.svg){kind=logo}
Last Updated October 2026
myStoria is committed to protecting your privacy and securing your personal information. This Privacy Policy describes how myStoria Inc. (“myStoria,” “we,” “our”) collects, uses, discloses, and protects your information when you use our Services through the myStoria Platform. This Privacy Policy is part of our Terms of Service.
This Privacy Policy applies to your use of myStoria across all platforms, including our website and our mobile applications available on the Apple App Store and Google Play Store.
Your health story is yours. Here’s what that means in practice:
The rest of this policy has the details.
You can try myStoria before you create an account. We call this a guest preview. Here’s how it works.
Before we read anything. You must be 18 or older. We tell you what we’ll read and why, and we don’t read anything until you tap “I agree.”
What we collect. Only what you choose to share in the preview: the goal you pick, health data you sync from your phone (read-only, up to the last 12 months), documents and photos you upload, and what you type or say. This is health information. We don’t ask for your name or email. We give your preview a random ID so we can keep it together and delete it on time.
How we use it. Only to show you your preview, and to move it into your account if you create one. We don’t use guest data to improve myStoria, train AI models or for advertising, and we don’t sell it.
Who it goes to. Only the service providers that run the preview for us: our database, file storage and AI providers (see Service Providers). Nothing you share in the preview goes to analytics or to advertising platforms. We may still count app installs and opens as described under Advertising Partners.
How long we keep it. If you don’t create an account, everything you shared is removed from our production systems 4 hours after you share it. If it was captured in our nightly backup, that copy is purged within 30 days. Deleted guest data isn’t restorable or accessible except as required by law. Our AI provider keeps nothing after it responds.
If you create an account. If you create an account before your preview is deleted, we move your data into your account. From then on, the rest of this policy applies.
Your choices. You can stop anytime by closing the preview. We don’t know who you are, so we can’t find your guest data if you contact us later.
Your consent record. We keep a record that you agreed: the date and time, the version of this policy and your preview’s random ID. It contains no health information. We keep it for several years to show we asked.
If something goes wrong. We don’t have contact details for guests. If a security incident ever affected guest data, we’d post a notice on our website and in the app.
Everything else in this policy, including how we protect your data, applies to guest data too.
Your Account Information
When you create an account, we collect your identification and contact information, such as first name, last name, telephone number, mailing address, and email address, as well as payment information processed through Apple App Store, Google Play Store, or our payment partners. We use this information to provide Services to you, communicate with you, and process payments.
Your Health Information
We collect personal health information, including reproductive health information, medical diagnoses, lab testing results, symptoms, medication history, appointments, and other information you choose to upload or enter into the myStoria Platform. This includes information you share through our AI-powered chat interface, voice notes, and documents you upload. Additionally, should you authorize us, we assist you in obtaining your relevant medical records from your care providers.
Third-Party Information
The myStoria Platform may be used to capture information about individuals who form part of your health journey, such as your partner, surrogates, donors, or children. By inputting information about other individuals, you represent and warrant that you have their consent or legal authority to do so. If you add information about minors, you represent that you are their parent or legal guardian. You are solely responsible for any third-party information you add to your account. If you are not a myStoria user but believe your information has been added to another user's account without your consent, contact concierge@mystoria.com
Usage and Device Information
We collect information about how you use the myStoria Platform, including usage events, device information, and session data, to improve our Services and ensure platform performance. This data is collected through our analytics provider and is described further in the Cookies and Tracking section below.
Artificial intelligence is an integral part of the myStoria experience. We use AI to power our chat interface, analyze your uploaded health records, generate personalized insights and summaries, and support our Concierge Team. For more detail, including the risks and how we manage them, see our AI Transparency Notice at www.mystoria.com/legal .
AI Providers.
Our user-facing AI features are powered by Google (Gemini). When you interact with AI features, your relevant data is sent to Google via secure API connections for processing. Google is bound by a data processing agreement that prohibits them from using your data for their own purposes, including training its AI models. Google keeps prompts and responses for up to 55 days, only to detect and prevent misuse of its service, and they may be stored temporarily in any country where Google or its agents have facilities.
What AI Processes.
AI may process your uploaded health records, text and voice chat messages, profile data, and other information you provide through the platform. AI processing is used to generate conversational responses, health record summaries, personalized insights, and other features described in our Terms of Service.
How Your Data Is Used by AI.
