Privacy.

Aevox is a product of Funspan LLC (“Aevox,” “we,” “us”). This policy explains what we collect, why, and what your options are. It applies to aevox.health, the Aevox clinic application, and the Aevox athlete platform.

1. What we collect

• Contact information you submit. If you email us or fill in a form (pilot application, sample-report request, FAQ question), we receive your email address and whatever you put in the message.
• Athlete test data, entered by a clinic. When a performance center or clinic uses the Aevox clinic application, it enters the athlete's name, sex, and birth year, uploads the metabolic-cart export, and commits a report. We store that record on the clinic's behalf: the identifying fields, the test date, the full analysis, the clinician's note, the original export file, and an email address if the clinician enters one. We treat all of this as sensitive health data.
• Athlete test data, shared by you. If a clinic sends you a link to your report and you choose to continue to the Aevox athlete platform, your browser sends the report to us together with a record of the consent you gave: the exact sentence you agreed to, when you clicked, and the network address and browser you used.
• De-identified research analytics. With the clinician's opt-in, we keep a copy of the physiological data from each test with the name, exact age, exact date, and file name removed and a server-side check that rejects any identifying field. We use it to improve threshold detection.
• Anonymous site analytics. We use Vercel Analytics (cookieless, IP-anonymized) to understand which pages visitors read and to find broken links.

2. What we do not collect

• No tracking cookies, no third-party advertising pixels, no session-replay tools.
• No fingerprinting (browser, hardware, IP geolocation beyond country-level for analytics).
• No selling, renting, or sharing of personal data with third parties for marketing.

3. How we use information

• To respond to you when you contact us.
• To produce and store test reports for the clinic that entered them.
• To show you your own report and, if you opt in, longitudinal analytics and fueling guidance on the athlete platform.
• To improve threshold detection using de-identified data only.

Two steps use the Anthropic API: threshold detection and drafting the clinician's note. Those requests carry physiological values, age, and sex. They never carry a name, identifier, email, date of birth, test date, or file name.

4. Health-data handling

Athlete test data is stored on US infrastructure, encrypted in transit and at rest, and is never used to train shared models or to improve another clinic's output. Each clinic can see only its own records. Aevox staff can read records across clinics for quality review and support.

HIPAA. Aevox is not a HIPAA covered entity and does not hold Business Associate Agreements with its infrastructure providers. Our customers are performance centers and cash-pay clinics that are not covered entities, so HIPAA does not govern their data; state consumer-health-data laws and federal consumer-protection rules do, and this policy is written for them. A clinic that is a covered entity, for example one that bills insurers electronically or sits inside a hospital system, must tell us before onboarding so the required agreements can be put in place first. We do not describe Aevox as “HIPAA compliant.”

Sharing to the athlete platform happens only when the athlete ticks a consent box and clicks “Continue with Aevox” on their own report page. That consent is recorded with the transfer and kept with the athlete's account.

5. Data retention

• Marketing-site contact submissions: 24 months, then deleted unless an active relationship exists.
• Clinic test records: for the duration of the clinic's subscription plus 30 days, or sooner on the clinic's request.
• Reports shared to the athlete platform but never claimed: 30 days.
• Athlete platform accounts: until you delete your account or ask us to.
• De-identified research analytics: retained; deleted on request.
• Anonymous site analytics: aggregated; raw events expire within 30 days.

6. Your rights

You can request a copy of any personal data we hold about you, or ask us to delete it, by emailing jack@aevox.health. We respond within 30 days. If your test data was entered by a clinic, the clinic controls that record; we will act on the clinic's instruction and will also honor your request directly where the law requires it. Data you shared to the athlete platform yourself is yours to delete at any time.

If we learn that your identifiable health data was accessed without authorization, we will notify the clinic within 72 hours of confirming it, and will notify you directly if you hold an athlete platform account.

7. Subprocessors

We use the minimum set of infrastructure providers, all in the United States:

• Vercel — hosting and serverless compute
• Vercel Analytics — anonymous site analytics
• Neon (via Vercel Postgres) — encrypted database storage for clinic records and the athlete platform
• Clerk — clinician and athlete authentication (email and name only)
• Anthropic — AI-assisted threshold detection and note drafting on de-identified physiological data
• Stripe — clinic billing (no athlete data)

Subprocessor changes are announced at least 30 days in advance to clinic customers.

8. Children

The marketing site and the athlete platform are not directed at children under 13. Clinics may test minors; the clinic is responsible for obtaining a parent or guardian's consent before entering a minor's data, and we process it only on the clinic's behalf.

9. Changes

We'll post a changelog at the top of this page when we update material terms, and notify clinic customers directly.

10. Contact

Questions or requests: jack@aevox.health. Funspan LLC operates Aevox; the registered entity is reachable at the same address.