Privacy Policy

Dyno Health, Inc. ("Dyno," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect information when you use the Dyno mobile application (the "App"), our website at joindyno.com (the "Website"), and related services.

Overview

Dyno is a health tracking app that helps you monitor testosterone replacement therapy (TRT) and related health data. The App can be used in two ways:

• Without an account: All data is stored locally on your device and never transmitted to our servers.
• With an account: When you create an account and opt in to cloud sync, your health data is encrypted and stored on our secure servers so you can access it across sessions and receive AI-powered insights.

Information We Collect

Information you provide directly

• Account information: If you create an account, we collect your email address, first name, last name, date of birth, and password.
• Health data: If you use cloud sync, we collect the health information you enter into the App, including medication protocols, dosing logs, symptom check-ins, lab results, testosterone readings, and facial measurements.
• Contact information: If you join our waitlist or contact us, we collect your name and email address.

Information collected automatically

• Website analytics: We use PostHog to collect anonymous usage data on our Website (not in the App), including pages visited and referral sources. PostHog may use cookies for this purpose.
• Apple HealthKit data: If you grant permission, the App reads sleep, heart rate, and activity data from Apple Health. This data is processed locally on your device to calculate your vitality score and is only transmitted to our servers if you have cloud sync enabled.

Information we do not collect

• Device identifiers or advertising IDs from the App
• Location data
• Usage analytics or telemetry from the App

How We Use Your Information

• Provide the service: Store and sync your health data, authenticate your account, and display your tracking history.
• AI-powered insights: If you have an account, your de-identified health data may be processed by our AI system to generate personalized health insights and trend analysis. This processing uses the Anthropic Claude API.
• Communications: Send you product updates, respond to inquiries, and provide customer support.
• Improve the service: Understand how the Website is used to improve our content and offerings.

Data Storage and Security

Local-only mode (no account)

If you use the App without an account, all data is stored locally on your device using Apple's Core Data framework. This data is protected by your device's built-in security features (passcode, Face ID/Touch ID, iOS data encryption). We cannot access this data.

Cloud sync mode (with account)

If you create an account, your health data is transmitted over HTTPS (TLS encryption in transit) and stored in a PostgreSQL database with field-level AES-256 encryption at rest. Encrypted fields include your name, date of birth, email, testosterone readings, lab results, dosing amounts, AI insights, and notes. Your password is hashed using bcrypt and is never stored in plain text.

Our servers are hosted on Railway in the United States.

Third-Party Services

We use the following third-party services:

• Railway — Cloud hosting for our application and database (United States)
• Anthropic — AI analysis of health data to generate personalized insights (data is processed transiently and not stored by Anthropic)
• Loops.so — Email delivery for waitlist communications
• PostHog — Website analytics only (not used in the App)
• Sentry — Error monitoring for our servers (health data is scrubbed before transmission)

We do not sell, rent, or trade your personal information or health data to any third party. We do not use your health data for advertising purposes.

Your Rights and Choices

• Use without an account: You can use the App without creating an account. No data is transmitted to our servers.
• Export your data: You can export all your health data as a JSON file from the App's Settings.
• Delete your data: You can delete individual entries within the App. To delete your entire account and all associated data, contact us at hello@joindyno.com.
• Uninstall: Removing the App from your device permanently deletes all locally stored data.
• Opt out of communications: You can unsubscribe from marketing emails at any time using the link in each email.

Data Retention

We retain your account data and health data for as long as your account is active. If you request account deletion, we will delete your data within 30 days, except where retention is required by law. Waitlist email addresses are retained until you unsubscribe. Website analytics data is retained for 12 months.

Health Breach Notification

In compliance with the FTC Health Breach Notification Rule, if we experience a breach of security involving your health data, we will notify you by email and in-app notification without unreasonable delay and no later than 60 calendar days after discovery.

California Residents

If you are a California resident, you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you. You also have the right to request deletion of your personal information. To exercise these rights, contact us at hello@joindyno.com. We do not sell personal information as defined by the California Consumer Privacy Act.

Children's Privacy

The Dyno app is not intended for use by anyone under the age of 18. We do not knowingly collect any information from children.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the "Last updated" date, and, if you have an account, by sending you an email notification.

Contact Us

If you have any questions about this Privacy Policy or your data, please contact us at:

Email: hello@joindyno.com
Company: Dyno Health, Inc.