Effective 2026-09-06 · v2026-08-22.1
Thylib Privacy Policy
Version: 2026-08-22.1 Effective: 2026-09-06
Thylib is operated by Perceptive One LLC ("Thylib", "we", "us", "our"), the data controller for the personal information described here. This Policy describes what Thylib collects, how we use it, who we share it with, and the rights you have — including the heightened rights that apply to consumer health data under state law.
1. What we collect
- Account information — the account identifier from each sign-in provider you use, your email, display name, and self-declared country of residence. Where a provider offers to hide your address behind a private relay, the relay address is the one we hold; we never see the real one.
- Health records (consumer health data) — when you connect a patient portal that supports SMART on FHIR (e.g. Epic MyChart), we sync the FHIR resources you authorize: Patient, Condition, Observation (labs, vital signs, social history, and social-determinants-of-health screenings — which can include recorded observations of sexual orientation and gender identity), MedicationRequest, AllergyIntolerance, Immunization, Procedure, DiagnosticReport, DocumentReference, Encounter, CarePlan, and Goal. Portal authorization tokens are stored encrypted at rest using Google Cloud KMS. We never see or store your patient-portal password.
- Audit log — records of when you signed in, which tools you ran, and what records were accessed. Retained as a tamper-evident security record.
- Billing information — handled by Stripe. We store only Stripe-issued customer/subscription identifiers and your subscription-consent records; we never receive or store your card number.
We do not collect advertising identifiers, and we use no third-party analytics, advertising, or tracking services — no tracking pixels, no third-party advertising cookies.
Cookies and browser storage. We use only what the service needs to function: one cookie that keeps you signed in, which your browser will not let scripts read, plus short-lived storage used to complete secure sign-in. We do not set tracking or advertising cookies. The provider-search page loads Google Maps, which may set Google's own cookies — the only third party that does. Because Thylib uses no non-essential cookies of its own, we do not display a cookie-consent banner.
2. How we use it
We use the data above to (a) provide, operate, maintain, and troubleshoot the service, (b) process payments, (c) send transactional email (renewal reminders, billing notices, family invitations, and the consent requests and notices described in §3), (d) detect abuse and secure the service, (e) respond to your support requests, and (f) comply with legal obligations.
We do not sell your personal information. We do not share your health data for advertising. We do not use your health data to train AI models. We do not use your health data for research — biomedical, scientific, commercial, or otherwise — and we do not sell or license it. We do not process your health data for any purpose you have not consented to.
3. Consent for consumer health data
We collect and process your health records only with your consent, given when you connect a provider portal. Each connection is authorized by you, scoped by your provider's patient-access interface, and can be revoked at any time from the connections page (revocation stops future syncs; you can also delete already-synced data as described in §5).
When the family admin connects records for an adult under provider proxy access, those records are visible only to the admin and are excluded from the AI integration (§4a), and from other family members, until that person agrees themselves. That person decides who may see their records, can withdraw their agreement, and can have their records removed from Thylib — at any time. The admin attests their authority for each person (their own records, a minor child, an adult they are the legal representative for, or an adult who granted them proxy access), and we log the attestation.
We do not share your consumer health data with third parties except the subprocessors in §4 (who act on our instructions) and the AI integration in §4a (which only ever runs at your direction). Because Thylib's core feature is querying your records through an AI assistant you choose to connect, using Thylib requires accepting the AI/LLM Disclosure at sign-up. Your health data is shared with an AI provider only when you connect that provider's assistant and only in response to queries you run. We never share your health data with any other third party, and we will never require consent to any sharing beyond what is needed to provide the service you signed up for.
