal status.

The agent may write structured observations to your profile, but only with your explicit confirmation for each one. You can edit or discard any agent-proposed observation before it is written.

10. Changes to This Policy

We may update this Privacy Policy as Veris evolves. When we make material changes, we will update the "Last updated" date, notify you by email if you have an active account, and for substantial changes, request re-consent before continuing to use your data under the new terms. Prior versions are available on request to privacy@artemyxlabs.com.

11. Contact Us

For privacy questions, requests, or complaints:

Email: privacy@artemyxlabs.com
For urgent security issues: security@artemyxlabs.com

---

This policy describes Veris's current data handling practices. It is subject to legal review. If any provision is found to conflict with applicable law, that provision is severable and the remainder continues in effect.