1. Soma
2. Privacy Policy
3. Consumer Health Data Privacy Policy

Consumer Health Data Privacy Policy

Effective October 25, 2026

This policy is for people in the United States, including under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's consumer health data provisions. It covers the Soma app and this website. It sits alongside our general Privacy Policy, which has more detail.

Short version: Soma keeps your health data on your phone. We have no account system, no analytics of our own and no server that stores your health data. Health data leaves your phone only if you turn on the optional cloud assistant in a test build, and only with your consent. We never sell health data and never use it for advertising.

Who we are

Soma is made by Anton Kozionov, an individual developer in Ukraine. Contact: hello@somalab.app

Health data Soma handles, and why

• Lab results read from the reports you import, with the names of the labs and clinics.
• Examinations and allergy tests: ECG, echocardiography, bone density, spirometry, ultrasound and IgE panels, with their numbers and conclusions as printed.
• Device and wearable data: for example heart rate, heart rate variability, blood oxygen, respiratory rate, sleep, steps, activity and workouts, weight, body fat, blood pressure and glucose.
• Health details you add: values you type in, smoking and alcohol, diagnoses, pregnancy and cycle dates, medications and notes.
• Profile details: name, date of birth, sex and country, for you and for any family members you add.
• Your conversations with the assistant, which may include health questions.

Soma uses this data only to provide the features you use: to show and chart your results against your lab's reference ranges, read them in the context of your health details, recognize a report that belongs to another profile, schedule reminders to repeat a test, and answer your questions in the assistant.

Where it comes from

• You: what you type in and the reports, photos and scans you import.
• Apple Health or Health Connect, only the types you allow. Soma reads them and never writes to them.
• Export files from Garmin, Withings, Oura, Dexcom Clarity or LibreView that you open in Soma. Soma doesn't connect to those services' accounts.

What stays on your phone

All of the data above is stored and processed on your phone. Reports are read on the device, and the assistant's private mode runs a language model on the phone without the internet. We don't receive this data and can't see it. Your phone's own iCloud or Google backup may include it, according to your phone's settings; that backup is in your Apple or Google account, not with us.

What leaves the phone: the cloud assistant

Test builds of Soma (for example through TestFlight) may offer a cloud mode for the assistant. It is off until you choose it, and the app asks for your consent first, naming what is sent and to whom. For another person's profile it asks again before sending that profile's data.

With each question, cloud mode sends the profile's lab results with lab and clinic names, the conclusions of examinations, device data and typed-in values, habits, diagnoses, medications, experiments, notes, what you asked the assistant to keep in mind, age and sex, country, pregnancy and its week, cycle phase, and the earlier turns of the conversation. Name and date of birth are not sent as separate fields, but they can appear inside notes or an examination's conclusion.

• Cloudflare runs our server, chat.somalab.app, which passes the request through to Anthropic. Our server keeps no copy and no logs. To limit how often questions can be sent, it counts requests per IP address and per random app identifier for one minute.
• Anthropic runs the Claude model as our service provider (processor). It processes the request in the US, doesn't train models on it, and deletes it within 30 days. It keeps a request longer only if it is flagged as breaking Anthropic's usage policy.

The private, on-device mode sends nothing.

Who receives health data

Only service providers acting for us, and only in cloud mode: a network and hosting provider (Cloudflare) and an AI model provider (Anthropic). We have no affiliates that receive health data, and we share it with no one else.

Things you send yourself go where you send them: an export file, a shared report, or an email reporting a mistake that opens in your own mail app.

What we don't do

• We don't sell health data.
• We don't use it for advertising, and Soma has no ads or tracking.
• We don't use it to train models.
• We don't use geofencing or track your location.

Your rights

• Access. Everything Soma holds about you is in the app on your phone. Export puts all of it into one file. You can also ask us to confirm whether we collect, share or sell your health data and to list the third parties that receive it.
• Deletion. On the phone, Profile → Settings → Delete everything removes all your data, and deleting the app does too. For anything sent in cloud mode, write to hello@somalab.app. Our server keeps no copy, and Anthropic deletes requests within 30 days, as described above.
• Withdrawing consent. Switch the assistant to private mode, and nothing more is sent. You can also withdraw access to Apple Health or Health Connect at any time in your phone's settings.

How to use your rights

Write to hello@somalab.app and tell us what you'd like. We may ask for details to confirm the request is yours, without asking for more than we need. It's free, and we'll answer within 45 days; if we need more time, we'll tell you why, and we won't take more than 45 more days.

If we decline your request, you can appeal by replying to our answer with “Appeal” in the subject. We'll answer the appeal within 45 days and explain our decision. If you disagree with it, you can contact your state's attorney general, for example the Washington State Attorney General (atg.wa.gov), the Nevada Attorney General or the Connecticut Attorney General.

Changes

If this policy changes, the new version will be published on this page with a new effective date. We won't start collecting or sharing health data in new ways without asking for your consent first.