Your health information is yours. Here is how we keep it safe.
AI helps. People decide. Your information is never sold or used for ads. This page says, in plain words, who sees what, where it goes and what you can ask us to do.
Last reviewed 2026-05-26
AI helps. People decide.
The AI prepares and suggests. Anything that could change your care waits for a person first.
A person checks the big things
Changes to medicines, targets and treatment plans wait until a qualified professional approves them.
You confirm what is yours
Nothing is saved about you until you say yes. You see what the AI understood before it counts.
Clear limits
The AI never diagnoses and never replaces your professional. When something sounds serious, it points you to people and to emergency help.
How your health information moves
Your health information follows strict rules. Here is where it goes and how it is protected at each step.
It stays in protected storage
Your records are kept in secure storage. Messages, medical notes, mental health notes, lab results and session recordings get an extra lock on top.
A safety gate stands in front of every AI request
Before anything reaches an outside AI company, the gate removes what could identify you. Companies without a signed agreement never receive your health information.
Everyone sees only what their role needs
A professional sees only their own patients. You see only your own information. Anything marked as health information is kept away from companies without an agreement.
Only authorised staff can change which AI is used
Every AI feature has an owner on our team. We record whether health information may be used with it, and we flag any gap.
Locked, twice
How we lock your information
Managed keys, kept apart from the data
The keys that unlock your information live in a separate, certified key service. They are never stored next to your records.
A new key for every piece
Each piece of sensitive information is locked with its own key, and that key is locked again by the key service. Someone who got hold of the stored records alone could not read them.
Connected accounts are locked too
When you connect an outside account, such as a calendar or a wearable, the access we hold is stored locked and used only for what you allowed.
Access rules in every record
The rules about who may see what are built into the storage itself, so a bug on a page cannot open someone else's records.
Companies that help us run METABO AI
A business associate agreement (BAA) is a contract that legally binds a company to protect health information. This table shows which companies have one with us, and what we send them.
AI companies
| Company | Agreement | Receives health information | What it is used for |
|---|---|---|---|
| Anthropic (Claude) | Pending signature | No | Understanding requests and clinical reasoning. Health information is blocked until the agreement is signed. |
| OpenAI (GPT-4o and Whisper) | Pending signature | No | Assistant reasoning and voice to text. Health information is blocked until the agreement is signed. |
| OpenRouter | No agreement available | No | Development gateway to AI models. Never receives health information; the gate enforces it. |
| Kie.ai | No agreement available | No | Creative helper tasks. Never receives health information; the gate enforces it. |
Other services
| Company | Agreement | What it is used for |
|---|---|---|
| Supabase (business plan) | Agreement signed (business plan) | Our main storage: accounts, sign-in and records. All health information lives here. |
| AWS Key Management | Agreement signed | Holds the keys that lock sensitive fields. |
| VAPI | Needed before going live | Live voice calls. Recordings can hold health information, so it stays off until the agreement is signed. |
| Composio | Needed before the next stage | Connects calendars and wearables. Verified before any health information flows through it. |
| Resend | No health information in emails | Confirmation and reminder emails. Emails carry no health details. |
| Upstash | No health information stored | Speed limits and background jobs. No health information is kept. |
| Stripe | Payments only | Payments only. No health information is shared. |
| Sentry | No agreement available | Error reports. Personal details are removed before anything is sent. |
| Slack and Discord | No agreement available | Team notifications with short summaries only. Raw health information is never sent. |
Agreement status as of 2026-05-26. “Pending signature” means the company offers an agreement and we are completing it.
Extra care around eating and body numbers
If what you tell us suggests a difficult relationship with food, METABO softens its words, hides numbers that can hurt, and brings your professional in. You can ask us to switch this on at any time.
You always know who did what
Who is behind each answer
Every suggestion says whether it came from the AI or from a person, and a person's approval carries their name.
Items waiting for a professional are answered within the time the professional has set. If it takes longer, you are told.
These always wait for a qualified person: adding or changing a medicine, changing your targets, changing a dose in a weight-loss medicine plan, and anything the safety check marks as a possible crisis. They cannot go ahead until the person approves.
Your rights, in plain words
Refunds
If it is not right for you, you can ask for your money back within the period shown at checkout.
Cancel any time
Cancel in a few taps. You keep access until the end of the period you paid for.
Take your information with you
Ask for a copy of everything we hold about you, in a file you can open.
Delete it
Ask us to delete your account and your information. We confirm in writing when it is done.
Professionals on METABO AI
How professionals are listed
Professionals are listed only after their credentials are checked.
Reviews come from real patients and are shown as written.
Fees are shown before you book. There are no hidden charges.