Version 1.0
Document owner: Emma Dyson
Drafted: October 21, 2026; revised October 27, 2026
Pairs with: US Terms of Use v1.0; US health-data consent statement v1.0; US research consent v1.0-US; Consumer Health Data Privacy Policy v1.0
Mana is provided by Mana Medical Technologies Inc., a Delaware corporation, 111 NE 1st St, 8th Floor, Miami, FL 33132. (“Mana,” “we,” “us”). The app and its software are developed by Mana Medical Ltd in the United Kingdom. This notice explains what we collect from people using the Mana app in the United States, why, and what you can do about it. If you are in the UK, the UK Privacy Notice applies instead.
If you are a patient of Cressa Clinic, see the section “If you are a Cressa Clinic patient” below: your clinic records are protected by HIPAA and governed by the clinic’s Notice of Privacy Practices.
We collect the health information you give us, including notes, voice notes and photos of your hands, and, if you allow it, health data from Apple Health. We use it to show you your own trends and to produce a monthly report, drafted by an AI model and checked by a member of Mana staff, that you can share with your clinician. We do not sell your data, and we do not share it for advertising. Your data is stored and processed on Google’s servers in the United States. You can delete your account and your data at any time.
Account and profile
Onboarding answers
Daily check-ins
Journal, voice notes and hand photos
Medications
Activity, rest and energy
From Apple Health, only if you allow it
From a connected wearable, only if you connect one
Voice intake call (clinic applicants only)
Automatically
Derived
Most of what we collect is consumer health data under state health privacy laws, including Washington’s My Health My Data Act, Nevada’s consumer health data law, and Connecticut’s privacy law. We apply that standard to every US user, whichever state you live in. Our separate Consumer Health Data Privacy Policy sets out the required disclosures, including the categories of third parties that receive consumer health data. In practice:
We do not make automated decisions that have legal or similarly significant effects on you.
Mana uses automated processing, including an AI language model, to turn your entries and device data into scores, trend flags and the draft text of your monthly report. The model is Google Gemini, run on Google’s Vertex AI service in the United States. It receives your check-in scores, your journal entries and voice-note transcripts word for word, your medication names and adherence, your sleep and activity data, your Mana Meter and the joints you marked. It does not receive your name, email, date of birth or account identifier (the clinic intake call is the exception: the assistant is given your first name and date of birth). Google does not keep your data after producing the draft and does not use it to train its models. We keep the text we sent to the model together with the draft it produced, so that we can check and explain the output.
Every monthly report is reviewed by a member of Mana staff before you receive it. Reports are informational and are not medical advice. No clinician sees your report unless you share it or you are a Cressa Clinic patient. You can ask us how a score or summary was produced, or ask a person to review it, at privacy@mana-medical.com.
If you connect Apple Health, we use that data only to provide the health features of the app. We do not use it for advertising, do not sell it, do not share it with third parties except service providers who process it for us under contract, and do not store it in iCloud. This is required by Apple’s health data rules as well as by this notice.
| Provider | What they do | Where your data is |
|---|---|---|
| Google Cloud (Google LLC): Firestore database, Cloud Storage | Storing your app data and files | United States |
| Google Cloud: Healthcare API, BigQuery | Your clinical record mirror; raw Apple Health archive (research consent only) | United States (Iowa) |
| Google Cloud: server processing and logs | Running the app’s server code | United States (Iowa) |
| Google: Firebase Authentication | Sign-in | United States |
| Google: Vertex AI (Gemini) | Drafting your monthly report; the clinic intake call | United States |
| Google Firebase Cloud Messaging and Apple Push Notification service | Delivering notifications | United States |
| PostHog Inc | Product analytics (you can opt out); never includes health content | United States |
| Junction, only if you connect a wearable | Connecting your Oura, Fitbit or Garmin account | United States |
| National Library of Medicine (RxNav) and openFDA | Medication name lookup; no identifier sent | United States |
| Apple | Sign in with Apple; TestFlight crash and usage data Apple collects itself | — |
| Mana Medical Ltd (our UK affiliate) | Develops and supports the software; staff access as described above | United Kingdom |
Your clinician or anyone else, only when you choose to, by sharing a report.
Cressa Clinic, only if you apply to become a patient and agree to it on a separate screen.
If the law requires it, for example a valid legal order. We will tell you unless we are legally prohibited from doing so.
If Mana is sold or merges with another organization, your data may transfer to the new owner. We will tell you before that happens.
We do not share your health data with data brokers, advertisers or employers, and we share it with an insurer only to verify your coverage at your request. We do not send text messages and do not use an email marketing tool; the only emails we send today are password resets.
