Privacy policy

Helm is operated by Helmworks LLC, a Wyoming limited liability company. Helm is currently early-access software; this policy describes our practices today and will be updated as the product evolves.

Contact for privacy matters: privacy@helm.org
General contact: hello@helm.org

We collect what you give us, plus minimal account metadata needed to run the service. Helm is a personal medical records portal — by design we collect health information you choose to enter.

• Account info: email address, password hash (via AWS Cognito — we never see your password in plaintext), MFA device token if you enable MFA, optional phone number
• Profile (PHI): name, date of birth, phone number (if provided), diagnosed conditions, allergies, medications, timezone, and the long-form narrative you write about your medical journey
• Clinical data you add (PHI): uploaded medical records (PDFs, lab reports, imaging summaries, visit notes), lab values, medications, symptoms, appointments, providers, photos, daily check-ins, treatments tried, case notes, audio recordings (e.g. doctor visit audio you upload for transcription), and any free-text notes
• AI-generated data about your case (PHI): Captain's reflections, ranked diagnostic theories, recommended tests, ruled-out items, research leads, specialists, trials, Q&A entries, visit-prep packets, phenotype matches, treatment tracking, symptoms analysis, case narratives, and the prior versions of every edit you (or Captain) make to a case narrative
• Voice + audio data (PHI): when you use Captain's voice mode or upload visit audio, audio is streamed to AWS Transcribe Medical for transcription and to AWS Polly for text-to-speech reply. Both are covered under our AWS Business Associate Agreement. We do not retain raw audio beyond the transcription request; transcripts are stored in your account as text.
• Operational logs: sign-in events, authenticated request metadata (IP address, user agent, timestamp) retained by AWS for standard security + abuse prevention. CloudWatch logs typically retain 30-90 days.

We do not use third-party analytics, advertising trackers, fingerprinting libraries, social-media pixels, or behavioral profiling tools. There is no third-party JavaScript on the application beyond what AWS Amplify hosting injects for its own operation.

We use your data to:

• Run the application — show you your records, accept your edits, deliver Captain's investigative output
• Send email you've opted into (daily check-in reminders, weekly digest, caregiver invites, Captain agenda digest)
• Maintain security + prevent abuse
• Respond to support requests
• Improve the product — analyzing aggregated, non-identifying usage patterns (which features get used, error rates) to decide what to fix or build next. We never inspect individual users' clinical content for product improvement.
• Comply with legal obligations (responding to subpoenas, court orders, or other legal process)

We do not:

• Sell your personal information to anyone
• “Share” your personal information for cross-context behavioral advertising (as that term is defined under California law)
• Use your data to train AI models. Per the AWS Business Associate Agreement and Anthropic's commercial terms, data passed to Bedrock is not retained beyond inference and is not used to train any underlying model.
• Share your data with insurance carriers, employers, data brokers, or law enforcement except where compelled by a valid court order, subpoena, or other legal process — and even then we will notify you unless legally prohibited from doing so
• Use your data to target advertising
• Disclose to anyone outside this policy without your explicit consent

Captain is Helm's AI assistant. It uses AI technology provided by Anthropic and accessed via AWS Bedrock in the us-east-2 region. Captain reads the data in your account when you initiate an action that requires it — when you click “Re-read the case,” chat with Captain, generate a visit-prep packet, ask Captain to analyze symptom patterns, generate Q&A vault entries, or trigger any other AI- backed feature.

What gets sent to Bedrock per request: the relevant slice of your data needed for the request (your profile, recent symptoms, lab values, appointments, case narrative, prior Captain memories, etc.) plus the specific user message or trigger. This is the “system prompt” that gives Captain context.

Retention by Anthropic / AWS Bedrock: per the AWS Business Associate Agreement and Anthropic's commercial terms, the inference request is not retained beyond the request and is not used to train AI models. AWS Bedrock processes the inference and returns the result; the input + output are not stored by Anthropic or AWS beyond standard operational logging required for service reliability and abuse prevention.

