Roota privacy policy
Last updated: 7 September 2026
1. Who we are
Roota is an AI-powered health navigation service. This policy explains how we process personal data through our website at rootahealth.com, our mobile app, and related support services.
The operator responsible for your personal data is LIMITED LIABILITY COMPANY ROOTA HEALTH (LLC ROOTA HEALTH), Ukrainian short name ТОВ "РУТА ХЕЛС", based in Ukraine. Our correspondence address is 57 Dmytra Vitovskoho Street, Lviv, Lviv Oblast, 79011, Ukraine. In this policy, "Roota", "we", and "us" mean that company. Under Ukrainian data-protection law, this company is the personal data owner.
Contact us about privacy or your data at privacy@rootahealth.com.
The website introduces Roota. The mobile app brings together information you provide and sources you choose to connect, then uses AI to help explain patterns and suggest next steps. Roota provides informational health navigation. It does not replace a clinician or emergency care.
2. Personal data we process
What we process depends on the features you use and the permissions you grant.
| Category | Examples and source |
|---|---|
| Website visits | IP address, requested pages, request time, browser and device information, and security-related request metadata received by our hosting services. The website's scripted conversation does not send your messages or health data to an AI model. |
| Early-access requests | When you join the waitlist, your email address, chosen language, signup time, and the notice record associated with your request are sent to our private Supabase waitlist. A version that does not save submissions is labelled as a preview. |
| Account and profile | Email address or phone number, authentication identifiers, profile details, date of birth or age, and preferences you provide. |
| Conversations and uploads | Messages, voice recordings you choose to send, transcripts, images, PDFs, laboratory reports, medical records, and related file metadata. These may contain health information or information about other people. |
| Health and lifestyle information | Symptoms, medical history, medications, supplements, measurements, habits, goals, and information about reproductive or menstrual health that you provide or authorize a connected source to share. |
| Connected health and wearable sources | Source identifiers and authorized records such as activity, sleep, heart rate, heart-rate variability, respiration, oxygen saturation, stress, body measurements, nutrition, and workout details. Some records can include GPS routes, location, or reproductive-health information. Availability depends on the source and permissions. |
| Device location and context | If you allow location access, your coordinates, accuracy, and location context such as an address, city, country, or nearby places. Location context can accompany app requests and inform responses. Your device settings control location permission. |
| Generated information | AI responses, health summaries and inferences, extracted measurements, priorities, goals, plans, reminders, and remembered context. We also create numerical representations of text, called embeddings, to retrieve relevant information. These records can remain personal or health data even without your name. |
| Technical and delivery data | App and operating-system versions, language and time zone, connection and synchronization status, push tokens, notification preferences, delivery records, and operational or security events. AI diagnostic traces can also contain request or response content, including health information. |
| Support correspondence | Contact details and information you send when you ask for help or exercise a privacy right. |
Provide information about other people only when you are entitled to share it. Remove unnecessary names and identifiers from uploaded records where possible.
3. Why we process data and our legal grounds
We use personal data for the following purposes under Ukraine's Law on Personal Data Protection and other applicable requirements.
| Purpose | Ground for processing |
|---|---|
| Create and secure your account, provide requested app features, synchronize records, and answer support requests | Steps you request before entering a service relationship, performance of that relationship, and applicable security duties. |
| Import and analyze health information, generate personalized health guidance, and maintain useful health context | Your separate, specific, unambiguous consent for health-data processing and AI analysis. Ordinary contract necessity alone does not authorize health-data processing. |
| Send requested early-access invitations or optional product emails | Your consent. You can withdraw it without signing up for the app. |
| Protect accounts, investigate abuse, maintain service reliability, and handle ordinary operational diagnostics | Our legitimate interests in a secure, functioning service, balanced against your rights, or applicable legal obligations. We do not rely on legitimate interests alone to process health or other sensitive data. Such processing also requires the applicable additional legal condition. |
| Comply with a binding legal requirement or handle a legal claim | The applicable legal duty or lawful ground for the claim, including any additional condition required for sensitive data. |
We do not sell personal data. We do not use health information or connected wearable data for targeted advertising, data brokerage, or eligibility decisions for employment, insurance, or credit.
This policy explains processing. Reading it, visiting the website, or joining the waitlist does not give consent to health-data analysis or connect a wearable. We request the relevant permissions before consent-based processing starts.
4. AI processing and your choices
AI is part of Roota's mobile health-navigation service. It helps interpret conversations and health records, extract information from documents, transcribe submitted audio, summarize your history, retrieve relevant context, and generate personalized explanations and suggested next steps. Remembered context lets later conversations use earlier information.
Relevant messages, health measurements, documents, audio, and context may be sent to external AI services. We use OpenRouter to route requests to model services. A request can use a fallback service if the primary route is unavailable. The recipients and their roles are described in section 6.
