MyFormula Privacy Policy
MyFormula ("we", "us", "I") is operated by Cameron Rahmati, a sole proprietor doing business as MyFormula, in the State of California, United States. As a sole proprietor I am personally the data controller for the information described here. Contact: privacy@trymyformula.com.
The short version
You give us health information so we can build you a supplement routine. We use it for that, and for understanding how the app performs. We do not sell it. We do not run ads. We are not a covered entity under HIPAA, and MyFormula is not a medical service.
Your health answers are saved on your phone. When you generate a routine they are sent to our server, which builds the routine and keeps a copy of your answers and the routine for three days. Coming back to finish uses the copy on your phone, which is kept for 7 days. If you subscribe, we keep your answers and your routine for as long as you have an account so they can be restored on a new phone and updated later. If you do not subscribe, the server copies are deleted after three days.
What we collect
Health profile you provide during the consultation. Your goals, symptoms, sleep and wake times, stress level, diet, lifestyle habits, biological sex, age, height, weight, medications, diagnosed conditions, family history, pregnancy status, and current supplements. Every question except the required safety questions can be skipped or answered "prefer not to say".
This profile is stored on your device. When you generate a routine it is also stored in our database under the retention terms below, and sent to the service described under "How your health data is used" (re-sent if an attempt fails). If you give a first name for the app to greet you by, it stays on your phone: it is not stored in our database or sent to that service.
Bloodwork photos or PDFs, if you upload them. Optional. The file is sent as you upload it, so it may show your name if the report does. It is sent to our server, which passes it to Anthropic's Claude API to read the lab values and returns them for you to check and confirm. Our server does not store the file. Anthropic processes it under its API data policy, which prohibits training on it and sets its own limited retention period (see anthropic.com/privacy). The values you confirm become part of your health profile and are handled as described above. You can decline this step with no effect on your routine.
Account data. An anonymous account id is created the first time you open the app, so that routine generation has a verifiable identity before you sign in. If you sign in with Apple or email, we store the email address and authentication tokens. All of this is held by Supabase, our database and authentication provider.
Purchase data. Subscription status and plan, via RevenueCat and Apple. We never see your payment card.
Your routine and daily check-offs. The routine the app builds for you, including its safety note, which may name a medication you entered, and each day's record of which supplements you marked as taken. Stored on your phone and in our database so they can be restored if you reinstall or change phones.
Usage analytics. Screen views, funnel progress, and feature usage, via Mixpanel, tied to a random per-install identifier that is not your account id. The events are: Onboarding Started, Onboarding Screen Viewed, Onboarding Completed, Routine Generation Started, Routine Generated, Routine Generation Failed, Teaser Viewed, Paywall Viewed, Paywall Tier Selected, Purchase Started, Purchase Completed, Purchase Cancelled, Purchase Failed, Win Back Viewed, Bloodwork Upload, Email Capture Viewed, Email Capture Submitted, Soft Exit Viewed, and Supplement Logged. Their properties are counts, screen ids, plan names, and error messages. Analytics events never contain your health answers, your email, or your bloodwork. If you abandon the paywall and give us your email for a findings summary, the email goes to our database, not to analytics.
Product searches. When a search in the Library, or the search for the supplements you take during setup, finds none of our rated products, we record what was searched and whether the label database had a match. When you open a product we have not rated, we record which product. This tells us which products to rate next. Each record holds only the date, the search or the product, and which of the two searches it came from, in our database, with no account id, analytics id, or time of day, and we do not connect these records to you. Our database provider keeps its own request logs (about a day on our current plan, longer on paid plans) showing which account sent each request and when; in principle those could be matched to these records, and we do not do that. Search text is reduced to plain letters, numbers, and spaces. Anything containing an @ sign, or seven or more digits (such as a phone or card number), is thrown away instead of stored. Anything else you type is kept as typed, including an email address written out in words, so please keep personal details out of the search box. Your phone remembers the last few hundred searches and products it has sent and does not send those again. Searches and products that at least two devices sent are copied into a private weekly report on GitHub, our code host, to plan which products to rate. These records are deleted from our database after 180 days.
Identifiers. Three identifiers exist and they are not joined. Your account id is a random id Supabase assigns when the app first opens; it labels your health profile, routine, and check-offs in our database, and we give the same id to RevenueCat so your subscription follows your account. Your analytics id is a separate random id created on your phone for Mixpanel. Apple assigns its own transaction identifiers to purchases, which RevenueCat receives from Apple. We do not read the advertising identifier (IDFA) and we do not ask for tracking permission.
