Privacy Policy

This policy explains how Harvest Sterling LLC (doing business as LifeFrom) (“LifeFrom,” “we,” “us”) collects, uses, protects and shares personal information through our websites, apps and services (the “Services”). We are the controller of the personal information you provide to use LifeFrom.

Harvest Sterling LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. Privacy contact: privacy@lifefrom.ai.

LifeFrom is a technology company, not a healthcare provider, health plan or clearinghouse, so we are generally nota “covered entity” under HIPAA. HIPAA typically governs the doctors, labs and hospitals that create your records, not a tool you use to organise them yourself.

That doesn't lower our bar. Your health information is among the most sensitive data we handle, and we protect it accordingly. U.S. state consumer health data laws do apply to us; see our Consumer Health Data Privacy Policy.

Information you give us:

• account details: name, email, and household members you add;
• health information you upload or enter: lab result PDFs, imaging and scan files (through the website), DNA files, gut and microbiome tests, ECG files, symptoms, medicines and supplements, meals, workouts, documents, and what we derive from them (such as extracted markers and scores);
• photos you take or pick (using the camera), videos you film, and voice notes you record (using the microphone);
• your messages to LifeFrom AI and to support;
• if you buy a supplement pack: your name, email, phone number, delivery and billing address, the supplements in your pack, your order, subscription and delivery history, and your agreement to the renewal terms. Stripe collects your card details; we never see your full card number.

From Apple Health, only with your permission: the categories you allow, such as heart rate, heart rate variability, resting heart rate, VO2 max, steps, active energy, workouts, sleep, weight and body composition, blood pressure, blood glucose, breathing rate, blood oxygen, temperature, cycle tracking, mindful minutes and time in daylight, plus your date of birth and sex. LifeFrom only reads Apple Health; it never writes to it.

Some Apple Health data is read only on your phone and not sent to us: workout routes, hearing, noise, walking and vision data. Apple Watch ECG waveforms are analysed on your phone. If you ask LifeFrom AI about an ECG, a summary of it (heart rate, rhythm regularity and heart rate variability) is sent to answer you. ECGs from Withings devices you connect are stored in your account.

From devices you connect: readings from the LifeFrom band (over Bluetooth), from Withings, and from other devices you link.

Voice: when you dictate in the app, Apple speech recognition turns your voice into text. It runs on your phone where it can; when on-device recognition is unavailable, Apple may process the audio on its servers. When you dictate on our website, the audio is sent to Deepgram for transcription.

Location: your approximate location (rounded to about a kilometre) is sent directly from your phone to Open-Meteo, a weather service, to get weather and air quality; it doesn't pass through our servers. Your city name can be included when LifeFrom AI answers you. Workout routes stay on your phone.

Collected automatically:on our website, device and browser details, IP address and the pages you view; Google Analytics only if you accept it. In the iOS app, which screens and features you use (screen and action names, with your account id), never your health data. You can turn app analytics off in Settings. The app contains no advertising and doesn't track you across other companies' apps or websites.

You may add family members, including children, only if you are their parent, guardian or authorised representative. You provide their information on their behalf and can delete it at any time. We don't let children use LifeFrom themselves: the Services are for adults 18 and older. If we learn that a child has created an account, we'll delete it. Contact privacy@lifefrom.ai.

Data from Apple Health is used only to give you LifeFrom's health and fitness features. It is never used for advertising, marketing or data mining, never sold, never shared with data brokers, never included in research or licensed to anyone, and never stored in iCloud by us. It is sent to the AI providers below only after you agree, and only to answer you.

You choose which categories LifeFrom can read, and you can change that in the Health app. LifeFrom does not write to Apple Health.

We use your information to:

• provide the Services: read your documents, explain results, answer your questions, log your day;
• take payment for, make, ship and support the supplement packs you buy, manage your subscription and send order, delivery and billing emails;
• if you ask, suggest a supplement protocol from your health record (see “Supplement suggestions and orders” below);
• maintain your account, send you service emails and notifications, and provide support;
• understand which features are used so we can improve them (product analytics, which you can turn off);
• secure the Services and prevent fraud and abuse;
• comply with law, keep tax and payment records, and enforce our terms.

We don't use your information for advertising, and we don't make solely automated decisions about you that have legal or similarly significant effects.

If you are in the EU, the EEA or the UK, we rely on these legal bases under the GDPR and UK GDPR:

• Contract: to create and run your account, provide the Services you ask for, and take payment for and deliver the products you buy;
• Explicit consent (Article 9(2)(a)): for health data, Apple Health data, your uploads and AI processing, which you give through the consents in the app and can withdraw at any time in Settings;
• Legitimate interests: for security, fraud prevention and product analytics, which you can opt out of in Settings;
• Legal obligation: for tax and payment records and responding to lawful requests.

Withdrawing consent doesn't affect processing that happened before you withdrew it.

AI is optional. LifeFrom works without it. If you turn LifeFrom AI off in Settings, all AI processing stops and nothing more is sent to AI providers.

