Privacy Policy — Constellate Health

Constellate Health (“Constellate,” “we,” “us”) runs a patient-consented platform for people living with autoimmune disease. You connect your medical records, log how you feel between visits, and get one clear picture of your health. This policy explains what information we handle when you use our website or our app, why we handle it, and what choices you have.

Constellate is operated by Constellate Health, Co., a Delaware corporation. This policy is available in the United States only. If you are located outside the U.S., please do not use the service.

1. The short version

We collect what you give us and what your records show, plus basic technical data to keep the app running.
We use AI to read and summarize records and symptoms. No AI vendor trains its models on your data.
We do not sell your personal information. Ever.
We only share your identifiable health data for research or commercial purposes after you sign a separate authorization for that specific use.
You can see your data, correct it, export it, delete it, and pull back your consent at any time.

The rest of this policy is the detail. It is written to be readable. If something is unclear, email privacy@constellate.health.

2. Who this covers

This policy applies to:

Patients and members who create an account and use the app.
Waitlist and website visitors who give us their email or browse constellate.health.
People who contact us for support, press, or general questions.

3. HIPAA posture

For the direct-to-patient service, Constellate is neither a “covered entity” nor a “business associate” under HIPAA. HIPAA covers healthcare providers, health plans, and their business associates. We contract directly with you, not with your doctor, so most of what we hold about you is not HIPAA-regulated Protected Health Information — it is personal health information governed by this policy and by the state and federal privacy laws described in Section 11.

A limited exception: when we retrieve records from your providers and payers on your behalf (see Section 4), the source systems are HIPAA-covered. HIPAA permits those systems to release records to you and to services acting under your written authorization. Once the records arrive at Constellate, they are governed by this policy and by our contracts with the vendors that carry them.

We do not use your identifiable health information for research, publication, or any commercial purpose without a separate written authorization from you that names the specific use, the recipients, and your right to revoke.

This policy is not legal advice. If you have HIPAA questions specific to your provider, contact that provider directly.

4. What we collect

4.1 Account information

When you sign up, we collect your name, email address, date of birth, ZIP code, and a password (stored hashed, never in the clear). If you contact support, we keep the message and our reply.

4.2 Patient-reported information

What you enter in the app: symptoms, flare logs, medications, side effects, questionnaire responses (for example, disease-activity and patient-reported outcome measures), notes to yourself, files you upload, and messages you send us.

4.3 Medical records retrieved on your behalf

When you authorize it, we retrieve your medical records from your providers, hospitals, payers, and health information exchanges through a third-party records aggregator (Fasten Health). The records may include visit notes, diagnoses, medications, allergies, immunizations, lab results, imaging reports, procedure history, and insurance claims. Which records arrive depends on what your providers make available.

4.4 Device and usage data

When you visit our site or use the app we automatically log: IP address, approximate location (city/region derived from IP), device and browser type, operating system, language, referring URL, pages viewed, time on page, and diagnostic events (errors, crashes, load times).

4.5 Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to protect the app from abuse. We do not currently run product analytics, and there is no advertising or tracking technology in Constellate. We do not use third-party advertising cookies, and we do not track you across other companies' sites. If we ever add analytics, we will name the provider here before turning it on.

4.6 Information we do not ask for

We do not collect Social Security numbers, government ID numbers, or payment-card details unless we specifically ask you for one — for example, if we ever introduce paid features. If we do, we say so at the point of collection.

5. How we use it

We use the information above to:

Create and secure your account.
Retrieve, organize, and display your medical records inside the app.
Extract structured facts (diagnoses, labs, medications, dates) from records and notes so the app can show them coherently.
Summarize your history, flag items you may want to raise with your care team, and prepare pre-visit briefs.
Send you service messages (account, security, appointment-related) and, if you opt in, product updates.
Provide support when you contact us.
Detect fraud, abuse, and security events, and enforce our Terms.
Meet legal obligations (for example, responding to a valid subpoena).
Improve the product by studying how it is used, in aggregate.

We do not use your data for advertising. We do not build advertising profiles. We do not share your data with data brokers.

6. AI processing

We use large language models to read documents, extract structured information from records, summarize your history, and answer your questions about your own record.

Model inference runs on Amazon Web Services Bedrock, calling Anthropic's Claude models. These calls happen inside AWS under a Business Associate Agreement.
Your data is not used to train any AI model. Our AWS Bedrock configuration disables model training on customer inputs and outputs, and our contract with AWS prohibits it.
Prompts and completions may be kept briefly for abuse detection by the model provider, then deleted per contract terms. They are not used to improve models.
AI output is a helper, not a diagnosis. See Section 3 of the Terms of Service — Constellate is not a medical device and does not practice medicine.

We share personal information only in these situations:

Service providers (subprocessors). Vendors we hire to run parts of the service — hosting, records retrieval, AI inference, email delivery, analytics, error monitoring. See Section 9.
At your direction. If you ask us to send a summary to your clinician, an employer, a caregiver, or a research study, we do it.
With your separate written authorization. For any use of your identifiable data outside of running the service — for example, contributing to a specific research study or commercial partnership — we ask for a separate, revocable authorization that names the purpose and the recipients.
Legal process and safety. To comply with a valid subpoena, court order, or law; to protect our rights and the safety of our users; or to investigate abuse.
Business transfer. If Constellate is acquired, merges, or sells substantially all its assets, information may transfer to the successor. We will tell you before your data is subject to a materially different policy.

We do not sell your personal information. We do not “share” personal information for cross-context behavioral advertising as those terms are defined in the CCPA.