Your personal health data is stored securely in your own account. It is not shared with other myStoria users. When you use AI features, we combine our curated health knowledge base with your individual information to generate personalized responses. The providers that power these features are bound by data processing agreements and are contractually prohibited from using your data for their own purposes. Our analytics provider, PostHog, receives information about how you use AI features, such as which features you use and how quickly they respond. It receives the content of your AI conversations and other AI features only if you opt in to help improve myStoria. Automated tools use it to find general patterns, such as common topics and how accurate answers are. Our team doesn’t read your conversations to do this (see Service Improvement below).
Automated Decision-Making.
AI-generated content is informational and organizational in nature. myStoria does not use AI to make automated decisions that produce legal effects or similarly significant effects on you. AI insights are intended to support your understanding of your health information, not to replace professional medical judgment.
Right to Human Review.
You have the right to request human review of any AI-generated analysis, insight, or recommendation. To request human review, contact our Concierge Team through the app or email concierge@mystoria.com.
All information collected within the myStoria Platform is considered your “Client Data.” We use your Client Data for the following purposes:
We minimize the sharing of your information and share it only as described in this section. We do not sell your personal information. We do not share your health data for advertising purposes.
Advertising Partners
To measure and improve our ads, we tell advertising platforms such as Google, Meta and TikTok when someone installs or opens the app, creates an account, finishes setup, or starts a subscription. These reports can include your phone’s ad ID, a random number that Apple or Google gives your phone for advertising. It doesn’t include your name or email, and you can turn it off: on iPhone, decline tracking when the app asks (or go to Settings > Privacy & Security > Tracking); on Android, delete your ad ID in your device settings. We never send advertising platforms your health information, including anything in your record or anything you ask our AI or Concierge team. Each platform uses this information under its own privacy policy.
Service Providers
None of our service providers are permitted to use your data for their own purposes, including training AI models. The exception is payments: Apple’s App Store, Google Play and Stripe also use payment information under their own privacy policies, for example to prevent fraud. Your health information goes only to the providers that need it to run myStoria, and to PostHog only if you opt in to help improve myStoria.
Other Disclosures
We may disclose personal information to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and individual safety. We may disclose your personal information as permitted by law in connection with a merger, acquisition, or sale of our business. Your health information will never be sold as a separate asset, including in bankruptcy or insolvency, and may only be transferred to a successor that agrees in writing to be bound by this Privacy Policy.
Legal requests
Health information has been sought through legal process in some places. We apply this standard to every request for member information:
Concierge Team & Your Privacy
Your Concierge Team member supports you on your health journey. They’re trained to handle health information and bound by strict confidentiality obligations. They open your myStoria profile only when you ask for their help, such as when you send a request, book a live consult or ask us to get your medical records, or to provide a Concierge service you’ve signed up for. They look at your AI chat history only when you share it or ask for help with it. The only exceptions are when someone’s safety is at risk or we need to investigate fraud or illegal activity.
Health-related Concierge communications take place within the myStoria Platform. We may occasionally use email for technical support and troubleshooting, but will not transmit your health information via unencrypted email. Concierge messages and recap notes are visible in your account. Video consults take place on Google Meet. With your permission, Google’s AI (Gemini) takes notes during the call. Your Concierge Team member reviews and edits them, adds them to your account, and then deletes the original notes. Calls aren’t recorded. If you’d rather we didn’t use AI notes, just tell us and your Concierge Team member will take notes by hand.
Where Your Data Is Stored.
Your data is currently stored on secure servers in Canada and the United States. We will notify you of any material changes to where your data is stored. If you are located in Canada, you acknowledge that your information is transferred to and stored in the United States, which has different privacy laws than Canadian jurisdictions.
How We Protect Your Data.
myStoria uses industry-standard technical and organizational security measures to protect your information, including encryption at rest and in transit, multi-factor authentication for administrative access and role-based access controls. Data collected via the mobile app is subject to the same encryption, retention, and access controls as data submitted through our website.
International & Cross-Border Transfers
Your data is stored and may be accessed from the United States and Canada. If you are located in Canada, including Quebec, your information is subject to the laws of the United States, which may differ from Canadian privacy laws. By using myStoria, you consent to the transfer of your information to the United States for the purposes described in this Privacy Policy. We take reasonable steps to ensure your information is protected in accordance with applicable Canadian privacy legislation, regardless of where it is stored.
