Privacy Policy

1. Operator and scope

Aldrick is operated by USA Research Group LLC. This policy covers information processed through the Aldrick web application, including the public assessment start flow, account areas, and follow-up emails you ask to receive.

2. Information you provide

• Email address and account information used to sign in.
• Age and body measurements such as height, weight and waist.
• Health assessment responses across the areas Aldrick supports.
• Cardiovascular information, including blood-pressure readings you record.
• Sleep information, including sleep duration and sleep-related symptoms.
• Activity and strength information.
• Sexual-health information.
• Mental and cognitive information.
• Hormone and lab information where Aldrick supports entering it.
• Medications, conditions, lifestyle information and the goals you select.
• Your follow-up-email preference.

3. Information processed automatically

• Authentication and session information needed to keep you signed in.
• Browser storage used to hold session and in-progress assessment state.
• Ordinary request, device and network metadata (such as IP address, user agent and timestamps) processed by our hosting infrastructure for delivery, security and reliability.

Aldrick does not intentionally collect precise geolocation, and does not use advertising or analytics cookies set by the application.

4. Browser storage and information before you have account access

Aldrick does not currently collect health assessment answers on its public pages, including the beta introduction page. Health assessment answers are collected only after you have access to an account and have accepted the current Aldrick agreements.

Aldrick may use ordinary browser storage on your device to keep you signed in and to hold operational state such as your place in a form you are completing while signed in. That storage sits on your device, and you can clear it through your browser at any time. Aldrick cannot reach into your browser to erase it for you.

Any anonymous assessment information left in a browser from an earlier version of the beta is discarded rather than attributed to an account. It is never associated with a signed-in Aldrick account.

5. How we use information

• Creating and operating your account.
• Running assessments and tracking profile completion.
• Calculating deterministic scores and confidence indicators.
• Generating educational plans and recommendations.
• Storing and showing your measurement history.
• Presenting educational safety information when your answers indicate it is relevant.
• Producing AI-supported explanations of results already calculated.
• Sending follow-up emails when the follow-up preference is enabled.
• Security, debugging, abuse prevention and service reliability.
• Complying with applicable law and responding to lawful requests.

6. AI processing (AI notice version 2026-08-14)

• To produce explanations, structured health context derived from your answers and results may be sent through Lovable's AI Gateway to OpenAI.
• Your email address and direct account identifiers are not intentionally included in that AI request payload.
• Aldrick does not currently include a free-text chat or “Ask” feature that sends open-ended messages for processing.
• AI does not calculate the underlying deterministic score; it explains results that were already computed by rules.
• AI output can be incomplete or inaccurate, so we do not promise that it is always accurate.

7. Service providers

We use the following providers, which process information on our behalf to deliver the services we have contracted for:

• Supabase — authentication and database.
• Cloudflare and Lovable — application hosting and runtime.
• Lovable AI Gateway and OpenAI — AI-supported explanations.
• Resend — email delivery.

Providers may change as the product develops. We may also disclose information to authorities or professional advisers where legally required.

8. Follow-up emails

• You can control the follow-up-email preference in your profile settings.
• Account and security messages, such as password-reset and email-confirmation messages, may still be sent while your account exists.

9. No sale of data and no targeted advertising

Aldrick does not sell personal information or consumer health data, and does not use it for targeted advertising. If this ever changes, we will update this policy and provide the disclosures and choices required by applicable law before the change applies.

10. Retention

We retain information while it is reasonably necessary to operate your account, provide the service, protect security, meet legal obligations and resolve disputes.

You may request deletion by writing to privacy@aldrick.com. Copies held in backups, or records we are required to keep by law, may take additional time to expire or may be retained as permitted by law.

11. Security

We use reasonable administrative, technical and organizational safeguards intended to protect information, including authenticated access controls and database access rules that scope health information to your own account.

No online service can guarantee absolute security. We do not claim any security certification.

12. Your choices and rights

• Request access to the information associated with your account.
• Request correction of inaccurate information, including by updating your answers in the app.
• Request deletion of your account and information.
• Withdraw consent where applicable.
• Change your follow-up-email preference at any time.
• Exercise additional rights that may be available under the laws of your state.

To make a request, email privacy@aldrick.com, from the email address registered to your account where possible. Aldrick is a private beta, so these requests are handled manually. Sending a request starts the process, and it is not an immediate deletion.

We will confirm the request through your registered email address before acting. Never send your password, health details or copies of identity documents. You do not need to accept the current Aldrick agreements to request access, correction, deletion or withdrawal of consent.

After deletion, already-delivered emails and copies retained temporarily in provider logs or backups may remain outside our immediate control until they expire.

13. Children

Aldrick is not intended for anyone under 18, and we do not knowingly invite minors to participate in the beta or knowingly collect their information.

14. Consumer health data

Health information you provide is also described in our Consumer Health Data Privacy Notice, which explains the categories collected, the purposes, the processors involved and how to exercise your rights. Please read it together with this policy.

15. HIPAA

Aldrick is a consumer educational platform, not a healthcare provider, health plan or healthcare clearinghouse. Neither Aldrick nor USA Research Group LLC claims to be a HIPAA-covered entity or to be HIPAA-compliant, and information you provide to Aldrick may not be governed by HIPAA in the same way as information you give a healthcare provider. Which laws apply depends on the circumstances and applicable law.

16. Changes and contact

We may update this policy as Aldrick develops. The version identifier and effective date at the top of this page show the current version, and material changes may require renewed acceptance.

Contact us at privacy@aldrick.com or by mail:

• USA Research Group LLC
• 2260 Ringling Blvd, Suite 320
• Sarasota, FL 34120
• United States