Privacy Policy

Scope and operator

This policy applies to Calibrate's public website, questionnaire flow, consult flow, saved drafts, authenticated account experience, generated protocol output, customer support, transactional email, security tooling, and related provider operations. Calibrate is operated by Abud Bakri, MD, an individual based in California, who is responsible for the personal information described in this policy. The service is offered as a direct-to-consumer educational wellness product; for any privacy request, contact support@calibrate.day.

• Calibrate is designed for adults using educational wellness guidance.
• If you are under 18, do not use Calibrate or submit personal information.
• If you use Calibrate on behalf of another person or organization, you represent that you have authority to do so.

Not for emergencies

Calibrate is not for emergency or urgent medical needs. Do not use the site to seek urgent care, crisis support, diagnosis, or treatment instructions. If you may have a medical emergency, call emergency services or contact a qualified clinician.

Information we collect

We collect the information needed to operate, secure, and support the Calibrate experience.

• Account and identity data such as email address, authentication provider identifiers, session state, and login verification metadata.
• Questionnaire, consult, and protocol data such as wake and sleep timing, light access, caffeine timing, midday reset choices, evening routine inputs, environment constraints, symptom-like goals, plan choices, generated protocols, and calendar-style output.
• Technical, security, and diagnostic data such as IP-derived request metadata, browser and device information, timestamps, CSRF state, rate-limit and abuse-prevention signals, signed webhook metadata, and anti-bot challenge tokens where enabled.
• Support and communications data such as transactional email records, delivery, bounce, and complaint events, contact requests, and consent-event logs.
• Limited analytics data such as privacy-scrubbed page and product events, the traffic source that brought you to Calibrate (a channel category such as a search engine, social network, AI assistant, or email, plus any campaign tags carried in the link), and, when they are available, your country and device type, together with performance measurements and error reports. For the emails Calibrate sends, we can record when a message is opened and when a link in it is clicked; whether a message is tracked this way is set when the message is queued to send, from whether analytics is allowed for you at that time, so a message queued before you turn analytics off can still be tracked. Analytics never includes the contents of your questionnaire or consult answers.

Consumer-health and HIPAA boundary

Calibrate treats questionnaire answers, consult answers, saved protocols, generated guidance, and related timing plans as sensitive consumer-health or health-adjacent data. The current website is positioned as direct-to-consumer educational wellness guidance, not as a HIPAA-covered patient portal or formal provider-care workflow.

• Calibrate does not currently ingest HealthKit, Apple Health, Health Connect, Google Fit, wearable, sleep-tracker, EHR, provider-record, insurance, pharmacy, lab, or medical-record data.
• Calibrate does not create a physician-patient relationship unless a separate formal care process is created and completed outside this current website flow.
• Any future external health-record, wearable, lab, provider, or medical-data integration requires a separate legal, security, and architecture review.
• Questionnaire and protocol data must not be sent to advertising pixels, lookalike audiences, retargeting systems, affiliate networks, product merchants, or analytics providers for ad targeting.

How we use information

We use personal information for product, security, support, and legal purposes that match a wellness-planning service.

• Provide the questionnaire and consult flows, generate guidance, save drafts and protocols, and let you access account-linked output.
• Authenticate users, send magic links or other account-related messages, and maintain service continuity.
• Protect the service against abuse, fraud, unauthorized access, and reliability incidents.
• Measure product performance, debug issues, and improve the quality of the Calibrate experience without turning sensitive questionnaire answers into ad-targeting inputs.
• Queue and send transactional email that you request or that is needed to operate the product.
• Comply with legal obligations, resolve disputes, enforce our terms, and maintain business records.

Cookies, local storage, analytics, and tracking

Calibrate uses necessary cookies and limited browser storage for security, authentication, draft ownership, CSRF protection, and non-sensitive UI state. Analytics is configured to avoid sensitive content.

