Last updated: 29 October 2026 · Effective: 21 October 2026
Sire Protocol is operated by Sire Systems LLC ("we"). If you want to reach a person about anything in this policy, write to privacy@siresystems.ai.
You are running a protocol somebody prescribed you. This app keeps the record of what you actually did, works out your adherence from that record, and shows it to the people you choose — one at a time, each by name, each revocable.
We do not sell your data. We do not train models on it. We do not put a health field in analytics. Subscriptions are the only way we earn, which is what makes the rest of this possible to promise.
Everything below is specific because the app is specific. Where we say the app behaves a certain way, it is built that way, not merely intended.
Your records are stored in the United States, in Amazon Web Services' Northern Virginia region (us-east-1), on infrastructure operated by Supabase on our behalf. Backups are taken daily and are held in the same region.
Progress photographs are the exception: they never leave your phone at all. They are written to the app's own storage, encrypted while the device is locked, kept out of your camera roll, and there is no code in Sire Protocol that uploads them. The same is true of a photograph of your protocol — it is read on the device and discarded when you close the screen.
Two smaller things also stay on the phone, and this section named neither until 13 September. The bodyweight you can give at sign-up has no column on the server: it is kept in the app's own encrypted storage and is used for the dose-per-pound line and, if you ask the assistant about food, in that question. And anything you record while offline is held on the device until it can be sent — that is what the app is describing when it says something is saved here but has not reached the server yet.
If you are outside the United States, using Sire Protocol means your health data is processed there, under United States law.
Weight, lean mass, heart rate variability and sleep. Read only. The app asks for no permission to write anything into your health record, and so it cannot. What it reads stays on your device.
No contacts. No location. No advertising identifier. No third-party tracker. No health field in any analytics or crash report. If we ever adopt an analytics or crash-reporting tool, that constraint is a requirement of adopting it.
They are written into the app's own storage, encrypted while your phone is locked, kept out of your photo library, and excluded from backups.
There is no upload path for them. Not one that is switched off — one that does not exist. Your coach cannot see them. Your clinician cannot see them. We cannot see them. If you delete the app, they go with it.
Everything. Including every read a coach or clinician made, and when.
Linking a coach is not available in this version of Sire Protocol. Nothing in the app or on the web can connect a coach to your account, so today no coach can read anything of yours. This section says what a coach would be able to read if linking is offered later, so that a consent you give now means what it will mean then. Each read would be recorded in your access log.
That last line is not a policy we follow. The functions a coach's device can call return dates, window times, whether a dose was taken, the reasons for a miss and the titles of goals — there is no compound, dose, site or lab column in what comes back, so there is no query they could write to obtain one.
A coach cannot change your protocol in any way. Compounds and doses stay with whoever prescribed them.
Two numbers each: your adherence percentage and your current streak. They never see a compound, a dose, a lab value, a window or a reason. The record a peer receives has four fields on it — an id, your username and those two numbers — and none of them are clinical.
Linking a clinician is not available in this version either, so no clinician can see anything through Sire Protocol. If it is offered later, a practice would see what you send it, under a signed business associate agreement, and linking would be a deliberate, explained action rather than a setting — because it changes what we are legally. See section 7.
We, Sire Systems LLC, operate the service, and the people who run it can access the data it holds where that is needed to operate, secure, support or repair it, or where the law requires it. We do not browse it, and we do not use it for anything section 5 does not name. Access of this kind is made with administrative credentials and is not recorded in your access log, which covers reads by a coach or a clinician. If you write to us for help, we will tell you if answering means looking at your records.
Seven separate decisions, each dated in a record you can read. None of them bundled, and none pre-ticked when you sign up.
One is required: keeping your protocol and your dose log — without it there is nothing for the app to be. If you want that gone, delete everything instead, which we make straightforward.
The other six are off until you turn them on, and each can be withdrawn on its own at any time: keeping the lab results you enter, a coach seeing your adherence, a coach reading the reasons for your misses, your circle seeing your two numbers, sending block summaries to a clinician, and sending questions to the assistant (section 5). The two coach consents and the clinician one have no effect in this version, because there is no coach or clinician link for them to govern; the clinician one cannot be turned on until there is.