Diagnostics. The app has no crash-reporting service. Errors from routine generation are recorded as an analytics event with the error message, which never contains your health answers.
How your health data is used
When you generate a routine, your questionnaire answers are sent to our server, which forwards them to Anthropic's Claude API and returns the result to your phone. The request contains your health profile; it does not contain your name or email. The app asks your permission before it sends anything, and you can turn this off in Settings, under "AI and your data". Anthropic processes the request under its API data policy, which prohibits training on this data and sets its own limited retention period (see anthropic.com/privacy). Our server keeps your answers under the retention terms below. No other third party receives your health answers.
When you ask a question in Ask, your question, the earlier questions and answers in that conversation, and your health profile, routine and blood test notes are sent to our server, which forwards them to Anthropic's Claude API and returns the answer to your phone. It does not contain your name or email. The app asks your permission before your first question, and Settings, under "AI and your data", turns it off. Anthropic processes it under the same API data policy as above. Our server keeps only a record that a question was asked and when, to count the daily limit, never the question or the answer. Your Ask conversations are saved on your phone only, so you can go back to them; they are erased when you delete your account or the app. A follow-up question is sent with the earlier questions and answers in that conversation, so it can be answered in context.
What we do not do
- We do not sell or rent your data to anyone.
- We do not share your data with advertisers or data brokers.
- We do not use your health answers for advertising.
- We do not claim to diagnose, treat, cure, or prevent any disease.
Retention and deletion
On your phone. If you leave the consultation without subscribing, your answers are kept for 7 days, matching the promise made in the app, and the routine built from them is kept no longer. Both are deleted from your phone the first time you open the app more than 7 days after you last used the consultation and a fresh check of your App Store purchases finds no subscription. If that check cannot be made, for example when you are offline, nothing is deleted until it can be. A finished profile that has been paid for stays on the phone until you delete your account or the app. Deleting the app removes everything on it immediately.
On our server. Your health profile and the routine built from it are kept for three days after you generate the routine. If you subscribe, they are kept for as long as your account exists; if you do not, they are deleted automatically. A subscriber's daily check-offs and account data are kept while the account exists.
Deleting everything. You can delete your account and every piece of data we hold about you from Settings in the app; deletion is immediate and cannot be undone. This removes your health profile, your routine, your daily check-offs, your account, and any findings-summary email that matches your account's address. It does not cancel a subscription, which is billed by Apple and cancelled in your Apple Account settings, and Apple and RevenueCat keep their own purchase records under their terms. You can also ask us at privacy@trymyformula.com and we will complete it within 30 days, including any email you gave us under a different address.
Your rights
Depending on where you live (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or export your data, and to object to processing. Email privacy@trymyformula.com. We do not discriminate against you for exercising these rights. We do not sell personal information as defined by the CCPA.
Third-party services and software in the app
The app is built with these services and their software development kits (SDKs). Each receives only what the table says, under its own privacy terms. Expo's notification library schedules the reminder notifications locally on your phone; no notification server receives your data.
| Processor | Purpose | Data it touches |
|---|---|---|
| Supabase (supabase-js SDK) | Database, authentication including Sign in with Apple, routine generation relay | Account data, email captures, your health profile and routine (three days, or while you are subscribed), your daily check-offs, product search records (180 days, not tied to an account) |
| Anthropic (Claude API) | Routine generation, reading uploaded bloodwork, answering Ask questions | Health profile, without your name or email; your Ask questions; lab documents as you upload them, which may show your name; held under Anthropic's API data policy, never used for training |
| RevenueCat (react-native-purchases SDK) | Subscription management | Purchase status and Apple transaction identifiers, your account id |
| Mixpanel (mixpanel-react-native SDK) | Product analytics | The usage events listed above, a random per-install id, device model and OS version, no health answers |
| Apple | Payments, Sign in with Apple, local notifications | Purchase and device data per Apple's terms |
| GitHub | Hosts our code and the private weekly report of product searches | Searches with no rated match and unrated products opened that at least two devices sent, not tied to an account |
Children
MyFormula is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has used the app, contact us and we will delete the data.
Changes
We will post changes here and update the date above. Material changes get an in-app notice.