• The consult flow keeps your questionnaire and consult answers in memory and in server-side draft or account storage, not in browser local or session storage, and generated protocols are not stored in browser storage.
• The short homepage quiz is the exception: while you answer it, your in-progress answers (the symptoms you select, wake and sleep times, schedule steadiness, and outdoor-light answer) are kept in your browser's session storage so a refresh does not lose them. A plan you continue from Claude or ChatGPT can also stage your wake time, sleep time, and other prefill answers in session storage, in that tab only. The in-progress quiz answers stay until you finish the quiz or close the tab. Answers handed to the consult, from the quiz or from Claude or ChatGPT, are staged for up to 30 minutes, are removed once the consult reads them, and are ignored after 30 minutes if they are not read. Session storage clears when you close the tab. The Cookie and Analytics Notice lists these storage keys.
• Analytics allows only scrubbed event names and safe properties; it must not include form contents, questionnaire answers, health labels, emails, tokens, or protocol details.
• Analytics records the traffic source bucket and any campaign tags and, when they are available, your country and device type; an event our server records because of something you did on the site, such as starting a plan, can include your country but not a device type, and events for the emails Calibrate sends and for the ChatGPT or Claude plugin carry neither a country nor a device type. For the emails Calibrate sends, whether we record opens and link clicks is set when each message is queued to send, from whether analytics is allowed for you at that time, so a message queued before you turn analytics off can still be tracked; the scheduled 40-day program emails are sent through a provider that records no opens or link clicks. It never includes questionnaire or consult answers. PostHog is the analytics processor, reached through a first-party relay rather than a browser library.
• Calibrate loads no PostHog browser library, no session replay, and no autocapture. The browser sends only a small allowlist of event names and safe properties to Calibrate's own server, which forwards a scrubbed event to PostHog.
• Sentry is configured with PII collection off, replay sample rates set to zero, and event scrubbing before send.
• Calibrate does not currently run ad pixels, retargeting, or behavioral advertising scripts. Those must not run on health intake, admin, authenticated, questionnaire, consult, or protocol pages.

Calibrate in ChatGPT and Claude

Calibrate offers a plugin that works inside ChatGPT and Claude. It lets you ask for a light, caffeine and sleep-timing schedule without leaving the conversation. This section explains what the plugin receives and what happens to it. Everything else in this policy and in the Consumer Health Data Privacy Policy applies as well.

Service providers and infrastructure

Calibrate uses service providers to host, secure, authenticate, store, email, monitor, analyze, and back up the service. Provider use depends on which features are enabled.

• Vercel hosts the Next.js app and may provide Blob storage and AI Gateway services when those features are enabled.
• Neon stores application data in Postgres, including account mappings, drafts, questionnaire submissions, protocols, jobs, email metadata, affiliate ledger records, audit records, and file metadata.
• Clerk provides authentication, sessions, and user lifecycle webhooks.
• Postmark sends transactional email and returns delivery, bounce, complaint, and related email events.
• Trigger.dev queues durable background jobs such as email work, cleanup, backup checks, and future reconciliations.
• Upstash Redis may provide distributed rate limits, replay locks, and temporary abuse counters.
• PostHog may receive privacy-scoped product events. Sentry may receive scrubbed error and performance events.
• Cloudflare Turnstile, WAF, DNS, or R2 may support bot protection, edge controls, and backup storage depending on the production configuration.
• Vercel AI Gateway and model providers are disabled unless AI guidance is intentionally enabled after review.

Who we share information with

We do not sell questionnaire responses, consult answers, protocol content, or consumer-health data. We do not share those records for third-party advertising, retargeting, lookalike audiences, or ad pixels. We share information only with service providers and recipients needed to operate Calibrate.

• PostHog and Sentry must not receive raw questionnaire answers, protocol JSON, prompt content, email addresses, raw IP addresses, or other sensitive user-submitted health context.
• Affiliate redirects may use a server-generated click ID for attribution, but not questionnaire answers, protocol content, health labels, email addresses, or raw IP addresses.
• Professional advisers, auditors, insurers, or law-enforcement or regulatory recipients where disclosure is legally required or reasonably necessary to protect Calibrate or others.
• A buyer, investor, or corporate successor in connection with a merger, financing, acquisition, reorganization, or asset sale, subject to appropriate confidentiality and transfer controls.

Retention

We keep information only for as long as reasonably needed for the purposes above, then delete, de-identify, or isolate it under our operational and legal retention rules. Account deletion is designed to remove saved questionnaire and protocol records while retaining only narrower operational records where needed.