Revoking is immediate and appends to the record rather than editing it. When you revoke a share, we add a dated row saying you revoked it. We never edit the grant that came before, because a consent history you can quietly rewrite is not a consent history. Both the grant and the revocation stay visible to you.
Revoking a share does not delete anything you have logged. Your log is yours.
We use your data to run the app: to show your queue, compute your adherence, draw your charts, and pass along what you chose to share.
We do not sell it. We do not rent it. We do not share it with data brokers, insurers or employers. We do not use it to train machine learning models.
If you use the assistant, it runs on a model provided by Anthropic, PBC, and what it needs to answer is sent to Anthropic to generate a reply. The app asks your permission, naming Anthropic, before anything is sent, and that permission is one of the decisions in section 4 — withdraw it and nothing more goes. What is sent:
Never your photos, your Apple Health readings, your messages, or your email or legal name. Anthropic processes it under its commercial terms, which do not permit training models on it. You can use the entire app without ever opening the assistant.
Research is opt-in and off by default. If you turn it on, we may include your adherence patterns, stripped of your name, email and anything identifying, in pooled analysis of what makes protocols stick. Never your labs. Never your photos. Never shared with an insurer or an employer. You choose it when you sign up. To turn it off afterwards, write to privacy@siresystems.ai and we will stop future inclusion.
No system is perfectly secure. If your data is ever exposed, we will tell you in writing within 60 days, to the email you signed up with, along with what happened and what you should do.
Linking a clinician is not available in this version. Until you link one, Sire Protocol is a consumer application. We are not a HIPAA covered entity and not a business associate, because nothing goes to a clinic unless you send it. We answer to the FTC Health Breach Notification Rule and to your state's health data law, and we are built to HIPAA-grade security regardless.
Linking a clinician changes that on purpose. Once a practice is connected, we handle protected health information on their behalf: we become a business associate, a business associate agreement covers that channel, and HIPAA's Privacy and Security Rules apply to it.
This is why linking is a deliberate action with its own explanation rather than a toggle in settings.
You can unlink at any time. Nothing new goes to the practice from that moment. What they already hold is their medical record, kept under their own legal duty. We cannot delete it and neither can you — ask the practice directly.
Everyone, everywhere, regardless of tier:
Deletion has three honest limits, stated in the app before you confirm:
Depending on where you live you may also have rights to object, to restrict processing, to withdraw consent, and to complain to a regulator. Write to privacy@siresystems.ai and we will action it within 30 days.
Every account is held to the consent standard of Washington's My Health My Data Act, wherever you live: every share needs its own consent, each can be withdrawn individually, and nothing is pre-ticked when you sign up. If you live in Washington you also have a private right of action under that Act. Where the law of the state you live in gives you more rights than this policy does, you have those rights as well.
Sire Protocol is offered in the United States.
Sire Protocol is for adults. You must be 18 or over. We do not knowingly collect data from anyone younger, and we delete it if we discover we have.
Your data stays while your account exists, because the value of the log is that it is long. When you delete your account it is erased immediately, and out of backups within 90 days.
That includes your access log and your consent records. An earlier version of this section said both were retained for six years after account closure as an audit trail. The software does not do that and never did: deleting the account removes them in the same statement as everything else. We would rather hold less of your data than keep a promise to hold more of it, and this section now says what the code does. While your account is open, both are append-only — a consent you withdraw is recorded as a withdrawal rather than erased — so the history is complete for exactly as long as you have an account.
If we change this policy in a way that affects what we do with your data, we will tell you in the app and by email before it takes effect, and where the law requires it we will ask for your consent again rather than assume it.
Sire Protocol does not prescribe, dose, taper, or interpret a lab result. It records what happened, does arithmetic you could do by hand, and routes every decision to the person qualified to make it. If any part of this app ever reads as medical advice, it is a defect — tell us at privacy@siresystems.ai and we will fix it.