Privacy and Data Handling
Pivot Wellness enables users to import and manage personal health data from various sources, including electronic medical record (EMR) systems, Google Sheets, and manual uploads. The following disclosures explain how your data is handled.
Who We Share Data With
Pivot Wellness does not sell, rent, or share your personal health information with third parties for marketing or advertising. We share data only in these limited cases:
- AI models: None. Every model that reads your data runs on our own hardware — there is no third-party AI provider in the path, so your prompts are never sent anywhere for processing.
- Your wellness coach: If you have an assigned coach and choose to share your nutrition or health data with them, they can view the data you have authorized for coaching purposes.
- Service providers: We may use vendors (e.g., hosting, email) that process data on our behalf under strict contractual obligations to protect it.
Health System Integration
When you connect your Health System account, Pivot Wellness accesses your medical records through the Health System's official documented API standard. This integration:
- Uses OAuth 2.0: We never see or store your username or password. You authenticate directly with the Health System and grant us limited, revocable access.
- Reads the following data types: Lab results, vital signs, medications, conditions/diagnoses, allergies, immunizations, encounter history, diagnostic reports, and clinical notes.
- Does not write to your medical record: Pivot Wellness has read-only access. We cannot modify any data in your EMR.
- Stores data on private infrastructure: Imported data is stored on hardware we operate, never on a third-party cloud database. Access is restricted by role and every cross-user read is written to an access log. Records are not encrypted at the row level today; credentials such as your EMR OAuth tokens are. See Security for the current posture.
- Allows revocation: You can disconnect your MyChart account at any time from the Health Agents page. You can also revoke access directly through MyChart's "Manage Connected Apps" settings.
How the connection looks from your side, step by step: Connecting your health records.
AI and Machine Learning
Pivot Wellness uses large language models (LLMs) to help you understand and interact with your health data. Important disclosures:
- AI responses are generated based on your data and general medical knowledge. They may contain errors and should never replace professional medical advice.
- Your personal health data is not used to train AI models that are shared with or accessible to other users.
- All models run on our own hardware, so your data is not sent to an AI provider in order to answer you.
Data Retention and Deletion
- Imported health data is retained as long as your account is active.
- You may delete individual data imports or your entire account at any time.
- Upon account deletion, your data is removed from live systems within 30 days.
- Database backups are retained beyond that window and are not currently purged on a fixed schedule, so a deleted account’s data can persist in backups until those backups are retired. We are working to bound this. If you need deletion from backups confirmed, contact us and we will handle it directly.
Regulatory Status
Pivot Wellness is not an FDA-regulated medical device. It is a personal health data management tool. It does not diagnose conditions, recommend treatments, or replace the judgment of licensed healthcare professionals.
Your Rights Under 21st Century Cures Act
The 21st Century Cures Act (2016) and the ONC Final Rule (2020) guarantee your right to access your electronic health information through standardized APIs. Healthcare providers and EHR vendors are prohibited from information blocking — unreasonably preventing or interfering with your access to your health data.
Pivot Wellness helps you exercise this right by providing a secure way to retrieve and organize your health data from participating EMR systems.
Contact
For questions about these disclosures or your data, contact us at privacy@pivotwellness.com.