• Anonymous questionnaire drafts are removed 180 days after they go inactive, and a draft you claim to an account is removed 365 days after it was last updated. Short-lived security and rate-limit records, such as abuse counters and idempotency keys, are removed within 14 days, and many expire much sooner.
• Saved questionnaire submissions, generated protocols, protocol events, and related email job payloads tied to an authenticated account are deleted when account deletion is processed through the backend account-deletion flow.
• Retained account and authentication records are minimized where feasible, such as clearing stored email fields while preserving narrow tombstone records needed to prevent stale provider events from recreating deleted users.
• Consent logs, audit records, diagnostic records, support records, email-delivery records, affiliate/accounting records, and security records may be retained where needed for fraud prevention, legal compliance, dispute resolution, accounting, or audit integrity.
• Backups and replicated infrastructure may preserve snapshots for limited periods after deletion requests, after which those backups are rotated out or overwritten in the ordinary course.
• If you request deletion, we will process the request in line with our systems and retention obligations, but we do not promise immediate erasure from every backup, provider log, delivered email copy, or legally retained record.

International transfers and security

Calibrate and its providers may process information in the United States and other countries that may not offer the same legal protections as your home jurisdiction.

• Where required, we rely on appropriate transfer mechanisms and contractual safeguards for international processing.
• We use reasonable administrative, technical, and organizational safeguards designed to protect information, including transport security, access controls, logging, secret management, provider scoping, request validation, rate limits, webhook verification, and redaction.
• No system is perfectly secure. You should use a strong email account, protect your authentication links, and avoid sharing account access with others.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, appeal, or withdraw consent for certain processing. California residents may also have rights under California privacy law if Calibrate meets applicable thresholds or if sensitive personal information rules apply.

• You can contact support@calibrate.day to request access, correction, deletion, export, or another privacy-rights workflow.
• Calibrate does not sell personal information or consumer-health data. If a future feature creates a sale, share, or targeted-advertising opt-out right, Calibrate must update this policy and the Privacy Choices page before enabling it.
• Where consent is the basis for processing, you may withdraw that consent, although some product features may stop working if the processing is required to operate them.
• If you are in the EEA or UK, you may also complain to your local supervisory authority. UK users may complain to the Information Commissioner's Office.

Incident and breach notices

If Calibrate identifies unauthorized access, acquisition, disclosure, or use involving personal information or identifiable consumer-health data, Calibrate will investigate, preserve evidence, involve appropriate providers and advisers, and evaluate notification duties under applicable breach, consumer-health, and privacy laws.

Marketing email and your 40-day transformation

Choosing “Start my 40-day transformation” starts your 40-day transformation emails and lets us use your answers to choose which products we show you. We never share your answers with the merchants. Choosing “Just send my plan” sends only your plan email, with no program emails. You can stop the program or the product picks at any time from your settings or with one tap in any email.

• Before you open the emailed quick-plan link, we keep your email address for up to 7 days. Your quick answers are saved as a draft so the link can fill them in, and a draft you never use is deleted after 180 days without activity. The quick-plan link expires after 24 hours; program and check-in links expire after 48 hours.
• The sign-in link that opens your plan is single-use. Opening it uses it up, so it cannot be used again.
• Every marketing email includes one-click unsubscribe and a valid physical postal address, and unsubscribing takes effect promptly.
• Some product links earn Calibrate a commission. Any product recommendation discloses that material connection before you click.
• You can turn marketing email on or off at any time in your settings, or unsubscribe from any marketing email.

Answer-based personalization

When you choose “Start my 40-day transformation”, Calibrate uses your questionnaire answers to choose which tips and products you are shown. Choosing “Just send my plan” does not turn this on.

• With your personalization consent, we use the concerns you picked in the questionnaire (for example, trouble falling asleep, feeling wired at night, or morning fog) on our servers to choose which product suggestions to show you. These answers stay on our servers and are not sent to the email provider; the provider only receives the suggestions we choose.
• You can stop answer-based personalization at any time in your settings, separately from the program emails. After that, your suggestions are general and are no longer chosen from your answers.
• This use of consumer-health-related information for a purpose beyond the requested service is covered by the Consumer Health Privacy Notice.

Email service provider

Calibrate uses an email service provider to send and manage marketing email. It acts as a processor under contract and receives only what is needed to deliver the program.

• The provider may receive your email address, first name, timezone, program day, consent flags, and the plan output times shown in the email.
• The provider never receives your raw questionnaire answers, free text, symptom names, safety-screen answers, or protocol JSON.
• Unsubscribe and complaint signals from the provider flow back into Calibrate's suppression records so a withdrawn consent stays withdrawn.

Changes to this policy

We may update this policy as Calibrate evolves. When the changes are material, we will update the date above and may provide an in-product or email notice where appropriate.