Privacy Policy

How getbased handles your data.

Effective 22 April 2026

In one sentence: getbased is a local-first application. Your data lives in your browser on your own devices. No account, no analytics by default, no central server storing your health information. The only times your data leaves your device are when you explicitly connect a third-party service (an AI provider, a wearable, a sync relay) — and only for the duration of those calls.

1. Who runs getbased

getbased is a free, open-source project developed and maintained by an individual (referred to as "the maintainer"). There is no company, no employees, and no sales team. The source code is licensed under the GNU General Public License v3.

For the purposes of the EU General Data Protection Regulation (GDPR), the maintainer is the Data Controller for the hosted website at getbased.health. When you self-host getbased, you are the controller of your own deployment.

2. What we don't collect

Before listing what might transit, here's what we never do:

3. What stays on your device

Virtually everything you put into getbased is stored locally in your browser:

None of these are sent to getbased's website. If you clear your browser storage, uninstall the app, or use the "Clear all data" action in Settings → Data, the data is gone from your device.

4. Third-party services you choose

getbased calls third-party services only when you configure them. Each has its own privacy policy that governs data handling on their side.

4.1 AI providers (all optional)

If you enable AI features, your prompts and any data you include in context are sent to the AI provider you chose. Available providers and their policies:

Before calling a cloud AI provider, getbased offers PII obfuscation: email addresses, phone numbers, street addresses, and names detected in imported PDFs are replaced with placeholders. You can enable a local-AI-based obfuscation layer on top of the regex for stronger redaction.

4.2 /api/proxy (the Vercel Edge Function)

The hosted getbased.health deploys a small proxy function on Vercel so the browser can reach AI providers without CORS errors. The proxy:

If you self-host, you bypass this entirely.

4.3 Cross-device sync (optional)

Opt-in sync uses Evolu, a CRDT protocol with end-to-end encryption. Your BIP-39 mnemonic derives the encryption key; a relay server relays ciphertext between your devices but cannot read the contents. You can choose the relay (getbased's default, or one you host).

4.4 Wearable integrations (optional)

When you connect a wearable (e.g. Oura), getbased:

Disconnecting a wearable wipes its local rows immediately. The vendor retains the data they already have on their side per their own policy; getbased cannot delete it there. To revoke getbased's access, disconnect inside the app and revoke the app on the vendor's site.

4.5 Knowledge Base (Interpretive Lens)

Documents you add to the on-device Knowledge Base are indexed and embedded locally in your browser using the Origin Private File System (OPFS). Nothing is uploaded. If you use the external-server lens option, the server you point at is under your control and its privacy model is yours.

4.6 Fonts and CDNs

getbased loads the Inter, Outfit, and JetBrains Mono fonts from Google Fonts. Google may log the IP address that fetches them. Chart.js, pdf.js, transformers.js (Knowledge Base embedder), and a small number of other libraries load from jsdelivr.net on first use and are cached by your browser.

5. Your rights

Under GDPR and most privacy frameworks, you have the rights to access, correct, delete, export, and restrict processing of your personal data. Because getbased stores your data on your own device, you can exercise all of these rights directly, without contacting us:

For personal data the maintainer controls (for example, if you email a support request), you can write to privacy@getbased.health.

6. Children

getbased is not designed for children under 15. This matches the minimum age for consent to information-society services under Czech law (the governing law of the Terms). If you live in an EU Member State with a higher minimum age (16 in several countries under GDPR Article 8), that higher age applies to you. Please do not enter a child's medical data without appropriate guardianship and consent.

7. Security

Measures we apply:

No system is unbreakable. If you discover a vulnerability, please report it via a private GitHub security advisory at github.com/elkimek/get-based/security.

8. International data transfers

If you use the hosted getbased.health, the Vercel Edge Function runs on regional edge nodes operated by Vercel, Inc. Your request may be handled by whichever edge node is closest to you; responses do not persist. Third-party services you choose (AI providers, wearable vendors) may transfer data to their own infrastructure per their policies.

9. Changes to this policy

If we update this policy, we'll change the Effective date above and mention it in the app's changelog. Material changes will also be announced on the app's first launch after the update.

10. Contact

Privacy questions: privacy@getbased.health

Source code, issues, general discussion: github.com/elkimek/get-based