Somatic — Privacy Policy

Effective 26 October 2026

Somatic is a WhatsApp service that turns your own health data — lab results, records from a health system you connect, and the foods you ask about — into personal wellness insights. It is made by Lizwise Elv LLC. This policy describes exactly what Somatic keeps, what it only passes through, and who else touches it.

What Somatic keeps

Only the following, and nothing else:

• Who you are, as a keyed hash. Your WhatsApp number is never stored in readable form. Your account is identified by a keyed hash of it (HMAC-SHA256 under a secret key), which cannot be turned back into the number. The one exception: while a “Connect my records” link or sign-in is open — at most 15 minutes — your number is held encrypted so Somatic can message you the result, and then it is deleted.
• Your age. The year you were born, so results are compared against the right ranges. If the year alone doesn't settle whether you are 18, Somatic asks the month and then the day, and keeps neither once it knows.
• Your choices. That you were shown what Somatic keeps, whether you allowed AI, which version of the wording you saw and when, and whether you paused the chat.
• Sex at birth, if you answer. Asked only when a result's range depends on it, and you can skip.
• Lab values you type, or that are read from a report photo or PDF you send: the test, value, unit, range and date.
• Foods you check: the food's name, the verdict and when, and a goal Somatic set for you (such as lowering LDL when your LDL is above its range).
• Foods you log by saying you ate (or skipped) them: the food, the amount and its nutrients, and when, so your day and week can be summed up.
• Food goals, if you set them up: your goal, weight, height, activity, target weight and pace, food choices (such as vegetarian), and your answers to the safety questions (such as pregnancy, kidney disease or an eating disorder), which decide whether Somatic shows calorie or weight targets at all.
• Records from a health system you connect: lab results and vital signs, the conditions and medications on your record with their status and dates, the sex your record states, which health system they came from and when.
• A count of AI requests per day, so one account cannot exhaust the service.
• Usage counts, for 35 days. For each day you message Somatic, how many messages you sent, under a pseudonymous code (a keyed hash of your account's keyed hash, under a separate secret key) that cannot be linked back to your number or your account. These counts are kept on Lizwise Elv's own Cloudflare account and deleted after 35 days. The code and the first day it appeared are kept up to 400 days, to count new users; beyond that, only totals per day (such as how many people used Somatic) are kept. Counting starts only from your first message after Somatic has told you about it in the chat.
• Reactions to Somatic's replies. If you react 👍 or 👎 to a reply, Somatic counts the reaction by the type of reply (for example “lab results” or “food check”). The count is not linked to you, and Somatic keeps a keyed hash of the reply's message ID, with its type, for 7 days so it can tell what the reaction was about.

None of these counts contain the text of your messages, Somatic's replies or any health value.

If you tell Somatic you are under 18, it keeps only a note that you are under 18 (so it does not answer further) and the date of its last reminder.

What passes through and is not kept

• The text of your messages. Somatic reads each message to answer it and keeps only the lab values or food named in it, as above.
• Photos and PDFs you send. They are read once and discarded.
• From a connected health system: your sign-in (Somatic never sees your password; you sign in on the health system's own MyChart page), the access token, which is used once and discarded, and the parts of your record it doesn't keep — visit details, your name, date of birth and address.
• WhatsApp message IDs, held for 24 hours so a redelivered message is not answered twice.

Operational logs record message IDs, message types, lengths and timings. They never contain message text or health values.

