Privacy Policy

1. Who we are

LAFIA is operated by Exonta LLC. This policy explains how information is collected, used, stored, and disclosed when you use LAFIA services.

2. Information we collect

Depending on how you use LAFIA, we may receive account and contact information, uploaded laboratory reports, extracted text and structured results, generated interpretations and PDFs, payment and billing references, support messages, device and browser information, page and interaction events, and email-delivery or engagement information.

Laboratory reports may contain sensitive health information and personal identifiers. Upload only information you are authorized to provide.

3. Laboratory reports and generated results

We use an uploaded report to extract laboratory values and generate the plain-language interpretation you request. We store the uploaded file, extracted text, report status, generated report data, and related identifiers so we can process, recover, display, and deliver the service.

A person who obtains a valid report link may be able to access the associated report. Keep report links, email messages, and downloaded reports private. We have not published a fixed expiration or deletion period unless expressly stated in the service.

4. AI processing

Report-derived content is sent to Anthropic’s automated AI-processing service to extract values, classify results, and create explanations and educational follow-up information. We store the resulting structured interpretation and raw AI response so the report can be displayed, recovered, and delivered.

LAFIA does not promise that an external AI provider will not retain or use submitted content for training or improvement. Current provider terms, account settings, retention, subprocessors, and processing locations require separate confirmation and legal review.

AI output may be incomplete or inaccurate. It is not medical advice, diagnosis, or treatment and is not a substitute for a qualified healthcare professional.

5. Service providers and disclosures

We use service providers for hosting, storage, databases, application operation, AI processing, payment processing, email delivery, analytics, and related support. These providers may process information on our behalf or as described in their own privacy notices.

We may disclose information to service providers, when required by law or legal process, to protect rights and safety, to investigate misuse, or in connection with a business transfer. We do not make a blanket promise that information is never shared.

6. Payments and checkout

Stripe processes payment and billing information. LAFIA receives information needed to identify checkout, confirm payment, unlock processing, manage credits or subscriptions, and provide support. LAFIA stores Stripe identifiers and payment status or amount information; full card numbers are processed by Stripe rather than intentionally stored in the LAFIA application database.

If you provide an email address before paying, LAFIA may associate it with an uploaded report and send automated incomplete-checkout reminders while the report remains unpaid and eligible. These reminders may include a report link, discount information, or campaign parameters.

7. Email and report notifications

Resend is used to send report-ready messages to the email address provided. A message may contain a report identifier and report link. A critical-result alert may contain limited result details needed to notify you and a configured operational recipient. Keep messages and links private.

Email delivery and engagement events may be forwarded to analytics systems. The availability and operation of unsubscribe or suppression controls should be confirmed before relying on them.

8. Analytics and similar technologies

LAFIA uses Google Analytics 4 and may use PostHog to understand site visits, funnel steps, feature use, and email performance. These tools may receive browser or device information, pages viewed, interaction events, approximate location, and selected funnel or purchase metadata.

PostHog may create identified profiles and may receive an application user ID and email address for signed-in users or email-engagement events. The reviewed purchase event is limited to an opaque transaction identifier, generic purchase value and currency, and a generic item name; it is not designed to include laboratory values, report text, diagnoses, symptoms, or report content. Default vendor collection, cookies, URLs, autocapture, and regional settings may affect what is collected.

LAFIA also uses browser local storage to continue parts of the upload or signup flow. Analytics consent and opt-out behavior depend on the current implementation and applicable law.

9. Use of information

We use information to provide and secure the service; process uploads and generate reports; deliver email notifications; process payments; provide support; maintain accounts and subscriptions; prevent abuse; troubleshoot; measure service performance; comply with law; and operate the business.

Any materially different use of report-derived content, including product development or secondary analysis, must be separately assessed and approved before being represented as a LAFIA practice.

10. Retention and deletion

LAFIA retains information for as long as reasonably necessary for the purposes described in this policy, including service delivery, recovery, security, support, legal obligations, and business records. Different categories may be retained for different periods. A final category-specific retention schedule and complete deletion behavior across databases, files, backups, logs, analytics, email systems, AI providers, and other vendors require implementation and legal confirmation.

11. Security

We use administrative, technical, and organizational measures intended to protect information. No online service can guarantee absolute security. The reviewed application includes HTTPS delivery, storage access controls, presigned or proxied report access in relevant paths, and no-store behavior in relevant responses; these facts do not establish a particular encryption algorithm or identical protection across every system, backup, vendor, email, or log.

12. Privacy requests

For access, correction, deletion, export, or other privacy requests, contact contact@exonta.io. Do not send passwords, full payment-card details, or report files by ordinary email. We may request information needed to verify and process a request. The service does not currently promise a self-service deletion or export control or a particular response time.

13. Children and age limits

LAFIA is not directed to children under the minimum age required by applicable law. If you believe a child provided information improperly, contact us at contact@exonta.io. The precise age policy and any jurisdiction-specific obligations should be confirmed before publication as a final legal position.

14. International processing

LAFIA and its providers may process information in countries different from the country where you live. Applicable transfer mechanisms, provider locations, and contractual terms should be confirmed for the relevant jurisdictions.

15. Changes and contact

We may update this policy when our practices or legal obligations change. The updated date will be shown at the top of this page. Questions or privacy requests may be sent to contact@exonta.io.

Medical disclaimer

LAFIA output is for educational and informational purposes only and does not constitute medical advice, diagnosis, or treatment. If you may be experiencing an emergency, seek urgent medical care rather than waiting for LAFIA.