1. Who we are and what this covers
MCMLXXXIV LLC, doing business as MATTIK Health (“MATTIK,” “we,” “us”), provides tools to help people organize and understand their health information. This Privacy Policy covers our website, newsletter, health application, and MATTIK-operated integrations that link to this policy (the “Services”). Our mailing address is 30 N Gould St, Ste R, Sheridan, WY 82801.
Some features may be in development or available only to a limited group. Describing a feature here does not mean it is available. Third-party services, including Meta’s Muse, have their own privacy practices.
2. Information we collect
- Account and profile information: email address, authentication information, profile details you provide, account identifiers, and preferences.
- Health records and related information: documents you upload, information extracted from them, laboratory results, medications, conditions, allergies, encounters, provider details, appointments, tasks, and questions you save. Depending on what you submit, records can contain sensitive information about physical or mental health, reproductive health, disability, genetic information, or other aspects of your health.
- Conversations and generated information: your questions, conversation history, generated explanations and summaries, source references, and your confirmations, corrections, or disputes of extracted facts. Generated information can be inaccurate.
- Sharing and connection information: invitations, recipient details, access permissions, authorization records, and information exchanged through integrations you choose to use, where available.
- Newsletter information: email address, device preference, signup time, consent version, subscriber identifier, and unsubscribe token.
- Technical and security information: IP addresses, browser and device information, request logs, access events, error information, and service usage metadata. The website signup flow uses an IP-derived hourly identifier to limit repeated attempts.
- Support information: information you include when contacting us.
We receive information from you, from people you authorize to share it, from your use of the Services, and from connected services you authorize where a connection is available. The newsletter form does not request medical records; use the application’s designated health features for that information.
3. How we use information
We use information to authenticate users, maintain profiles, store and organize records, extract and present health facts, generate explanations and appointment preparation materials, preserve source references, and support the sharing choices you make. We also use it to respond to requests, administer consent and privacy choices, protect the Services, investigate errors and misuse, and meet legal obligations.
Newsletter information is used for the MATTIK news and launch updates you request. A newsletter signup does not authorize us to retrieve health records or connect your health profile to Muse. Where law requires consent for collecting or sharing health information, we obtain that consent separately; this policy is not a substitute for it.
4. Service providers and AI processing
We use service providers for hosting, account authentication, data storage, application processing, security, and communications. The app implementation uses Supabase for authentication, database services, and document storage. The website uses Google Cloud Run for hosting and Google Cloud Firestore to store newsletter signup and abuse-prevention records.
AI-assisted features use OpenAI. To answer a question or prepare an explanation, the app can send your question, relevant health context, and recent conversation history to the AI service. MATTIK also stores conversation history and generated results so you can return to them. A generated explanation is not a new verified medical fact.
Provider retention and model-training arrangements are separate from MATTIK’s own storage. We do not represent that AI processing is entirely on your device, that providers retain nothing, or that information can never be accessed by authorized personnel. The applicable provider agreements and settings must support the health information being processed.
5. Optional connections with Muse
Muse is Meta’s personal AI agent. If a MATTIK connection is offered and you choose to authorize it, Muse may send MATTIK your requested action, related input, and connection information. MATTIK may return the information needed for the permitted action. Depending on the enabled tools and permissions, this could include health summaries, record excerpts, laboratory results, medications, saved questions, or appointment preparation information.
This describes an optional connection, not automatic access to your account. The authorization screen and enabled tools must identify the access being granted. Connecting an account does not authorize unrelated sharing or unrestricted access to other people’s profiles.
Muse may retain returned information in its own workspace and process it to respond to you. Meta’s published description says that inference interactions and tool activity may be used for model training after removal of certain identifying information, with an opt-out in Muse settings. Review Muse’s Privacy Policy and your Muse data controls before sharing health information. MATTIK does not control Meta’s independent processing.
Revoking an integration’s authorization stops future access under that authorization; it does not necessarily erase information already returned to Muse. Manage or request deletion of those copies through Muse as well as requesting deletion from MATTIK. Contact us if you need help with MATTIK-side access or cannot find a revocation control.
6. Other disclosures and your sharing choices
When you use available sharing features, people you authorize may receive access to the information covered by your permission. Removing their access does not erase copies they previously downloaded, exported, or otherwise retained.
We may disclose information when required by law, to respond to valid legal process, or where permitted and reasonably necessary to address fraud, security incidents, or threats to safety. Any transfer in connection with a business transaction remains subject to applicable privacy law, including required notice or consent.
Our proposed operating policy is not to sell personal information or use consumer health information for targeted advertising. Any independent processing by a service you choose to connect, such as Muse, is described separately above.
7. Cookies, browser storage, and external resources
Authentication and hosting services may use cookies or browser storage to keep sessions working, remember preferences, and protect the Services. External resources, such as fonts or icons, can send technical request information to their providers. Browser controls can restrict cookies or storage, but doing so may prevent sign-in or other features from working.
The reviewed newsletter form does not set advertising cookies, and the app source does not add health information to client analytics events. These observations do not establish the behavior of every hosting service or a future release.
8. Retention, deletion, and security
We retain account information, uploaded records, extracted facts, and conversations to provide the Services while they remain associated with your account, subject to deletion requests and applicable obligations. Retention must also account for resolving requests, preventing abuse, and legal requirements. Backups and provider-held copies may have separate deletion cycles.
In the current app implementation, deleting a record also removes linked facts, review entries, and conversations that cite it. Removal of the stored original may require a separate cleanup attempt. Account deletion requests require operator processing; submitting a request does not immediately erase an account. These limitations do not extend any deadline imposed by applicable law.
The app uses authenticated access, profile permissions, and expiring links for original records. No security measure eliminates all risk. We will provide notice of a security incident where applicable law requires it.
9. Your choices and privacy rights
You can use available app controls to review and correct information, dispute extracted facts, export information from an owned profile, delete records, manage sharing, and request account deletion. Exports may not contain infrastructure logs, backups, or information belonging to another person.
You can also contact support@mattikhealth.com to request access, correction, deletion, a copy of your information, or withdrawal of consent. Depending on the law that applies, you may have rights to restrict or object to processing, learn about disclosures of health information, or appeal a denied request. To appeal, write to the same address and identify the request. You may complain to your relevant privacy regulator. We may verify your identity or an authorized agent’s authority before acting. We will not unlawfully discriminate against you for exercising privacy rights.
Withdrawn consent does not invalidate processing already lawfully completed. Some features cannot function without the information they need. To stop marketing emails, use the unsubscribe link in an email or contact us. Please do not include medical records in an initial support email; we can arrange an appropriate way to address your request.
10. Age and information about other people
The proposed initial service is for adults 18 and older. It is not intended for children to create accounts. Do not upload another person’s information unless you have lawful authority and the relevant feature permits it. Contact us if you believe a child has supplied information without appropriate authorization so we can investigate and take appropriate action.
11. Location and applicable protections
MATTIK is operated by a U.S. company. Using cloud services can involve processing outside the state or country where you live. Applicable notices, contractual protections, and consent requirements depend on the processing involved and the laws that apply.
Health information in a consumer app is not automatically protected by HIPAA merely because it originated with a healthcare provider. This policy is not a HIPAA Notice of Privacy Practices or a claim of HIPAA certification. Applicable consumer privacy and health data laws may provide additional protections.
12. Updates and contact
We will post revisions with an updated effective date and provide additional notice or obtain consent where required. A policy update alone does not authorize a new use of health information that requires your separate consent.
MCMLXXXIV LLC, doing business as MATTIK Health
30 N Gould St, Ste R
Sheridan, WY 82801
support@mattikhealth.com