What we save: the structured outputs Captain produces (your case reflection, ranked theories, suggested tests, etc.) are saved to your account so you can review them later. Captain's chat conversations are also saved so you can pick up where you left off. You can delete any of these at any time.

Other AI / ML services we use:

• AWS Transcribe Medical — converts voice input to text. Covered by our AWS BAA. Audio is not retained beyond transcription.
• AWS Polly Generative — converts Captain's text replies to audio (us-east-1 region for the generative engine). Covered by our AWS BAA. Synthesized audio is streamed to your browser and not retained by AWS beyond the request.
• AWS Titan Embeddings — vectorizes long transcripts so Captain can semantically retrieve relevant snippets. Covered by our AWS BAA. Embeddings are stored in our database (associated with your account); raw text is not retransmitted to Titan after embedding.

AWS provides Helm's infrastructure and AI services. Specifically:

• AWS S3 (us-east-2, replicated to us-west-2 for disaster recovery) — uploaded medical records and audio files. KMS-encrypted at rest. 30-day S3 Object Lock (governance retention) prevents accidental deletion.
• AWS RDS Postgres (us-east-2, private VPC) — all clinical data + Captain's outputs + conversational history + case-narrative version history. Automated daily backups. TLS-only connections from the application backend.
• AWS Cognito (us-east-2) — authentication + user pool. Passwords are never stored in plaintext; only hashed by Cognito.
• AWS Bedrock (us-east-2 for chat, us-east-1 for generative TTS) — proxies your inference requests to AI technology provided by Anthropic.
• AWS Lambda (us-east-2) — runs the data-api server-side actions.
• AWS Amplify (us-east-2) — hosts the Next.js application frontend.
• AWS SES (us-east-2) — outbound email (account confirmation, check-in reminders, caregiver invites). Bounce + complaint events go to an SNS topic for delivery hygiene.
• AWS Transcribe Medical, Polly, Titan Embeddings — see §4 above.

All of the above are covered under our AWS Business Associate Agreement (BAA), which obligates AWS to handle PHI under HIPAA-equivalent controls (encryption, access logging, breach notification, etc.).

Helm also uses these service providers for specific functions:

• Stripe — runs hosted checkout and the customer portal, and processes payment methods, subscriptions, invoices, and related billing events.
• Sinch Fax — provisions fax numbers, fetches the record documents you select for an outbound fax, and delivers received fax PDFs to Helm for the receiving user's records. Because fax documents can contain health information, Sinch processes that information when the fax feature is used.

We do not use third-party analytics, advertising networks, behavioral profiling tools, or social-media pixels.

Connections between your browser and our service are HTTPS-only (TLS 1.2+). All data is encrypted both in transit (HTTPS) and at rest (AWS KMS).

Helm uses HIPAA-grade architecture (we are not, however, a HIPAA-covered entity — see §11). Concretely that means:

• Encryption in transit — TLS 1.2+ on every connection between your browser and our service, and between our service and AWS APIs
• Encryption at rest — AWS KMS-managed keys for both RDS (clinical data) and S3 (record files + audio)
• Authentication — AWS Cognito with optional multi-factor authentication (MFA via authenticator app); session JWTs invalidate within ~60s of suspension via sessionVersion bumping
• HIPAA-aware idle timeout — sessions automatically expire after 15 minutes of inactivity, in keeping with healthcare-portal norms
• Access controls — your data is only accessible to your authenticated session. We never read individual users' clinical content for any reason except (a) when you specifically request support and grant consent, or (b) when compelled by valid legal process.
• Audit logging — administrative actions (account suspension, support views) are logged with timestamps to an internal audit table that's never cascade-deleted with user data
• Data export + deletion — full ZIP export + 90-day-grace-then-purge deletion are first-class features
• Private subnets — Lambda + RDS run inside a private VPC subnet, not exposed to the public internet

What we have not done (yet, transparently): we are a pre-launch beta product. We do not yet have a SOC 2 audit, HITRUST certification, or third-party penetration test. We use the “HIPAA-grade architecture” framing specifically to be accurate about what we are: a product built on HIPAA-covered AWS services with the same security primitives a covered entity would use — not a product that has completed a formal HIPAA compliance audit.

