Privacy Policy

Last updated: October 13, 2026

Mosiac Health is a personal health app run by Matthew Legault in Calgary, Alberta (“we”, “us”). This policy explains what information the app collects, why, who it’s shared with, where it’s stored, and the choices you have. We follow Alberta’s Personal Information Protection Act (PIPA). You must be 18 or older to use the app.

The short version: we use what you tell us to give you advice and an exercise plan, and to book appointments when you ask us to. We don’t sell your information, don’t use it for advertising, and don’t let anyone use it to train AI. You can download or delete it any time.

1. What we collect

Your account: your name, email address and password. The password is stored only in a scrambled, one-way form that can’t be turned back into the password.
Your profile: your age, the sports you play, what you first came in about, and your phone number if you give it.
What you share about your health: what you tell the assistant (typed or spoken), your answers to its questions, pain and symptom check-ins, and the exercise sessions you complete.
Your voice: when you speak, the recording is turned into text on our own server and deleted straight away. We keep the text, not the audio.
Bookings: the clinic and time you ask for, the contact details you give for it, any notes, the referral summary we prepare from your information, and the clinic’s own intake form when the clinic has one (it can include your health card number, address, medical history and medications).
Security records: when you sign in, from what IP address and type of device, and a log of account actions such as creating, changing or deleting an account.

The app uses one cookie, to keep you signed in. There’s no advertising or tracking.

2. Why we use it

To run the app: the conversation, your tailored exercise plan, prevention routines for your sports, and your progress.
To book appointments you ask for: your request, referral summary and any intake form go to our team, who pass them to the clinic. Once the clinic confirms, we confirm the appointment with you.
To email you about your account and your bookings: confirmations, a reminder the day before an appointment, and a follow-up afterwards. Every follow-up email has a link to stop them.
To keep the app and your account secure, and to fix problems.

3. Who we share it with

We use a few service providers to run the app. Each gets only what it needs, for that purpose only.

Who	What they receive	Why	Where
Amazon Web Services	Everything stored in the app, including backups	Hosting the app and its database	Canada (Montréal)
Anthropic (Claude)	Your messages and the app’s notes about your health, such as your age, sports and symptoms. Never your name or email.	Writing the assistant’s replies	United States
ElevenLabs	The text of the assistant’s replies	Turning replies into speech	United States
Google (Workspace email)	Booking requests with their referral summary, sent to our team, and emails sent to you	Sending and receiving email	United States and other countries
Clinics	Your referral summary, contact details and their intake form if you filled it in	The appointment you asked for	Canada

Anthropic keeps what it receives only briefly, for safety and abuse monitoring, and doesn’t use it to train its models. We may also disclose information if the law requires it.

4. Information stored outside Canada

As the table shows, Anthropic, ElevenLabs and Google may process or store some of your information in the United States, and Google possibly in other countries, for the purposes listed. Information held outside Canada is subject to the laws of those countries. If you have questions about how these providers handle your information, contact our privacy contact below.

5. How long we keep it

Your information is kept while your account is open.
When you delete your account (Profile → Delete my account), everything about you is removed from the app straight away. Copies in our backups are gone within 14 days, as the backups roll over.
“Reset my progress” clears your plan, check-ins, conversation and appointments but keeps your account. A record of any referral already sent is kept until you delete your account.
Security records are kept for two years.

6. Your choices and rights

See your information: Profile → Download my data gives you a copy of everything we store about you.
Correct it: edit your profile, or ask us.
Delete it: Profile → Delete my account, at any time.
Withdraw consent: stop using the app and delete your account. We can’t give tailored advice without the information it’s based on.
Stop follow-up emails: use the link in any follow-up email.
Complain: contact us first. If we can’t resolve it, you can contact the Office of the Information and Privacy Commissioner of Alberta.

7. How we protect it

Everything travels over encrypted connections (HTTPS). The database isn’t reachable from the internet, passwords are stored only in scrambled form, and only the app’s administrator can access account records, with every access logged. No system is perfectly secure. If a breach puts you at real risk of significant harm, we’ll notify the Information and Privacy Commissioner of Alberta and, where required, you.

8. Changes to this policy

If we change this policy, we’ll update the date at the top, and tell you in the app about any significant change.

9. Contact

Questions or requests about your privacy: Matthew Legault, Privacy Contact, info@mosiachealth.ca.