Trust

1. Where we stand today

HealthTrajectory is an early-stage company. The website collects only what is needed to run an early-access list. The mobile app is not released, and no health or wellness data is collected through this website.

We do not currently hold our own third-party security certifications or audit reports (such as SOC 2 or ISO 27001). We will not claim any we do not have.

2. What we collect and what we do not

• Collected: your name, email address and, if you choose, your phone type, when you join the early-access list.
• Not collected: health data, payment details, advertising identifiers or location.
• No advertising or analytics cookies, and no cross-site tracking.
• We do not sell personal information.

Full details are in our Privacy Policy.

3. Where your data lives

The website and the early-access list run in our own account at Cloudflare. We do not use a third-party form or email-marketing service to hold the list. Access to that account is limited to the people who run HealthTrajectory.

Cloudflare publishes its own security certifications and compliance reports at cloudflare.com/trust-hub. Those apply to Cloudflare's infrastructure, not to HealthTrajectory as a company.

4. How we protect it

• Encryption in transit: every page and the sign-up form are served over HTTPS.
• Abuse controls on the sign-up form: origin checks, a hidden spam trap and rate limiting. Rate limiting uses a one-way hash of your IP address, never the address itself.
• Our source code is kept in a private repository, and deployments run automatically from it.
• Email for support and general contact is received through Cloudflare Email Routing and forwarded to the team.

5. Your control

You can ask us to see, correct or delete what we hold about you, or unsubscribe, at any time by emailing support@healthtrajectory.ai from the address you gave us.

6. Report a security concern

If you believe you have found a vulnerability or a security problem, please email support@healthtrajectory.ai with the details. We will acknowledge your report, look into it promptly, and will not take action against good-faith research that avoids accessing other people's data, disrupting the service or publishing details before we have had a chance to fix the problem. Our machine-readable contact is at /.well-known/security.txt.

7. Sub-processors

The outside services that touch the website today are Cloudflare (hosting, database, network and email forwarding) and Google Fonts (typefaces). We will update this page if that changes.