HIPAA & Data Protection
N1 Precision Insights is a personal health-tracking tool. When you use it to log your own data (or data about a family member in your care), you are not a HIPAA-covered entity, and the data you enter about yourself is not regulated by HIPAA. Even so, we voluntarily apply HIPAA-equivalent administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of your health information.
Identifying Fields — Strict Handling
Two fields on your profile are potentially identifying and are handled with explicit rules in the code:
- Date of birth is stored in full for growth-percentile and age-band calculations, but the raw date is never sent outside our server. AI features receive only your age in whole years. Research exports use only your birth year (U.S. HIPAA Safe Harbor).
- Biography / medical history (the free-text field on your profile) is never transmitted to any external service, AI model, export, or delegated user. It stays in our database and is visible only on the biography page you edit — unless you choose to enable a public profile. See the Public Profiles section below for the important caveat.
These rules are enforced at two layers: (1) the code that builds data for external systems never includes these fields, and (2) a server-side sanitizer strips them again before any data is persisted for AI use or sent to a third party, as a second line of defense against future programming errors.
Our technical protections include:
- Encryption of data in transit (TLS) and at rest
- Access controls and authentication for all user data
- Audit logging for data access in clinical contexts
- User-controlled data sharing with explicit consent
- De-identification of data sent to third-party AI services
Our infrastructure runs on Amazon Web Services under a Business Associate Agreement that covers our use of AWS services including AWS Bedrock (the AI service through which we invoke Claude and Nova models). All AI processing happens inside this BAA-covered boundary. Customer inputs and outputs are not used to train any AWS or third-party foundation model.
When a covered entity (clinician, hospital, research institution) accesses patient data through N1 Precision Clinical or Trials, HIPAA requires the patient’s explicit permission before the covered entity can trigger AI processing on their behalf, even though the underlying Bedrock call is BAA-covered. Until the patient (or parent) grants that permission, AI features are disabled for the delegated session. Consumers using Insights to explore their own data may use AI features under their own consent.
Individual consumers using N1 Precision Insights to track their own health data are not subject to HIPAA requirements and may use the service without restriction.