Who else handles your data

• Meta (WhatsApp Cloud API) carries the messages between you and Somatic, under Meta's WhatsApp Business terms.
• Cloudflare runs the front door Somatic receives messages and web pages through, and the encrypted connection to Somatic's servers.
• Lizwise Elv's own Cloudflare account holds the pseudonymous usage counts and reaction counts described under “What Somatic keeps”, and nothing else about you.
• Google (Gemini API), only if you allow AI. When you send a photo or PDF, a food Somatic doesn't know, or a message it can't place by itself, that content goes to Google's Gemini model to be read. When Somatic shows you an insight, the facts behind it (the results, ranges and dates involved) go to Gemini to be put into words. Somatic uses Google's paid service, under which Google does not use the content to train its models, and keeps it for 55 days only to detect abuse; Google may process it outside the United States. With AI off, nothing goes to Google and typed lab values and common foods still work.
• Open Food Facts, a public product database, receives a barcode number when you send one, to look the product up. Nothing about you goes with it.
• The health system you choose (through its Epic MyChart sign-in), only if you connect one. Somatic reads, read-only: lab results, vital signs, conditions, medications, visits and basic demographics. It never writes back.

Somatic's own servers are operated by or for Lizwise Elv LLC in the United States.

How it is protected

Everything Somatic keeps about your health is encrypted at rest with AES-256-GCM, each account's data sealed to that account. Connections are encrypted in transit. Deleting a record overwrites it rather than merely marking it deleted.

How long, and “delete my data”

Somatic keeps what is listed above until you delete it. Send “delete my data” in the chat and confirm: your account, your lab values, foods, connected records and any open link are deleted at once, permanently. You can also write to the address below and we will do it for you. Writing to Somatic again afterwards starts a new, empty account. The one exception: if we block a number for abuse, we keep a scrambled code made from it (never the number itself) so that it can't sign up again, until we lift the block.

What Somatic never does

• No sale of your information, to anyone
• No advertising, and nothing shared with advertisers or data brokers
• No use of your data for any purpose except giving you your own insights
• No diagnosis, treatment advice or triage: Somatic gives general wellness information

Adults only

Somatic is for people 18 and over. It asks your age before anything else and does not serve anyone under 18.

Washington residents: consumer health data

Under Washington's My Health My Data Act, the information Somatic keeps is consumer health data. In short:

• What we collect: the categories under “What Somatic keeps” above — lab results and vital signs, conditions and medications from records you connect, foods you check or log, food goals and your answers to their safety questions, a goal derived from your labs, your year of birth and, if you give it, sex at birth. Because using a health service can itself say something about your health, we also treat the pseudonymous daily usage counts and reaction counts as consumer health data.
• Where it comes from: you, and the health system you choose to connect.
• Why: only to provide the service you asked for — explaining your results and checking foods against them.
• Who it is shared with: only the processors listed above, to provide the service. It is never sold.
• Consent: Somatic tells you what it keeps before it keeps anything, and asks separately before using AI. You can withdraw: send “AI” to change the AI choice, “stop” to pause, or “delete my data”.
• Your rights: to know whether we hold your consumer health data and to see it, to have it deleted, and to withdraw consent. Write to us at the address below. If we decline a request you may appeal by replying to our answer; if you are not satisfied with the appeal, you may contact the Washington State Attorney General.

California residents

Under the California Consumer Privacy Act, you have the right to know what personal information we collect, use and disclose (described above); to have it deleted; to have it corrected; and not to be treated differently for using these rights. We do not sell or share personal information, and we use sensitive personal information — your health information — only to provide the service you asked for. To use your rights, send “delete my data” in the chat or write to us; we confirm requests by answering in the WhatsApp chat they concern. You may use an authorised agent. We respond within 45 days.

Who is responsible

Lizwise Elv LLC, which makes Somatic
2104 Forest Avenue, Belmont, CA 94002-1504, United States

Contact

[email protected]

Changes

If this policy changes in a way that affects what Somatic keeps or who handles it, the change will be described here with a new date above, and called out in the chat before it takes effect.

26 October 2026: Somatic now keeps pseudonymous daily usage counts for 35 days on Lizwise Elv's own Cloudflare account, and counts 👍/👎 reactions to its replies by type of reply (see “What Somatic keeps”). Neither contains message text or health values. Existing users are told in the chat, and counted only from their next message after that.