Privacy Policy

This is the most important thing on this page. The platform is built so that clinical information stays in the business's own systems.

There is no free text field anywhere that a member can type into about their health. The only member input in a program is multiple choice. Every assessment question must carry a fixed list of options, and the database rejects a question that does not, so a member can only ever choose from answers the business wrote about goals and preferences.

The one exception is the optional question box in an "Ask a question" step, which is covered in section 4 and which the assistant refuses to answer clinically.

For each business the platform stores the business name, a URL slug, a billing email, branding such as logo, hero image and brand colours, and the commercial terms of the arrangement, including fee settings, payment account identifiers and billing status. It also stores the email address and role of each user on the account.

For each member the platform stores name, email, optional phone, cohort, status, and the progress record of the program: which steps were opened, which were completed, and when.

It also stores the multiple choice answers a member selected, and purchase records created by the payment processor, which cover amount, currency, date and processor reference.

It does not store diagnoses, medicines, test results, notes or any other clinical record.

When a member asks the assistant a question, the question and the assistant's answer are stored, along with which lessons the answer drew from and whether the assistant answered, found no source, or declined because the question was clinical.

Staff at the member's own business can read these exchanges. This is deliberate, so the business can see what members are asking and write lessons that cover it. Members should assume anything they type there is visible to their business.

Logos, hero images, lesson media and documents are stored in publicly addressable storage, so that they load reliably in email clients and browsers without a signed session. Anyone with the file URL can open it.

This is why businesses are told, in the product and in the terms, not to upload anything that identifies an individual member.

The platform relies on the following categories of service provider. These are the vendors present in the code today.

6.1 Cloud hosting, database, authentication and file storage: Supabase.

6.2 Payment processing: Stripe, including Stripe Connect for business payouts.

6.3 Transactional email: Resend.

6.4 AI models, reached through the Lovable AI gateway: Google Gemini for drafting and answering, and OpenAI text embeddings for lesson search.

Business and member records are kept while the business account is active. Payment records are kept for as long as the business needs them for its own accounting.

A business can delete a member record from the platform, which removes that member's profile, progress and answers. A business can request deletion of its whole account and its data by writing to admin@soleraprime.com.

A member should ask their own business first, since the business controls the member record. A member can also write to admin@soleraprime.com and the request will be passed to their business.

[Counsel to complete: retention periods, and whether backups are in scope for a deletion request]

[Counsel to complete: applicable privacy laws, data subject rights language, international transfer terms, breach notification commitments]