Personalized responses are a form of automated analysis and can include inferences about your health. They can be incomplete or wrong. You can question an output and request correction of inaccurate source information or remembered context. Roota does not use these outputs to make decisions about you that have legal or similarly significant effects, such as deciding insurance or employment eligibility.
We obtain explicit consent before processing your health information, including data from connected health and wearable sources, with AI. The consent notice explains the information used, the purpose, and external recipients. If you decline, features that require that processing are unavailable. You can still browse the public website or join the waitlist under its separate permission.
You can withdraw health-data or AI consent by contacting privacy@rootahealth.com. Withdrawal stops the processing covered by that consent. It does not make earlier lawful processing unlawful. It can prevent personalized app features from continuing. Where consent is the only applicable basis, withdrawal also triggers deletion or irreversible anonymization of affected stored data, subject to applicable legal exceptions. We explain any limited records retained and their legal basis. You can also request deletion of stored records and derived context under section 10.
Roota does not use your health information, including data from Apple Health and other connected sources, to train or fine-tune AI or machine-learning models. We use OpenRouter with routing to providers that train on request data disabled. OpenRouter's optional input/output sharing for product improvement and private input/output logging are also disabled for our account. These settings apply to model requests through OpenRouter. They do not mean that every service provider retains no data. Generating a response for you and maintaining your personal context are different from training a model. Provider handling and retention are explained in sections 6 and 8.
5. Connected health services and wearables
To use the Roota app, you need to connect Apple Health or another supported health service or wearable device. Access requires your device's health permissions or the source's authorization flow. We receive the categories that the source makes available under your permissions. Roota uses Terra API to connect supported sources and deliver authorized records.
Roota uses authorized Apple Health and other connected-source records for your requested health-navigation features, such as reviewing activity, sleep, recovery, and trends. We do not receive passwords for your connected accounts.
Permission to connect a source or grant device health access and permission for Roota's AI analysis are distinct. A source's authorization screen or your device's health permissions do not replace Roota's health-data and AI consent notice.
To stop importing new records, disconnect the source through the app's connected-services controls or revoke access through the source's own settings, where available. You can also contact us. Device health permissions can be changed in your operating-system settings. Disconnection does not itself delete information already imported into Roota, derived summaries, or your account with the source. Request deletion separately under section 10.
Apple and other source providers handle their own accounts and original records under their own policies. See Apple's Health privacy information and Terra's end-user privacy policy.
6. Who receives personal data
Authorized Roota personnel may access data when needed to operate the service, respond to your request, or investigate a problem. Access is limited by role and purpose. Service providers receive the information relevant to their task.
| Recipient or service | Role and information involved |
|---|---|
| Supabase | Account authentication, database, private file storage, and backend functions. This includes account details, conversations, health records, and connected-source records. |
| Twilio | Delivery of phone verification codes for account authentication. Receives your phone number, verification-message content, and associated delivery information. |
| Railway | Hosting and operating the AI backend that processes app requests. |
| Vercel | Public website hosting and request metadata. A compatibility endpoint also forwards traffic from older app versions. |
| Terra | Supported health-source authorization, connection identifiers, and delivery of authorized wearable or health records. |
| OpenRouter and downstream model-hosting services | Relevant text, health context, files, or audio for inference, document extraction, transcription, embeddings, and context retrieval. Chat and memory features use models developed by OpenAI, Google, xAI, Anthropic, and Moonshot AI as relevant to the feature, including fallback models. OpenAI embedding models support retrieval of relevant context. A model's developer and the company serving a request can differ. The hosting service can vary with the selected model and fallback route. |
| ElevenLabs models through OpenRouter | Speech-to-text transcription. Submitted voice recordings and associated request information are processed to produce text transcripts. |
| E2B | Isolated computation for requested analysis. A computation can receive relevant health-query results and temporary files. |
| Exa | Web search and page retrieval. Search text can contain personal context when it is necessary for a requested search. Exa's handling of query data depends on the applicable service terms and can include retention and use for service or model improvement. The OpenRouter settings described in section 4 do not apply to Exa. |
| Expo and the applicable Apple or Google notification services | Push tokens, delivery information, and notification content. A notification can contain an excerpt of a response and reveal health information on your lock screen. |
| Apple mapping services | Coordinates used for nearby-place lookup when the relevant location feature is used. |
We remain responsible for selecting and controlling the processing we arrange. OpenRouter routing does not make downstream model services anonymous or remove their role in processing your information. Some providers retain request content or metadata under their applicable agreements. Our permitted routes must meet the restrictions described in this policy.
We may disclose information when legally required or necessary to establish, exercise, or defend a legal claim. A company reorganization or transfer may involve personal data only with the safeguards, notices, and legal grounds required by applicable law. A business change does not create permission to train models on your health data or use it for unrelated purposes.