Your app data, files, sign-in details and clinical record are stored on Google’s servers in the United States, in a separate database from UK users, and all processing of your data, including your daily check-ins, your Apple Health data, the drafting of your report and the delivery of notifications, happens in the United States. Mana’s software is built and supported by Mana Medical Ltd in the UK, and Mana staff in the UK can access your data as described above; that access is role-based and logged, and your data is not copied to UK systems.
| Data | Kept for |
|---|---|
| Account, profile, onboarding answers, check-ins, journal, voice recordings, hand photos, medications, activity logs, Apple Health and wearable summaries, clinical record, draft summaries, intake transcripts | While your account exists. Deleted within 30 days of account deletion. |
| Monthly report PDFs | While your account exists; deleted with your account |
| Record that consent was given, its version, and when it was withdrawn (no health content) | 6 years |
| A one-way hash of your deleted account identifier | Indefinitely, so deleted data cannot be re-created; it cannot identify you |
| Coded research copy, only if you gave the research consent | Up to 10 years from the date you delete your account; the key linking it to you is destroyed when you delete your account |
| Server logs (account identifiers, errors, staff access records) | 30 days; staff access records 6 years |
| Beta program feedback | The length of the program plus 12 months |
| Support messages | 2 years |
| Marketing preferences | Until you unsubscribe or delete your account |
| Anonymized data | Indefinitely; it cannot be linked back to you |
We protect your data with encryption in transit and at rest, access limited to named staff with two-step sign-in, logging of every staff access to a user’s record, and regular supplier review. Data on your phone is protected by your iPhone’s own encryption. No system is perfectly secure. If a breach of your unsecured health data occurs, we will notify you without unreasonable delay and within 60 days of discovery, as the FTC Health Breach Notification Rule requires. We will also notify the FTC and, where required, state authorities and the media. Where HIPAA applies to your data as a Cressa Clinic patient, the Clinic’s HIPAA breach notification process applies instead.
We respond to requests within 45 days, may ask you to verify your identity, and will not discriminate against you for exercising any of these rights.
California residents. Because Mana offers software for you to store medical information, California’s Confidentiality of Medical Information Act treats us as a provider of health care for the purposes of that law. We do not disclose your medical information without your authorization except as that law permits. If the California Consumer Privacy Act applies to us in future, you will also have the rights it provides, including to know, delete, correct, and limit use of sensitive personal information; we will update this notice when that happens. We do not sell or share personal information for cross-context behavioral advertising.
Other states. Residents of other states with privacy laws may have additional rights; contact us and we will honor them.
Cressa Clinic (Mana Rheumatology, P.A., a Florida professional association qualified to do business in Arizona and owned by licensed physicians) is a separate medical practice that uses the Mana app as part of your care. If you apply to the clinic, your intake call transcript and the history drawn from it are shared with the clinic so it can decide whether to accept you. If you become its patient, the health information in your Mana account that is used for your care becomes part of your medical record, held in the clinic’s systems in the United States. That information is protected health information under HIPAA, is governed by the clinic’s Notice of Privacy Practices, and is handled by Mana on the clinic’s behalf under a business associate agreement; the AI drafting, staff review and any other processing of it are carried out under those agreements. The clinic’s notice, not this one, governs how that information may be used and shared. This notice continues to govern your account details, your device connection, and usage analytics (which are switched off for clinic patients).
Mana’s scores and trend flags are built and tested on real-world data from people with rheumatoid arthritis and related autoimmune conditions, and they get better the more of it they are trained on. After the health-data consent we show you a separate, optional research consent screen with its own version number. If you tick it, we keep a coded copy of your health data, including your raw Apple Health readings, with your name, email and other identifiers replaced by a code. We use that copy to develop, test and improve Mana’s algorithms, including tools that predict flares and worsening, and for research into how symptoms, activity, sleep and treatment relate to outcomes in rheumatoid arthritis and other autoimmune conditions. Findings may be published; they never identify you. Mana is a company and this work has commercial value to us as well as benefit to patients.
The screen has two separate ticks: using your coded data for Mana’s own algorithm development and research, including after you delete your account; sharing it with research partners such as universities, health systems and companies under agreements that forbid re-identification, for which we receive no payment; and contacting you about future studies. You can tick any, all or none. Declining does not affect your use of the app, and you can change your mind in Settings at any time. If you withdraw, we stop using your data in new work and delete your coded records within 30 days; analyses already completed and models already trained are unaffected. If you delete your account with the first tick on, we destroy the key that links the coded copy to you and keep the copy for up to ten years from that date.
If you take part in a formal research study, the consent you signed for that study governs how your data is used in it. Health data is not used for research without a consent that specifically describes it.
We may create statistics and de-identified datasets from which no individual can reasonably be identified (for example, how often people with a given condition report a flare in winter) and use or share them for research, product development and business purposes. We take reasonable measures to ensure the data cannot be linked to you, we publicly commit not to attempt to re-identify anyone, and we require anyone we share it with to make the same commitment in writing. De-identified data is no longer consumer health data and cannot be deleted on request.
Mana is for adults. You must be 18 or older to create an account, and we ask for your date of birth to check. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
If we make a significant change we will update the version number and ask you to accept the new version in the app. We will not quietly broaden how we use data you have already given us.
Mana Medical Technologies Inc., 111 NE 1st St, 8th Floor, Miami, FL 33132
Privacy: privacy@mana-medical.com
Support: support@mana-medical.com
Mana Medical Ltd (software developer), Flat 4, 397 Clapham Road, London SW9 9BT, United Kingdom. Document owner: Emma Dyson.