Draft template. This document is a starting point prepared for Casa Elev8. Have it reviewed by qualified legal counsel for your jurisdiction (Costa Rica, and the United States if you serve U.S. patients) before relying on it.

Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Casa Elev8 / Elev8 Health ("we," "us," "the clinic") collects, uses, stores, and protects your personal and health information when you use the HealthSync patient application and related services (the "Service"). We take the privacy of your health information seriously.

1. Information we collect

Account information — your name, email, phone, and login details.
Health and intake information — your intake questionnaire, medical history, goals, symptoms, and similar details you provide.
Clinical information — scans and their findings, lab results, your care plan, progress logs, vitals, appointments, and notes from your care team.
Billing information — invoices, payment method and status, and receipts. Card payments are processed by our payment provider; we do not store full card numbers.
Usage information — basic technical data needed to operate and secure the Service.

2. How we use your information

To provide your care, manage your program, and let you and your care team track progress.
To schedule appointments and send appointment reminders (which never contain medical details).
To prepare and manage invoices, receipts, and payments.
To secure the Service, maintain audit records of access to health data, and meet legal obligations.

3. Legal basis and consent

We process your health information to provide you care and with your consent, and as permitted or required by applicable law — in Costa Rica, the Law on the Protection of Persons regarding the Processing of their Personal Data (Ley N.° 8968) and its regulations, overseen by the Agency for the Protection of Data of Inhabitants (PRODHAB). Health information is treated as sensitive data and is processed only with your informed consent or as the law otherwise permits. You may withdraw consent at any time (see Your rights); withdrawing consent may limit our ability to provide the Service.

4. How we protect your information

Data is encrypted in transit (TLS) and at rest.
Access is governed by row-level security so each patient can only see their own records, and staff only the patients they are authorized to treat.
Access to health data is recorded in audit logs. Staff accounts support multi-factor authentication.
Reminder and notification emails never include protected health information.

5. Who we share information with

We do not sell your information. We share it only:

With your care team at Casa Elev8, to provide your care.
With service providers who help us run the Service under contract and confidentiality obligations — currently our hosting and database provider (Supabase), application hosting (Vercel), transactional email (Resend), and payment processing (Stripe). These providers process data only on our instructions.
When required by law, or to protect the rights, safety, and security of patients and the clinic.

6. International data transfers

Some of our service providers process data on servers located outside Costa Rica (including the United States). Where this happens, we take steps intended to keep your information protected to the standard described here.

7. Your rights

You can, at any time:

Access and download your data — from the Privacy screen in the app.
Request correction of inaccurate information — ask your care team.
Delete your account and request deletion of your data — from the Privacy screen, subject to records we must retain by law.
Withdraw consent or object to certain processing.

8. Data retention

We keep your information for as long as you are a patient and for any additional period required by applicable medical-records and tax laws. After that, we delete or anonymize it.

9. Children

The Service is intended for adults. Minors should use it only with the involvement of a parent or guardian and the clinic.

10. Changes to this policy

We may update this policy. We will post the updated version here with a new "last updated" date and, where appropriate, notify you.

11. Contact us

To exercise your rights or ask a privacy question, contact Casa Elev8 at info@elev8.health. If you are in Costa Rica, you also have the right to lodge a complaint with the national data-protection authority (PRODHAB).