Health Data Privacy Notice
This page is about one feature only: the health vault. It is separate from the general privacy policy on purpose — health information gets its own notice here, not a paragraph inside a longer one.
The short version. The health vault is off by default and turns on only when you tap one explicit button inside the app, after reading what it does. It stores what you type, lets you search it, and — only when you ask — uses it to write a list of questions for your next appointment. It never tells you what a result means, whether it is normal, or whether to worry. That line is enforced by code that checks every generated answer before you see it, not only by an instruction to a model.
This is opt-in, on purpose
Setting up the vault is a deliberate screen, not a checkbox buried in sign-up. Nothing about your health is stored until you tap "Set up my health vault", and nothing about using the rest of Handled requires you to.
What you can store
Typed text, in your own words, organized into one of five categories: lab results, visit summaries, condition notes, medication lists, or general notes. There is no file or photo upload yet — if a later version adds one, this page will say so before it ships.
What it does with it
- Stores and organizes it, searchable by keyword, for as long as your account exists.
- "Prepare questions for my next appointment" sends your vault records — except anything you have marked stays on this device — to Anthropic's Claude, which writes a list of questions to bring to your doctor and explains any general medical terms your records contain. This is the only thing in the vault that calls a model, and it only runs when you tap the button.
- Every generated answer is checked by code before you see it
(
guard.ts, if you want to read it yourself — Handled's source is not a black box). The check looks for language that characterizes your specific result ("your level is high," "that's concerning"), diagnoses anything, or tells you what to do about it. If a generated answer fails that check, it is rewritten once and checked again; if it still fails, nothing is shown, and you are told plainly that nothing could be prepared safely from what was written — not shown a weaker version of it.
What it will never do
No interpretation of your specific values. Not "that's normal," not "that's high," not "that could mean X," not "you should be concerned," not "you should take, stop, increase, or decrease anything." Handled has no license to practice medicine and does not claim one. It organizes what you already have and helps you ask sharper questions — the judgment stays with your doctor.
This is also what keeps the feature a question-preparation tool rather than a medical device, and why Anthropic's own usage terms — which treat automated medical guidance to consumers as a high-risk use needing professional review — do not apply to what this feature actually does.
Who sees it
Anthropic receives the vault records you have not marked local-only, only at the moment you tap "Prepare questions," as part of that one request. Nobody else. Vault records are never sent to an analytics provider, an advertiser, or any other third party — the same wall described in the general privacy policy for the rest of your household's information applies here without exception. There is no narrower and no wider version of that promise for health data specifically; it is the same wall.
Your controls
- Stays on this device — mark any single record so it is excluded from every request to a model, while remaining fully usable and searchable inside the app.
- Delete one record — asks you to confirm first, naming what will be deleted, the same posture the app already applies to a safety fact like an allergy.
- Delete everything — the Privacy screen's "Forget everything" and "Delete my account" controls both include every vault record; neither leaves health data behind as a special case.
- Export — a full copy of your vault is included in the data export described in the general privacy policy.
How long it is kept
For as long as your account exists, or until you delete a record, the whole vault, or your account. The same backup caveat in the general privacy policy applies: a deleted record leaves the live service immediately but may remain in an encrypted backup until that backup ages out on its normal schedule.
If something goes wrong
Handled has a written internal procedure for responding to a breach involving health information, covering notice to affected users without unreasonable delay. It is an operational draft, not reviewed by counsel, and is being strengthened before this feature reaches more than a private group of users.
Where this sits legally
Handled is not a HIPAA-covered entity and intends to stay that way — there is no insurance relationship, no provider integration, and uploads are user-initiated only. Washington's My Health My Data Act and the FTC's Health Breach Notification Rule still apply to a consumer app like this one regardless, and both are a real source of risk that a feature like this one carries. Being straight about the state of this: the scoped legal review this feature was designed to have — covering WA MHMD compliance design and FDA product-copy review — has not happened yet. This page, and the code it describes, are what stand in for that review for now.