Is my health data safe in MoraHealth? Access, download and deletion

In MoraHealth, only you and the people who accepted your sharing invitation can see your health records; your data is never sold or used for advertising, and you can download or delete all of it at any time. This post explains in plain language how your data is protected, where it goes, and what rights you have over it.

For an overview of MoraHealth, see What is MoraHealth?

Who can see your records?#

• You. Your records are tied to your account.
• The person you share with. If you share a profile by email invitation, the person who accepts it with their own account can see that profile's records. You can stop sharing at any time. See Profiles and sharing.
• No one else. Your records are not opened to other users, advertisers or data companies.

How is your data protected?#

• Encrypted connection: all traffic between the app and the server goes over HTTPS.
• Your password cannot be read: it is never stored as written; it goes through a one-way transformation that cannot be reversed.
• Bot protection: for sign-in, sign-up and password resets, the request is checked to come from a real person — Cloudflare Turnstile on the web, Apple App Attest on iPhone. This check does not cover your health data.
• Attempt limits: many failed sign-in attempts in a short time are blocked.
• No tracking: the website uses only the cookies needed to keep you signed in; there are no advertising or analytics cookies, and no tools that track visitors, such as Google Analytics. On the public pages (home, blog, About), only aggregate visit counts are kept, with Cloudflare Web Analytics, which uses no cookies; nothing is measured on the screens after you sign in.

Where is your data sent?#

To run MoraHealth, your data is processed on the infrastructure of hosting, database, email and network security providers. Beyond that, your health data is sent to our AI provider in only two cases:

1. When you upload a report, if the file needs to be processed by AI so its details can be read.
2. When you ask for an AI summary, only the report you chose and what is needed to interpret it.

Both times you are asked for your approval first; if you do not approve, nothing is sent. The provider does not use this data to train its own products. To see exactly what is sent, read What does MoraHealth's AI summary analyze, and what not?

If you would rather not use AI at all, you can enter your reports by hand and never ask for a summary; the rest of MoraHealth works the same.

Your uploaded files are not stored#

When you upload a PDF or photo, the file itself is not stored permanently on the server. It is processed only to read the details; what is saved is the information you approved.

Downloading all your data#

Use Download my data in Account Settings to request a copy of all your records:

1. A download link is sent to your registered email address.
2. When you open the link, you are asked to sign in with your email and password; the file downloads only after you sign in.
3. For your security, the link is valid for 24 hours.

The ZIP file contains your profiles, your reports and their values, AI summaries, and your medication, appointment, vaccination, condition, allergy, operation, pregnancy and measurement records, in a machine-readable format. It is meant for moving your data to another service or keeping your own backup.

For a readable summary to show your doctor, My Health Summary PDF is the better fit.

Deleting records and your account#

• One by one: you can delete a report, a medication, a reading, an AI summary or a profile you added at any time.
• Your whole account: when you choose Delete My Account in Account Settings, a confirmation link is sent to your email (valid for 1 hour). Once you confirm, your account and all the data tied to it are permanently deleted. Nothing is deactivated or archived; it cannot be undone.

We recommend downloading your data before you delete it.

Your data protection rights#

MoraHealth is operated in line with data protection law, including the GDPR for users in the European Union and the United Kingdom. Because health data is a special category of personal data, separate consent is asked when you create your account for keeping it in your account.

To exercise your rights to access, correct, delete, port or object to the processing of your data, write to info@morahealth.co; requests are answered within 30 days. All the details are in the Membership Agreement and Privacy Notice.

In short#

No system is 100% secure. If a security breach affects your data, the relevant authority and the affected users are notified within 72 hours of it being discovered.