7. International processing
Your data can be processed in Ukraine and other countries where the services listed above operate. The location depends on the service, selected model-hosting provider, and infrastructure used for the relevant request. A European backend host does not mean all data stays in Europe.
For international transfers, we use a route permitted by Ukrainian law and apply the protections required for the transfer. Contact us for information about the recipients, processing locations, legal grounds, and safeguards that apply to your data.
8. Retention and deletion
We keep personal data only for as long as needed for the purposes described in this policy and applicable legal requirements. We use the following retention criteria:
| Data | Retention |
|---|---|
| Website email preview | In a version labelled as a preview, the email remains only in the current page session and is cleared when the page reloads. The preview does not create a waitlist registration. |
| Early-access waitlist | We keep your email and signup record while needed to arrange and send the early-access invitation you requested, or until you withdraw your request. The limited legal-record and backup criteria below also apply. |
| Account, conversations, uploads, imported health records, generated insights, and personal context | For the duration of your service relationship while needed for the purposes described in this policy, subject to earlier deletion or consent withdrawal. We retain limited records afterward only where required by law or necessary to establish, exercise, or defend a legal claim. |
| Submitted audio and temporary analysis files | Submitted audio and uploads follow the rules for their associated conversation or account record. Transcription alone does not delete the original audio. Temporary copies follow the processing and retention arrangements applicable to the service performing the analysis. |
| Operational, security, support, and consent records | For the time necessary to resolve the relevant matter, document permissions and requests, and meet applicable legal duties or establish, exercise, or defend a claim. We assess the record's purpose, sensitivity, and applicable legal or limitation periods. |
| Backups and provider-held copies | Backup copies may remain until the applicable backup cycle expires. Provider-held content and metadata follow the relevant provider's retention arrangements and applicable legal obligations. A record disappearing from the app does not establish that every backup or provider copy has been erased. |
Deleting an individual chat item, correcting remembered context, disconnecting a source, signing out, and uninstalling the app have different effects. They do not automatically erase every server record or a provider's original records. An account-data deletion request covers associated imported data and derived personal context, subject to a specific lawful retention exception.
If we must retain a limited record, we explain the reason and applicable period. Restricted backup copies remain protected until expiry and are not used to restart ordinary processing. Deleting data from Roota does not delete originals in Apple Health, another connected source, or a copy you previously exported or shared.
9. Security, device storage, and notifications
Our controls include authenticated access, restrictions between users' records, and private file storage. We restrict operational access to personal information. No internet service or device is completely secure.
The app keeps local copies of some information so that it can display and synchronize your records. Protect your device with its available security controls. Signing out or removing a local copy does not by itself delete server records.
You control notification permission and lock-screen previews through your device settings. Notifications and any enabled Live Activity can reveal information to someone who can see your screen. Health-related delivery content may also pass through the notification services described in section 6.
10. Your rights and how to contact us
Depending on the law that applies, you can ask us to:
- Explain the source, purposes, recipients, and handling of your personal data.
- Provide access to your data and a copy, including a portable copy where that right applies.
- Correct inaccurate information, including stored health context.
- Delete personal data, subject to a lawful exception.
- Consider your reasoned objection to processing and restrict processing where the law provides.
- Withdraw consent for health-data analysis, AI processing, or optional emails.
- Explain automated analysis and consider your challenge to an inaccurate result.
Send requests to privacy@rootahealth.com. For app records, use your account email or identify the account safely. Do not send a full medical record or password to prove your identity. We may request proportionate verification and respond within the period required by applicable law. If a request cannot be fulfilled in full, we explain the reason and available next steps.
You can complain to the Ukrainian Parliament Commissioner for Human Rights or seek protection of your rights through a competent court.
11. Cookies and website storage
The website uses a fixed, authored conversation. Joining the live waitlist sends the registration information described in section 2 to Supabase. A version labelled as a preview keeps the email only in page memory and clears it when the page reloads.
Our website does not use advertising pixels, session replay, or optional analytics. Our hosting services can still process request metadata and apply security mechanisms, which can involve cookies or similar storage. Hosting records follow the operational and security retention criteria in section 8 and the hosting service's applicable retention arrangements.
We explain any new optional tracking before enabling it and request permission where required. Joining the waitlist does not authorize unrelated marketing or health-data processing.
12. Age, updates, and contact
Roota's initial service is intended for adults aged 18 and over located in Ukraine. It is not intended for children. If you believe a child has provided data, contact us so we can investigate and take appropriate action.
We update this policy when our processing changes. The date at the top identifies the current version. We give appropriate notice of material changes through the website, app, or account contact. If a new purpose requires consent, we request it before that processing starts. Continued use alone does not replace required consent.
Privacy questions and requests: privacy@rootahealth.com.