Active Accounts. We retain your information for as long as your account is active and as necessary to provide you with our Services.
Account Deletion. You may delete your account and all associated data in the app’s account settings, by contacting our Concierge Team at concierge@mystoria.com, or at https://www.mystoria.com/data-deletion-requests. If you delete in the app, your access ends right away. Your data is removed from our production systems within 30 days of your request, and backup copies are purged 7 days after that. Deleted data will not be restored or accessed except as required by law. We also delete it from our service providers’ systems within the same timeframes, except that our AI provider keeps prompts and responses for up to 55 days to check for misuse, and Apple, Google and Stripe keep payment records under their own policies.
Deletion Records. We retain a minimal audit log for 12 months to verify we honored your deletion request. It’s hashed, so it doesn’t show your name, contact details or health information. It’s then automatically deleted.
Service Improvement. If you opt in to help improve myStoria, we may use your data to evaluate and improve service quality: automated tools check the accuracy of AI-generated insights against the underlying health records, and we use what they find to improve our health knowledge base and the overall myStoria experience. Our team doesn’t read your conversations to do this. An engineer may look at a specific one only to fix an error or follow up on feedback you’ve sent. If you don’t opt in, we don’t use your health information for this. You can change your choice anytime by contacting privacy@mystoria.com.
myStoria is intended for users 18 years or older. We do not knowingly collect personal information directly from individuals under 18.
We recognize that parents and legal guardians may add health information about their minor children to their myStoria account as part of their family’s health journey. When you add information about a minor, you represent that you are their parent or legal guardian and have the legal authority to manage their health information. This information is treated with the same security protections as all other health data on the platform.
Subject to applicable law, you have the following rights regarding your information:
Withdraw consent
You can turn off Improve myStoria by contacting privacy@mystoria.com, and stop marketing emails with the unsubscribe link in any of them. Because myStoria can’t work without processing your health information, withdrawing that consent means deleting your account. We will acknowledge your request within 10 business days and complete it within 30 days. You have the right to file a complaint about how we handle your information with the applicable privacy authority in your jurisdiction.
Do Not Sell or Share
myStoria doesn’t sell your personal information, and we never share your health information for advertising. We do share limited app activity and your phone’s ad ID with advertising platforms to measure our ads (see Advertising Partners). Some state privacy laws may treat this as "sharing" for advertising. To remove the relationship between your data and your device, reset your ad ID and/or delete your accounts with the associated advertising networks (TikTok, Meta, Google, Apple, etc). If you have questions about your rights under state privacy laws, including the California Consumer Privacy Act, contact privacy@mystoria.com.
Breach Notification
We take the security of your data seriously. In the unlikely event of a data breach affecting your personal information, we will notify affected users promptly, and no later than 30 days after discovering the breach. We’ll also notify regulators as the law requires, such as Quebec’s Commission d’accès à l’information, the Privacy Commissioner of Canada and the U.S. Federal Trade Commission.
Cookies and Tracking Technologies
myStoria uses cookies and similar tracking technologies on our website and mobile application. These technologies fall into the following categories:
We never use tracking technologies to send your health information to advertising platforms. You can manage cookies in your browser or our cookie banner and your ad ID in your device settings.
Camera & Device Permissions
Our app may request access to your device’s camera, microphone, or photo library to enable features such as uploading medical documents, recording voice notes, or capturing images for your myStoria account. All permissions are optional and can be revoked via your device settings at any time. myStoria is not a medical device and does not offer clinical or diagnostic services.
Third-Party Sites and Links
The myStoria Platform may link to websites we don’t control. We’re not responsible for their privacy practices, so please read their policies. Our private community is hosted for us by Circle (see Service Providers). Circle also follows its own privacy policy for your Circle account, and anything you post in the community can be seen by other members.
We may update this Privacy Policy from time to time. We’ll tell you in advance about material changes, through the myStoria Platform or by email. Where a change materially affects how we handle your information, we’ll ask you to accept it before it applies to you. For other changes, your continued use of our Services after the notice period means you accept the updated policy. If you live in Quebec, you’ll get at least 30 days’ notice, as described in our Terms of Service.
If you have any questions or concerns about our privacy practices or this policy, contact us at:
Privacy Officer
Jessica Chalk, Founder & CEO
privacy@mystoria.com
myStoria Inc., 809 Wellington St N, Unit 2, Kitchener ON, N2H 5L6
For general support: concierge@mystoria.com
