HIPAA & Data Protection
N1 Precision Insights is a personal health-tracking tool. When you use it to log your own data (or data about a family member in your care), you are not a HIPAA-covered entity, and the data you enter about yourself is not regulated by HIPAA. Even so, we voluntarily apply HIPAA-equivalent administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of your health information.
Identifying Fields — Strict Handling
Two fields on your profile are potentially identifying and are handled with explicit rules in the code:
- Date of birth is stored in full for growth-percentile and age-band calculations, but the raw date is never sent outside our server. AI features receive only your age in whole years. Research exports use only your birth year (U.S. HIPAA Safe Harbor).
- Biography / medical history (the free-text field on your profile) is never transmitted to any external service, AI model, export, or delegated user. It stays in our database and is visible only on the biography page you edit — unless you choose to enable a public profile. See the Public Profiles section below for the important caveat.
These rules are enforced at two layers: (1) the code that builds data for external systems never includes these fields, and (2) a server-side sanitizer strips them again before any data is persisted for AI use or sent to a third party, as a second line of defense against future programming errors.
Our technical protections include:
- Encryption of data in transit (TLS) and at rest
- Access controls and authentication for all user data
- Audit logging for data access in clinical contexts
- User-controlled data sharing with explicit consent
- De-identification of data sent to third-party AI services
We are in the process of establishing Business Associate Agreements (BAAs) with our infrastructure providers in preparation for future clinical and research use cases. Until this process is complete, healthcare providers and health plans (covered entities) should consult with their own compliance teams before using any N1 Precision product in a regulated context.
Anthropic does not provide a Business Associate Agreement for the Claude API. For that reason, any AI feature that would cause patient data to flow to Claude on behalf of a clinician or covered entity is gated behind explicit patient consent and is currently disabled while our Clinical workflow is off the roadmap. Consumers using Insights to explore their own data may use AI features under their own consent.
Individual consumers using N1 Precision Insights to track their own health data are not subject to HIPAA requirements and may use the service without restriction.