8. De-identified data and research

One of Constellate's goals is to support research that improves care for people with autoimmune and immune-mediated conditions. Today, we do not share your information with researchers or research partners, identifiable or de-identified. In the future, we may offer you the option to contribute de-identified data (data that cannot reasonably be linked back to you) to research, including research conducted with life sciences and pharmaceutical companies. That would happen only with your separate consent, and never as a condition of using Constellate. Any de-identified data we process is maintained and used only in de-identified form; we do not attempt to re-identify it, and we require the same commitment from anyone who receives it. We will not use or share information that identifies you for research or any other commercial purpose without your separate written authorization, which you can decline or withdraw without losing access to Constellate.

9. Subprocessors

Constellate relies on the following categories of subprocessors:

Cloud infrastructure: Amazon Web Services (US regions).
Database and application hosting: self-hosted Supabase on AWS EC2 (single-tenant to Constellate).
AI inference: Amazon Bedrock (Anthropic Claude models), under BAA.
Medical records retrieval: Fasten Health.
Transactional email: Resend (data protection agreement pending).

A current list of individual vendors, what they process, and where they are located is maintained at constellate.health/subprocessors. We update that page when we add, replace, or remove a subprocessor.

10. Your rights and controls

You can:

See what we have. Request a copy of your data by email.
Correct it. Fix inaccurate information you entered directly in the app; ask us to help with records that came from providers.
Export it. Get a machine-readable copy of your data (CSV / FHIR where available).
Delete it. Close your account and delete your data. We honor deletion within 30 days of the request, subject to legal holds.
Pull back consent. Revoke the authorization that lets us retrieve records on your behalf, or the one that lets your data be used for a specific research purpose. Revocation stops future use — it does not undo data that has already been shared with a partner under a prior authorization, and it does not undo aggregated or de-identified analyses that have already been produced.
Opt out of non-essential email. Use the unsubscribe link at the bottom of any marketing email. You cannot opt out of account and security notices while your account is open.

Email privacy@constellate.health to make a request. We verify identity before acting.

11. State-specific rights

11.1 California (CCPA / CPRA)

If you live in California, you have the right to:

Know the categories and specific pieces of personal information we collect, use, disclose, and (if applicable) sell or share.
Request deletion of your personal information.
Correct inaccurate personal information.
Opt out of sale or sharing for cross-context behavioral advertising. Constellate does not sell or share personal information in this sense.
Limit use of sensitive personal information. Health information is sensitive personal information under California law. We use it only to provide the service and for the other purposes disclosed in this policy — not to infer characteristics for advertising.
Be free from retaliation for exercising these rights.

You may designate an authorized agent to make a request on your behalf. Requests go to privacy@constellate.health.

11.2 Washington — My Health My Data Act

If you live in Washington, or if we collect your consumer health data while you are in Washington, the Washington My Health My Data Act (MHMDA) applies. You have the right to know what consumer health data we collect, request deletion, and withdraw consent to its collection, sharing, or use. We ask for your consent before collecting consumer health data beyond what is strictly necessary to provide the service, and we obtain a separate written authorization before selling or sharing consumer health data (we do not do this). To exercise MHMDA rights, contact privacy@constellate.health.

MHMDA requires a separate notice for consumer health data specifically. Ours is the Consumer Health Data Privacy Policy, and it governs where the two differ. We apply MHMDA's protections to every Constellate user, not only to Washington residents.

11.3 Nevada — SB 370

Nevada residents may request that we not sell their covered personal information. Constellate does not sell personal information as defined by Nevada SB 370. To make a verified request, contact privacy@constellate.health.

11.4 Other U.S. states

Several states — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, New Hampshire, New Jersey, Iowa, Indiana, Montana, and Tennessee — have enacted comprehensive privacy laws that provide access, correction, deletion, and portability rights, plus the right to opt out of targeted advertising, sale, or profiling. Where any of these laws apply to you, we honor those rights on the same basis described above.

11.5 International

Constellate is US-only at launch. Non-US residents are not the intended audience, and we do not currently offer the rights framework required by the EU / UK GDPR, Canadian PIPEDA, or similar laws.

12. Children

Constellate is for adults. You must be 18 or older to use it, and we ask you to confirm this when you sign up. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete the account and the information in it. If we later support minors, this policy will be updated with a parental-consent flow and a separate children's privacy notice before that enrollment opens.

13. Security and breach notification

We take security seriously. Concretely we use:

Encryption in transit (TLS 1.2+) and at rest (AWS KMS-managed encryption on EBS and backups).
Role-based access controls; production access is limited, logged, and requires multi-factor authentication.
Single-tenant hosting of your data on our own AWS account; no shared multi-tenant database.
Audit logging of data access; regular review.
Vendor risk review before adding a subprocessor.

No system is perfectly secure. If we discover a breach of unencrypted personal information that affects you, we will notify you and the appropriate regulators within the timeframes required by applicable law (in most states, without unreasonable delay and no later than 30–60 days after discovery, depending on the state).

We do not claim any specific compliance certifications at this time. When we obtain a certification, we will say so on this page and link the report.

14. Retention

Account information: for the life of your account and 90 days after you close it.
Medical records and patient-reported data: for the life of your account and 90 days after you close it, unless you ask us to delete sooner.
Backups: may retain deleted data for up to 7 days before rolling off.
Server and audit logs: up to 30 days.
De-identified and aggregated data: may be retained indefinitely because it is no longer personal information.

We may retain records longer if required by law, to enforce our Terms, or to defend a legal claim.

15. Changes to this policy

We may update this policy. If we make a material change — for example, a new use of your data or a new category of sharing — we will notify you by email or in the app at least 30 days before it takes effect. The date at the top of the page shows when the current version became effective. Continued use of Constellate after that date means you accept the change. If you do not accept, you can close your account.

16. Contact us

Constellate Health, Co.
Privacy inquiries: privacy@constellate.health
Legal notices: legal@constellate.health