When it is on, and only after you agree in the app, the relevant data is sent through OpenRouter to OpenAI models (which may be served through Microsoft Azure) and Google Gemini models, and documents may be read by Mistral's text recognition. That can include health data from Apple Health and your uploads, your messages and voice-note transcripts, photos, videos that aren't workouts, and lab reports and documents. When we draw an illustration of a meal, the image model receives only the dish name.

Your portrait. If you choose to make a portrait, the two photos you take (your face from the front and from the side) are sent, with our own style reference images, to Kie, which runs OpenAI's GPT Image model, to draw the portrait shown on your home screen and your membership card. This happens only after you agree on the portrait screen, and never for anything else: not to train models, not for advertising. Your photos and the portrait are kept with your account until you remove the portrait or delete your account.

Our requests are set not to train on your data, and to use zero-retention endpoints where available; some providers may keep a request for up to 30 days for abuse monitoring. We do not use your identifiable health data to train AI models.

When LifeFrom looks up research, it sends search terms only, never your personal data, to PubMed, Europe PMC, Semantic Scholar and ChEMBL.

Some things never leave your phone: your raw DNA file (only the answers to the questions you ask are looked up), and workout videos, which are read on the phone itself.

AI can be wrong. LifeFrom is not a medical service; see our Medical Disclaimer and AI Use and Limitations.

If you add a raw DNA file, it is read and indexed on your phone and stays there; we keep only a record that you added it. When you ask about your DNA, the few variants that answer your question are sent to LifeFrom AI. We don't read health-risk or drug-response genes, and we never share genetic data with anyone else.

Suggestions. In the app, LifeFrom can suggest a supplement protocol based on your health record (for example your blood tests and wearable readings). This happens only with the health-data consent you gave in the app, and with AI on, through the AI providers described above. The suggestion is made by LifeFrom for you. It is not shared with our payment processor or our manufacturer, and you decide whether to buy anything.

Orders. When you buy a pack, we send OK Capsule (our contract manufacturer in the United States) your name, email, phone number, delivery address and the products and quantities in your pack, so it can make, label and ship your pouches and send tracking. We send Stripe your payment, billing and delivery details to take payment, calculate sales tax and run your subscription. Neither of them receives your health records, test results, AI conversations or the reasons behind a suggestion.

The list of supplements you buy can say something about your health, so we protect it like other health data and treat it as consumer health data under the Consumer Health Data Privacy Policy.

Only as needed to run the Services. Our service providers and what each receives:

• Supabase (on Amazon Web Services, us-east-1, United States): our database, file storage, sign-in and server functions. It stores your account, health record, uploads and conversations.
• Vercel: hosts our website and web app. It receives your IP address and request details, and the data you send or view through the web app as it passes through.
• OpenRouter, OpenAI (possibly via Microsoft Azure), Google and Mistral: AI processing, as described above, only when AI is on and you have agreed.
• Kie(running OpenAI's GPT Image model): your two portrait photos, only if you make a portrait and agree, to draw it.
• Deepgram: the audio when you dictate on our website, to turn it into text.
• Apple: delivers push notifications (your device token and the notification text) and provides speech recognition when it can't run on your phone. If you buy through the App Store, Apple handles the payment.
• Open-Meteo: your approximate location, sent from your phone, to return weather and air quality. No account details are sent.
• Withings, if you connect it: we hold the access tokens and receive your readings to show them in LifeFrom.
• Resend: your email address and the content of the emails we send you, such as sign-in codes, account messages and order updates.
• Stripe: if you pay on our website, your name, email, phone number, billing and delivery address and payment details, to take the payment, calculate sales tax and manage your subscription. We don't see your full card number.
• OK Capsule (United States), if you buy a supplement pack: your name, email, phone number, delivery address and the products and quantities in your pack, to make and ship it. Never your health records.
• PostHog (EU): product analytics. In the app, screen and action names with your account id, never your health data, notes, photos or messages. On the website, cookieless page views.
• Google Analytics: on our website only, and only if you accept it. It receives page views, device and browser details and an online identifier.
• Public reference databases (such as the U.S. National Library of Medicine, the FDA, PubMed, Europe PMC, Semantic Scholar and ChEMBL): names of medicines and supplements or search terms only; nothing about you is sent.
• Legal reasons: to comply with law or protect rights and safety.
• Business transfers: as part of a merger or acquisition, subject to this policy.

Each provider is bound by contract to protect your data and to use it only to provide its service to us.

We do not sell your personal information. If you join a research study, we license only de-identified data for that study with your separate consent (see the Research Program Terms). We keep de-identified data de-identified and do not try to re-identify it. Data from Apple Health is never included. The research program is not open yet.

In the app's Settings you can, at any time:

• turn LifeFrom AI off, so all AI processing stops;
• turn product analytics off;
• withdraw your health-data consent, which stops LifeFrom reading Apple Health and signs you out;
• delete your account and all of its data (Settings, Delete account and data).