You control sharing. There are three concrete sharing mechanisms in the app:

• Doctor share link: a read-only URL with an unguessable 22-character bearer token. Expires after the window you select (default 7 days). You can revoke it any time. Anyone with the URL can read until expiry or revocation; you can see the access count + last-access timestamp on the share manager.
• Caregiver access: a persistent invite to a specific email address. The caregiver creates their own account with that email + accepts the invite. You can revoke at any time. Read-only.
• Record-share tracking: internal-only — when you mark “I gave this record to Dr. X,” we store the join. Doesn't actually transmit the record to anyone; it's a personal log so the system can stop bugging you about bridges you've already addressed.

Helm does not verify the identity of share-link recipients — the bearer token is the credential. Don't forward a share URL to anyone you don't intend to give access to.

Every user can, at any time:

• Export your full data as a ZIP archive (Settings → Privacy & data → Export). Includes every record file, every lab value, every Captain output, every symptom log, every audio transcript.
• Delete your account. Settings → Privacy & data → Delete account. Triggers a 90-day grace period during which you can sign back in to recover. Secure hard deletion is temporarily paused while version-aware storage erasure is certified, so scheduled accounts and their health data may be retained beyond the eligibility date rather than incompletely deleted. Export and recovery remain available during this safety hold. Once certified, the purge removes PHI tables, stored objects, and the Cognito identity; some admin audit entries are preserved with the user id nulled for regulatory purposes.
• Correct any inaccurate information — every field in your profile, your records, your symptom logs is editable in the app. For things you can't correct yourself, email privacy@helm.org.
• Revoke any caregiver or doctor share link.Settings → Caregivers, or the case-header Share button.
• Withdraw consent for AI processing — email privacy@helm.org. We'll disable Captain for your account while keeping your records readable.
• Lodge a complaint with your state attorney general or with the FTC if you believe your rights have been violated and we haven't resolved your concern.

Response time: we respond to data-rights requests within 30 days. If we need more time (rare; e.g., for a complex correction), we'll tell you why and how long we expect to need.

Depending on where you live, you have additional rights under state law. These are stacked on top of the “every user” rights above.

California (CCPA / CPRA)

If you're a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you specific rights:

• Right to know what personal information we've collected, the categories of sources, the business purpose, and the categories of third parties we've shared with. The disclosures in §2 and §5 above cover this; you can request a personalized report by emailing privacy@helm.org.
• Right to delete your personal information. See §8 — Settings → Privacy & data → Delete account.
• Right to correct inaccurate personal information. See §8.
• Right to opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising, so this right is preserved by default. No action required.
• Sensitive Personal Information (SPI) — under CPRA, health information is SPI, as is precise geolocation, biometric identifiers, and account credentials. You have the right to limit our use of SPI to what's necessary to provide the service. We do not use your SPI for any purpose beyond providing Helm to you, so this right is also preserved by default. We do not sell SPI to anyone.
• Right to non-discrimination — we won't deny service, charge different prices, or degrade quality for users who exercise CCPA/CPRA rights.
• Authorized agent — you can designate someone to submit requests on your behalf. Contact us with proof of authorization.

Categories of personal information collected in the past 12 months (for CCPA disclosure purposes): identifiers (email, name), customer records (account info, contact info), demographic info (age, gender), internet activity (sign-in events, usage), geolocation (timezone only, not precise), sensory data (audio for transcription), professional info (your stated providers + appointments), inferences (Captain's pattern-matching outputs), and sensitive personal information (health data, account credentials).

No financial incentive program. We do not offer or run any financial-incentive program tied to data collection.

Washington State (My Health My Data Act)

Washington's My Health My Data Act (MHMDA) gives any WA resident specific rights when their “consumer health data” is processed by a regulated entity. We process consumer health data and treat all our users as covered.

Categories of consumer health data we collect: all PHI listed in §2 (medical records, symptoms, lab values, medications, appointments, audio, AI outputs), plus inferences Captain draws from that data, plus your decision to interact with healthcare topics (which itself is treated as health data under MHMDA).

