Data Handling Policy
Portico Life, Inc. · Version 1.0.2 · Effective 09.25.2026
Purpose
This policy shows, in more technical detail, how Portico classifies, processes, stores, and deletes your data, so you can see exactly how it is protected. It supplements our Privacy Policy and is written for you, our partners, and anyone reviewing how we work.
01 · Scope
This policy covers all data handled by the Service: the Portico mobile app, porticolife.ai, and our related services and integrations, as defined in our Terms of Service.
02 · Data Classification Framework
Every piece of data Portico holds belongs to one of four tiers. Each tier has its own rules for how it is handled, stored, and sent.
Name, email, account and device IDs. Our highest protection level. Your email and sign-in are kept in a separate system from your health data, by design.
Readings, reports, meals, and vitals. Encrypted in transit and at rest, at all times.
Scores, trends, and protocols. Linked to your account, and shared only with the service providers that help deliver them.
De-identified patterns across many people. Can’t be linked back to you; used to make Portico better for everyone.
03 · How Your Data Is Processed
Portico reads your reports, meals, and voice entries with its own AI models, and, where it serves you better, with models from top, trusted providers. This is the path your data takes:
On Your Phone
You add or connect data in the app. Whatever your phone can do well happens there: your phone’s own speech recognition turns voice into text, and your privacy choices take effect before anything is sent.
Encrypted Transfer
Your data travels to Portico’s cloud over TLS 1.2 or higher.
Identifiers Stay Out
We never add your personal identifiers (Tier 1) to what we send to AI models. For extraction of markers from your uploaded PDFs and images, those files are read as-is.
AI Processing
Portico’s own AI models, and models from top, trusted providers, turn your data into readings, scores, and trends. Neither may use your data to train AI models unless you turn on model training.
Stored as Insights
Results are stored as Derived Insights (Tier 3), linked to your account and encrypted at rest.
04 · Local First, Cloud Where It Helps
On Your Phone
Portico keeps a recent copy of your data on your phone, so it opens fast and asks the cloud less. That copy is protected by your phone's own security.
In the Cloud
Your health data, reports, and history are stored in our cloud, so Portico can see long-term trends and keep your data safe if you lose or change your phone. It is protected by:
- —AES-256 encryption at rest
- —TLS 1.2 or higher in transit
- —Your account can reach only your own data
- —Email and sign-in kept in a separate system from your health data
- —Access to personal identifiers limited to the few people who need it to run Portico
05 · Data Retention
| Data | How Long | When It’s Deleted |
|---|---|---|
| Health history (Tier 2 and 3) | While your account is open | Within 30 days of deleting your data or account |
| Personal identifiers (Tier 1) | While your account is open | Within 30 days of deleting your account |
| Crash reports and product analytics | Only as long as they help us fix and improve Portico | Rolling |
| Voice audio, full birth date, precise location | Never kept | We never have them |
| Anonymised patterns (Tier 4) | May be kept | Can’t be linked back to you |
| Backup copies | Up to 90 days | Rolling purge |
| Legal holds | As the law requires | When the obligation ends |
06 · If Something Goes Wrong
Stop the breach. Isolate affected systems. Assess what happened and what data is involved.
Find the root cause. Identify who is affected.
Tell affected users by email, and notify regulators where the law requires it.
Fix the root cause, review what happened, and update this policy if needed.
07 · Service Providers
Each provider gets only the data it needs to provide its service, and none may use it for its own purposes.
Cloud Infrastructure: Hosting, storage, and compute for the Service. Your data is encrypted in transit and at rest.
AI Model Providers: Read your reports, meals, and voice entries on our behalf. No Tier 1 identifiers are added, and they may not train AI models on your data unless you turn on model training.
Email and Sign-In: Deliver account emails and codes, and let you sign in. They receive only your email and sign-in details.
Crash Reports and Product Analytics: Help us fix and improve Portico. Technical details and screens visited, tied to an account ID, never your name or email.