Datensicherheit

1. Data is encrypted, not just hidden

Your health profile (blood tests, genetics, microbiome, glucose, body composition, doctor reports) is stored encrypted with AES-256-GCM. The database holds an encrypted block, not readable text.

The encryption key is not in the code or the repository. It lives as an environment variable on the server.

The health profile and stored files are encrypted. A database backup on its own, without the relevant keys, is not meant to expose the content of those fields. Some operational metadata, for example technical identifiers, timestamps or audit records, may be stored separately to the extent necessary for operations and security and may remain readable. We regularly verify the exact scope of protection through restore testing and key management review.

GCM also verifies integrity: if someone tampered with the encrypted data, decryption fails instead of returning forged content.

2. Passwordless sign-in

We do not store passwords because we do not have any. You sign in with a one-time link sent to your e-mail, valid for 15 minutes. A password that does not exist cannot be stolen, and you cannot reuse it anywhere else.

You can optionally enable two-factor authentication (TOTP) in an app such as Google Authenticator, 1Password or Authy. Signing in then also requires a six-digit code from your phone.

The session cookie is httpOnly (JavaScript in the browser cannot read it), Secure (HTTPS only), SameSite=Lax (limits abuse from other sites) and lasts 7 days.

3. Account separation

Authorisation is designed to separate accounts, and it is tested. Every data request is bound to your signed-in session. Data is not served based on what the browser asks for, but based on who is authenticated on the server.

User separation is also guarded by an automated test verifying that no value belonging to one user appears in another user's response. The test is part of the local test suite.

4. Where data goes

To read a PDF report and produce a summary, we send the content of the uploaded document and the relevant health data to the Claude language model via the commercial API of Anthropic. Without it the application could neither extract values from a report nor write a summary.

In this relationship Anthropic acts as a processor. Under the commercial API terms, inputs are not used to train models.

A full list of recipient categories (hosting, the SMTP provider for sign-in e-mails, the Garmin and Oura integrations, sharing with other users) is in the Privacy Policy. We have no advertising, we do not sell data, not even anonymised, and the application contains no third-party analytics or marketing scripts.

5. Where it runs

The application and the database run on servers in Germany (Falkenstein data centre, Hetzner), i.e. within the European Union. The AI processing described above may take place outside the European Economic Area, see the Privacy Policy. We keep backups encrypted at the storage level and rotate them.

It is our own dedicated virtual private server with full root access, not shared hosting. Access to it is limited to authorised persons and processors as needed.

We operate the application over HTTPS and the server is configured so that traffic between your browser and the application is encrypted. We regularly check this configuration, including the redirection of unencrypted requests.

6. What you can enforce

Export: download your health profile as machine-readable JSON at any time. Originals of uploaded files can be downloaded individually in the application.

Partial deletion: every data section (blood, genetics, microbiome, glucose, body composition) can be deleted separately. AI summaries can be deleted as a whole.

Account deletion: removes your profile together with your data. This is not hidden behind an e-mail request, it is a button in settings.

7. Access log

We record selected security-relevant events, including successful sign-ins, selected account changes, account deletion, birth-date setting and administrative operations. We are continuing to expand the exact scope of the log. A record may contain time, actor and target IDs, IP address and browser identification. We do not record the contents of health documents in the audit log.

It exists so we can say retrospectively who did what, and it is personal data in itself. It is handled under the Privacy Policy.

8. What we do not claim

The service is in closed testing. The operator holds no ISO 27001 certification and the service has not yet undergone an external security audit. Any certification obtained or audit completed will be stated in this document. JOuHealth is designed and provided as an informational and educational tool, not for the diagnosis, treatment or prevention of disease.

No system is one hundred percent secure. We describe what we specifically do so you can judge it yourself, instead of promising absolute safety.