PRIVACY & SECURITY

Your data, your account

NizHealth is designed to keep account and health information behind authentication. The AI receives only the authenticated user's context prepared by the server.

Authentication

Passwords are stored as secure hashes. Sessions use HttpOnly cookies, CSRF protection, idle timeouts and session ID rotation.

Health information

Your health records are associated with your account and application queries are scoped to the authenticated user. Uploaded medical documents are stored outside normal public browsing and are protected by ownership checks.

AI boundary

Provider credentials and the private AI-service token stay on the server. The AI is instructed to treat health records and user messages as data, not as instructions that can override its safety rules.

Medical safety

The AI provides educational and record-based support. It is not a doctor, diagnostic system, emergency service, or replacement for professional care.

Security responsibilities

Use a unique strong password, keep your devices secure, and contact the service operator if you suspect unauthorized access. Production operators should configure HTTPS, private PostgreSQL access, secret rotation, backups and monitoring.