4. Subprocessors
| Subprocessor | Role | Data category |
|---|---|---|
| Google Cloud (BigQuery, GCS, Cloud KMS, Cloud Run) | Hosting, storage, encryption | Health records; encrypted tokens |
| Stripe | Subscription billing | Email, billing identifiers (no card numbers) |
| Resend | Transactional email delivery | Your email address, email contents (no health records) |
| Your healthcare provider (Epic, Oracle Health, etc.) | Source of the FHIR records you elect to import | Health records you authorize |
4a. AI assistant integration (the core of the service)
Thylib's primary use is querying your own records through the third-party AI assistant you connect (Claude, ChatGPT, Gemini, or another MCP client). When you run a query, the records responsive to it are delivered to that AI provider; their privacy and retention policies apply once data leaves us. Records flow only to the provider whose assistant you connected, and only in response to your queries — never in the background. This data flow is described in the AI/LLM Disclosure, presented for your acceptance as its own document at sign-up. You can disconnect an assistant or revoke MCP access at any time. The web dashboard works without a connected assistant, but AI-assisted querying is the core of the service.
5. Retention and deletion
- Health records: retained while your family has an active free trial or subscription. After your trial expires or your subscription lapses, this data is retained for 30 days (so you can subscribe or reactivate without re-importing), then permanently and irreversibly destroyed — we email you before that happens. You may request immediate destruction at any time by deleting the family or your account; destruction completes within fourteen days (records are deleted from our live systems immediately; residual copies in database backups are purged within fourteen days).
- Account information: retained for the lifetime of your account; anonymized on deletion.
- Audit log: retained as an append-only security record; not deleted on account deletion, in order to preserve a tamper-evident history.
- Billing and consent records: subscription, refund, and subscription-consent records are retained for seven years after each transaction (tax, accounting, and consumer-protection law require us to keep proof of charges and of your consent).
6. Your rights
For all users, regardless of state: you can access, export, correct, and delete your data using the self-service controls below, or by emailing privacy@thylib.com.
- Access / export: download a complete export of your data from the account page.
- Delete: delete your account or family from the account page; health-record destruction follows §5.
- Correct: correct your account profile in Settings. (Health records are synced copies — corrections to the underlying chart must be made with your healthcare provider; we will re-sync them.)
- Withdraw consent: disconnect any provider connection, or revoke the AI integration, at any time. If your records were connected to a family by an adult who holds proxy access to them, you decide who may see your records and can withdraw that permission — or have your records removed from Thylib — using the links in the email we send you, or by contacting privacy@thylib.com.
California residents have these rights under the CCPA/CPRA and CMIA, including the right to know, delete, correct, and to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of. In addition, under the Confidentiality of Medical Information Act (Civ. Code §56.06), a business offering consumers software to manage their medical information is deemed a "provider of health care" for confidentiality purposes: Thylib maintains your medical information under those CMIA duties and does not disclose it except as this Policy describes and California law permits.
Washington residents (and residents of other states with consumer health data laws, including Nevada): you have the right to confirm whether we collect, share, or sell consumer health data, to withdraw consent, and to have your consumer health data deleted. Washington's My Health My Data Act also requires a standalone policy: see our Consumer Health Data Privacy Policy, linked from our homepage. We do not sell consumer health data and will not do so without the separate, signed authorization those laws require. To exercise these rights, use the self-service controls above or email privacy@thylib.com; if we decline a request, you may appeal by replying to our decision, and we will respond to your appeal as those laws require.
We will not discriminate against you for exercising any privacy right.
7. Security and breach notification
We protect your data using industry-standard safeguards, including encryption in transit and at rest, protected storage for the credentials that connect to your providers, access controls granted on a least-privilege basis, and logging of access to health records. We currently host your data with a major cloud provider in the United States.
As a vendor of personal health records, we are subject to the FTC Health Breach Notification Rule. If a breach of security results in unauthorized acquisition of your unsecured identifiable health data, we will notify you and the FTC (and, where required, state regulators) within the timelines those rules require.
8. Children
Thylib is not directed to children under 13, and we do not knowingly accept sign-ups from anyone under 18. A parent or legal guardian may connect and manage a minor's health records within their family, subject to their legal authority to do so and to their provider's own proxy-access rules. Where a connected medical record includes a date of birth, we use it to determine whether a person whose records are managed in a family is a minor or an adult — so that an adult's records are not shared with other family members or queried through an AI assistant without that adult's own consent, and so that a change in age (for example, a minor reaching adulthood) is reflected automatically on the next sync.
9. Changes to this Policy
Material changes are presented for your re-acceptance on next sign-in. Non-material changes are announced by email; the version string above identifies the document you accepted.