You can also change which Apple Health categories LifeFrom reads in the Health app, and accept or reject Google Analytics on our website.

Depending on where you live (including the EU, the UK, California and other U.S. states with privacy laws), you have the right to:

• access your personal information and know how we use and disclose it;
• correct (rectify) inaccurate data;
• delete (erase) your data;
• restrict how we process it;
• get a copy of your data in a portable format;
• object to processing based on legitimate interests, including product analytics;
• withdraw consent at any time;
• complain to a data protection authority: the AEPD in Spain, the ICO in the UK, or the authority where you live or work;
• not be discriminated against for exercising these rights.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Delete your account in the app: Settings, Delete account and data. Your record is deleted straight away, and from our backups within 30 days. We keep billing and supplement order records where the law requires.

Get a copy of your data: there is no in-app export yet, so email privacy@lifefrom.aifrom your account address and we'll send it. For any other request, email the same address. We'll verify the request and respond within the time the law requires (one month under the GDPR, generally 45 days under U.S. state laws).

This section is our notice at collection under the California Consumer Privacy Act (as amended by the CPRA) and covers similar laws in other states, including Colorado, Virginia and Connecticut.

Categories we collect: identifiers (name, email, account id, IP address, device token); customer records (including delivery address and phone number); characteristics such as age and sex; commercial information (supplement packs and subscriptions you buy); internet activity (pages and features used); approximate geolocation (city level); audio and visual information (photos, videos, voice notes); inferences (scores and summaries); and sensitive personal information (health data, genetic data, account log-in, and supplement purchases where they reveal health information).

Sources: you; Apple Health, the LifeFrom band, Withings and other devices you connect; and your use of the Services.

Purposes:the purposes in “How we use your information” above. We disclose each category only to the service providers listed in “Who we share information with,” for those purposes.

Sale and sharing:we don't sell personal information and haven't in the past 12 months. Google Analytics on our website may count as “sharing” for cross-context behavioural advertising under California law, so it loads only if you accept it. We honour Global Privacy Control signals as an opt-out of sale or sharing. We don't knowingly sell or share the data of anyone under 16.

Sensitive personal information: we use it only for permitted purposes, such as providing the Services you request, security and legal compliance, and not to infer characteristics about you.

Retention:we keep each category for the periods in “How long we keep data” below.

Your rights: to know and access, delete, correct, and opt out of sale or sharing, and not to be discriminated against for using them. Email privacy@lifefrom.ai. You can use an authorised agent; we'll ask for proof of the agent's authority and may ask you to verify your identity directly.

Appeals (Colorado, Virginia, Connecticut and other states that provide them): if we decline your request, you can appeal by emailing privacy@lifefrom.aiwith “Appeal” in the subject. We'll answer within the time your state's law requires (generally 45 or 60 days). If we deny the appeal, you can contact your state Attorney General.

Financial incentives: research studies, when they open, pay participants. Each study will give you a notice of financial incentive, including how its value was set, before you agree.

For Washington, Nevada, Connecticut and other states with consumer health data laws, see our Consumer Health Data Privacy Policy.

Withdrawing your health-data consent stops new processing; your existing record stays until you delete it, so you can come back.

We use safeguards suited to the sensitivity of your data, including encryption in transit and at rest, access rules so each account can only reach its own data, and monitoring. No system is perfectly secure, so we can't guarantee absolute security.

If a breach of security affects your health information, we will notify you, and the FTC where required, under the Health Breach Notification Rule. We will also notify you and the authorities as other laws require.

• Database and files: Supabase on Amazon Web Services, United States (us-east-1).
• App and website product analytics: PostHog, European Union.
• AI processing: United States.
• Payments (Stripe) and supplement manufacturing and shipping (OK Capsule): United States.

If you are in the EU, the EEA or the UK, your data is transferred to the United States. We protect those transfers with the EU Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, and rely on the EU-US Data Privacy Framework where the recipient is certified. Email privacy@lifefrom.ai for a copy of the relevant safeguards.

[EU representative under GDPR Art. 27: to be appointed]

[UK representative: to be appointed]

Until they are appointed, contact us directly at privacy@lifefrom.ai.

On our website we use strictly necessary cookies to keep you signed in. PostHog counts page views without cookies (nothing is stored on your device). We load Google Analytics, which uses cookies, only if you accept it in the banner; if you reject it, or your browser sends a Global Privacy Control signal, it doesn't load. To change your choice, clear this site's data in your browser and you'll be asked again.

We honour Global Privacy Control signals as an opt-out of sale or sharing.

In the app, PostHog records which screens and features are used, tied to your account id and never to your health data; you can turn it off in Settings. The app contains no advertising and does not track you across other companies’ apps or websites.

We may update this policy as the product and the law change. We'll update the date above and, for material changes, tell you by email or in the app before they apply.

Privacy questions or requests: privacy@lifefrom.ai. Harvest Sterling LLC (doing business as LifeFrom), Attn: Privacy, 30 N Gould St, STE R, Sheridan, WY 82801, USA.