Sources of consumer health data: you (when you enter or upload it) and Captain (when the AI produces inferences about your data).

Categories with whom we share consumer health data: AWS (as our infrastructure processor, under our BAA), Anthropic (for inference only, no retention), Sinch (when you use fax, to send or receive the fax document), and people you explicitly choose to share with via doctor share links or caregiver invites. Stripe separately processes billing and payment information as described in §5.

WA residents' rights:

• Right to confirm + access — see §8 (Export).
• Right to delete — see §8 (Delete account + 90-day-grace-then-purge).
• Right to withdraw consent — at any time, for any specific processing or in total. Email privacy@helm.org. Note: withdrawing consent may limit functionality (e.g., no Captain if you withdraw consent for AI processing).
• Right to appeal a decision on a data request. If we decline a request, you can appeal by replying to our decision email. We'll respond to an appeal within 45 days. If we still decline, we'll tell you how to file a complaint with the WA Attorney General.
• Private right of action — MHMDA gives WA residents a private right to sue for violations.

We do not sell consumer health data. If we ever do, we would obtain separate, explicit, written authorization from you that meets MHMDA's specifications. As of this policy's effective date, no sale of consumer health data has occurred or is planned.

We do not use geofences around healthcare facilities to identify or track users, or to send messages related to health services. MHMDA prohibits this and we comply.

New York (SHIELD Act + state privacy law)

NY's SHIELD Act applies because we hold the private information of NY residents. We implement “reasonable safeguards” — see §6 above. In the event of a security breach affecting NY residents, we'll notify affected users + the NY Attorney General + applicable consumer reporting agencies as required by law. NY also gives data subjects the right to request information about data collection + a copy of their data; see §8.

Illinois (BIPA + PIPA)

Illinois' Biometric Information Privacy Act (BIPA) restricts use of biometric identifiers (fingerprints, face geometry, voice prints). Helm does not collect or store biometric identifiers. Voice audio you record in Captain voice mode is sent to AWS Transcribe Medical for speech-to- text conversion and is not retained as a voiceprint or used for identification. Transcripts (text) are stored; raw audio is not. The Illinois Personal Information Protection Act (PIPA) breach-notification framework applies as in §6 above.

Other states

Texas, Virginia, Colorado, Connecticut, Utah, Oregon, and others have passed comprehensive consumer privacy laws. The rights described above (access, deletion, correction, opt-out of sale, limit use of sensitive data) substantively cover what these laws require. If you live in one of these states and want to exercise a right not already covered here, email privacy@helm.org and we'll honor it.

Helm is hosted in the United States (AWS us-east-2 with DR replication to us-west-2). If you access Helm from outside the US, your data will be transferred to + processed in the US. We don't currently offer Helm internationally and have not undertaken formal cross-border transfer mechanisms (Standard Contractual Clauses, UK-IDTA, etc.). If you're outside the US, please be aware that US privacy law is different from + generally less restrictive than EEA/UK law, and that by using Helm you consent to your data being processed in the US under the practices described here.

What HIPAA is, and why this section exists: HIPAA is the US federal law that protects the privacy of protected health information (PHI). It binds “covered entities” (healthcare providers, health plans, healthcare clearinghouses) and their “business associates” (vendors handling PHI on a covered entity's behalf).

Helm is NOT a HIPAA-covered entity. We are a direct-to-consumer tool that you, the user, voluntarily use to organize your own health data. We do not bill insurance, transmit data to covered entities on your behalf, or operate as a provider, plan, or clearinghouse. HIPAA does not, as a matter of law, apply to us in the same way it applies to a doctor's office.

Helm uses HIPAA-grade architecture. We use AWS services covered under a Business Associate Agreement (BAA), implement encryption at rest + in transit, run audit logging, enforce access controls, support data portability and deletion, and follow security practices that mirror what a HIPAA-covered entity would implement. We choose this framing deliberately: we want to be honest about what we are (a beta product built with strong privacy primitives) rather than overclaiming (a fully HIPAA-audited compliance regime).

