How your data is held
The privacy page says what SteadyRange will not do with your readings. This page is the checkable half: where they run, who else can see them, and what happens when you ask for them back or ask for them gone.
Optional AI and retention
When you invoke an AI feature or enable AI summaries, photos, questions, transcripts, file contents or a relevant health-record summary can be sent through our server to the configured processor. SteadyRange does not store uploaded scan images, but provider deletion is separate. Review the provider terms before submitting sensitive information.
OpenAI
API data is not used for training by default. Abuse-monitoring retention is generally up to 30 days, with exceptions and endpoint-specific storage. No approved zero-retention configuration is claimed here.
Provider data policyxAI
Optional voice parsing can send a transcript when rule-based parsing fails. API retention depends on account configuration; zero retention has not been verified.
Provider data policy- Live health records
- Erase health data removes logged health records from the live database and revokes report, calendar, and caregiver links. Account settings, care-team records, care messages, and subscriptions remain. Account deletion also removes sign-ins, care messages, and caregiver access and cancels subscriptions.
- Database backups
- Provider-dependent expiry. The deployed backup window has not been verified; deletion does not immediately erase provider backups.
- Security audit records
- Retained after deletion. The operator has not yet published a verified retention period.
- Payment records
- Stripe retains transaction records under its legal and contractual obligations; deleting SteadyRange does not delete those records.
- Optional AI requests
- Provider-dependent retention and deletion limits. No zero-retention configuration is claimed. Generated answers may be saved in your account.
- Recipient copies
- Previously downloaded reports, screenshots and delivered email cannot be recalled.
Disclosure updated September 30, 2026. Production processor contracts and retention settings still require operator verification.
Controls
Transport and storage
Every connection is HTTPS; there is no plaintext fallback. Records are held in a managed SQLite database that the provider encrypts at rest. Third-party device credentials — the tokens that let a connected scale or CGM account sync — are additionally encrypted in the application layer with AES-256-GCM before they are written, so a database dump does not hand anyone working credentials to your account elsewhere.
Authentication
Sessions are cookie-based, HTTP-only, and short-lived, with a five-minute signed cache in front of the session table. Passwords are hashed and are never stored or logged in the clear. Passkeys — Face ID, Touch ID, Windows Hello, hardware keys — are supported and are the stronger option: a passkey cannot be phished or replayed on another site. Email addresses must be verified before an account becomes usable, and disposable-address domains are refused at account creation.
Isolation between accounts
Every query that touches a health record is filtered by the authenticated user id — there is no shared pool and no cross-account view. Clinician access is separate and explicit: a practice sees a member's record only through a live enrollment plus a consent scope that member granted, and every read of a shared record is written to an append-only audit chain the practice cannot rewrite.
Shared clinician links
A clinician link is a long random token in the URL, and that token is the only credential — which is the point, because a doctor should not need an account to read one page. The link is never indexed, and it can be rotated or switched off from Settings, at which moment it goes dead. Treat it the way you would treat an emailed document: anyone holding the link can read that report.
What deletion removes
Erasing health data removes logged health records from the live database and revokes report, calendar, and caregiver links. Care-team records, care messages, account settings, and subscriptions remain until account deletion. Backups are not erased immediately; their expiry window has not been verified. Security audit records, payment-provider records, optional AI processor records, and recipient copies have separate retention or deletion limits, listed below.
What is not claimed
SteadyRange is not a covered entity and does not offer a HIPAA business associate agreement. It holds no SOC 2 report and has not had a third-party penetration test. It is not a medical device and does not give treatment advice. Saying so plainly is part of the posture: a small product that names its limits is easier to evaluate than one that implies certifications it has never been through.
Who else touches your data
A small product runs on other people’s infrastructure. Pretending otherwise would be the dishonest version of a privacy claim, so here are the infrastructure providers, alongside the configured AI processors above and what each company can see.
| Company | What it does | What it can see |
|---|---|---|
| Vercel | Runs the application and serves every page. | Every request, in transit. Aggregate, cookieless page counts are retained; request payloads are not. |
| Turso | Hosts the managed SQLite database your records live in. | All stored records, encrypted at rest by the provider and reachable only with the service credential. |
| Resend | Delivers transactional email — verification, magic links, reminders, the weekly briefing. | Your email address and the contents of mail addressed to you. A briefing email contains your figures, which is why it is opt-in. |
| Stripe | Processes Plus subscriptions. | Your billing details. Card numbers never reach SteadyRange; the app stores a customer id and a subscription status. |
| Upstash | Caches sessions and enforces rate limits. | Session identifiers and request counters. No readings. |
| Axiom | Collects application traces so failures can be diagnosed. | Request timings, route names, and error text. Not reading values. |
Optional integrations you switch on yourself — a connected scale, a CGM import — add the provider you chose to this list for your account only, and drop off it when you disconnect them.
Who runs SteadyRange
SteadyRange is built and operated by one person — not a team, not a venture-funded company. There is no support tier between you and whoever wrote the code: the address below is read by the person who can actually fix the thing you are writing about.
That is deliberate, and it cuts both ways. A single operator means decisions about your data are not made by a growth team you will never meet — and it also means there is no 24-hour on-call rotation. Both are worth knowing before you trust a product with a medical history.
Reporting a vulnerability
If you have found a way to reach another member’s records, to open a report you were not given, or to bypass a consent scope, email hello@steadyrange.com with enough detail to reproduce it. You will get a human reply, not an autoresponder. Please do not run automated scans against the live service, and please do not access, alter, or keep anyone else’s data while demonstrating an issue — a description and a request path are enough.
There is no bug bounty programme, and no legal threat either. Good faith reports are welcome and will be credited if you want them to be.