When you share with a doctor: if you use a doctor share link or caregiver invite to give a healthcare provider access to your records, the provider becomes subject to HIPAA for any data they retain on their end. The transmission via our share link is patient-controlled and does not create a business-associate relationship between Helm and the provider.

For clinics + practices: if you're a healthcare organization interested in offering Helm to your patients as a HIPAA-covered service, contact us and we'll work out a BAA + the necessary compliance documentation.

Helm is positioned as a general wellness product, not a medical device. Per FDA guidance on General Wellness: Policy for Low-Risk Devices (2019), software intended for general wellness purposes — organizing personal health information, supporting a healthy lifestyle, helping users discuss their health with providers — is outside FDA medical-device regulation.

Captain (the AI) is not a diagnostic device. Captain surfaces patterns, ranks theories, suggests tests you might discuss with your doctor, and helps you write visit-prep notes. It does not diagnose conditions. It does not direct or recommend specific treatment. It does not replace clinician judgment. We rely on the user always validating Captain's output with a licensed healthcare provider, and we make this explicit in the in-app UI, in Captain's system prompt, and in our terms.

• Active accounts: we retain your data as long as your account is active.
• Deleted accounts: 90-day soft-delete grace period (during which you can sign in and recover the account), then a daily purge job cascade-deletes RDS rows, S3 objects, audit attribution, and the Cognito identity.
• Per-record retention: uploaded record files carry a 30-day S3 Object Lock (governance mode) by default, preventing accidental deletion within that window.
• Case narrative versions: every prior version of a case narrative is retained for the life of the case. Deleting a case deletes its version history.
• Audit logs: administrative actions are retained for 7 years (regulatory practice) with user-id attribution nulled on account purge.
• Operational logs: CloudWatch typically retains 30-90 days. AWS access logs follow AWS standard retention.
• Audio: raw audio is not retained beyond the transcription request. Transcripts (text) follow your account's retention.
• Email logs: AWS SES bounce + complaint events are retained for delivery hygiene; no message bodies are retained beyond transmission.

Helm uses only the cookies strictly necessary to run the service:

• Auth cookies (set by AWS Cognito / Auth.js) — keep you signed in. Session-scoped, secure, HttpOnly, SameSite=Lax.
• CSRF token — protects against cross-site request forgery on server actions.
• localStorage — used in-browser only for client-side draft survival (e.g., your in-progress case narrative) and UI preferences (voice picker selection, voice-conversation-id resume). Not transmitted to our server.

We do not set advertising, analytics, or third-party tracking cookies.

If we become aware of a security incident affecting your personal information, we'll:

• Investigate promptly and contain the incident
• Notify affected users without unreasonable delay (typically within 72 hours of confirmation), including: what happened, what data was affected, what we're doing about it, and what steps you can take
• Notify state attorneys general + consumer reporting agencies as required by applicable state breach-notification laws (NY SHIELD, CA, IL PIPA, etc.)
• Preserve evidence for forensic review

You must be 18 or older to create your own Helm account. Helm isn't designed for anyone under 18 to sign up on their own, and we don't knowingly collect data from children under 13 (per COPPA). A minor's health information may be managed only through a parent or legal guardian's account (the Family feature), not an account the minor creates. If you believe a minor has signed up for their own account, contact us and we'll delete it.

Managing a minor's information: a parent or legal guardian may maintain a minor child's health information within their own account (the Family feature). The parent agrees to these terms on the minor's behalf and is responsible for what they upload.

We'll update this policy as the product evolves. The effective date at the top reflects the most recent change. Material changes (anything that meaningfully expands what we collect, how we use it, or who we share it with) trigger:

• In-app re-consent via the /welcome screen — we bump our internal legal-docs version constant, which forces every signed-in user back through the consent gate on their next session
• An email to your account address explaining what changed

The git history of this page in the source repository is the canonical record of every revision.

Privacy questions, deletion requests, correction, access, withdrawal of consent, MHMDA appeals, CCPA/CPRA requests: privacy@helm.org
General questions: hello@helm.org

We respond to privacy requests within 30 days (45 for appeals).