Depth is the intelligence layer for your body. You upload your blood-test reports; we read them, score them, and hand back a clear briefing on what actually matters. To do that, we handle some of the most sensitive data you own, your health record. This policy explains, in plain language, what we collect, why we collect it, who we share it with, where it lives, and the rights you have over it. We have tried not to hide anything important behind vague words.
Depth is owned and operated by Depth Intelligence Private Limited ("Depth", "we", "us", "our"), the company behind depth.fit and the Depth application. By creating an account or using Depth, you agree to the practices described here.
1. Scope
This policy covers the Depth website, application, and related services (together, the "Service"). It applies to everyone who creates a Depth account or uploads data to us. Depth is for adults only. You must be 18 or older to use it. We do not knowingly collect data from children. See section 11.
2. The data we collect
We collect three kinds of data, and we treat them differently.
Account data
You can create an account with Google, Sign in with Apple, or email. Depending on the method you choose, we receive your email address, name (if provided), and the relevant account identifier. Apple may provide a private relay email address if you choose to hide your email. We use this information to create and secure your account and to contact you about the Service. We do not receive your Google or Apple password.
Health data (sensitive)
This is the heart of the Service, and it is sensitive personal data. It includes:
- The blood-test report PDFs you upload.
- The biomarker values we extract from those reports.
- The scores, insights, and Recaps we derive from them, including your Depth Score.
- Profile information you provide so we can read your results in context: date of birth, sex, and ancestry/cohort.
- Fitness and wellness records you authorize Depth to read from Apple Health: heart rate, resting heart rate, heart-rate variability (HRV), steps, walking/running distance, active energy, basal energy, exercise time, stand hours, oxygen saturation, respiratory rate, sleeping wrist temperature, VO2 max, blood glucose, body weight, body-fat percentage, lean body mass, sleep analysis, and workouts.
We collect health data only with your consent, and only to provide the Service you asked for. You are never required to upload anything you do not want us to have.
Apple Health access is read-only and limited to the data you authorize. Apple Health is Depth's only current health-data connection. Depth does not write to Apple Health. Records another app or device writes to Apple Health may be imported after you authorize access, but Depth does not directly communicate with, control, or certify Apple Watch or any other vendor or hardware. We currently offer no direct vendor or hardware integrations.
Usage and technical data
Like most online services, we collect standard server logs and technical information: device and browser type, approximate location derived from your IP address, and how you interact with the Service. We use PostHog as identified product analytics: events can be associated with your account and can include selected report IDs, Depth Score and tier, marker ID and status, and sex/cohort properties. We use this to understand and improve the Service. PostHog does not receive raw Apple Health metric values. We do not use raw Apple Health metric values for advertising or marketing.
3. How and why we use your data
We use your data to:
- Read your uploaded reports and extract the markers from them.
- Generate your Depth Score, insights, and Recaps.
- Power the AI agent that answers your questions over your own health record.
- Import the Apple Health data you authorize and show related wellness insights.
- Arrange an at-home draw through independent providers when you request one and the service is available.
- Maintain your account, authenticate you, and keep the Service secure.
- Communicate with you about the Service, including changes and important notices.
- Comply with our legal obligations and enforce our terms.
We do not sell your personal data. We do not use health data, including raw Apple Health metric values, to serve advertising or for marketing.
At-home draw arrangements are availability-qualified and not guaranteed. Depth acts only as a concierge. An independent partner performs collection and testing and issues the clinical result. Depth is not the laboratory, phlebotomy provider, or diagnostic provider.
4. Legal bases for processing
For your health data, which is sensitive personal data, our legal basis is your explicit consent, which you give when you upload a report and ask us to process it. You can withdraw that consent at any time (see section 9); withdrawing it does not affect processing we already carried out lawfully.
For account and technical data, we rely on what is necessary to perform our contract with you (providing the Service), our legitimate interests in keeping the Service secure and functional, and compliance with applicable law.
5. Who processes or receives your data
We do not run all of our own infrastructure. To provide the Service, we share data with the processors and service providers listed below.
- Cloudflare, our hosting and infrastructure provider. It handles serverless compute, object storage for your uploaded report PDFs, database connection pooling, edge delivery, and our AI gateway.
- PlanetScale, our managed PostgreSQL database provider. Your core record is stored here. This database is hosted in India (the Mumbai region), which is the primary location of your data.
- Google Cloud (Vertex AI / Gemini), processes the blood-report PDFs you upload to extract structured data from them. In other words, the contents of your uploaded reports are sent to Google for AI processing. Google also provides Google authentication.
- Apple, provides Sign in with Apple and Apple Health, which supplies only the categories you authorize Depth to read.
- OpenRouter and the pinned DeepSeek provider, process prompts for AI-generated insights and agent responses. They receive the information needed for the requested response, which may include derived health context.
- NVIDIA, provides fallback AI processing for insights and Recap copy and may receive derived health context when that fallback is used.
- PostHog, provides identified product analytics using the event properties described in section 2, but not raw Apple Health metric values.
- Meta Pixel, measures visits and campaigns on the public marketing website only. It is not used in the authenticated product and does not receive health data from Depth.
- Discord, supports concierge booking operations and may receive the contact and scheduling details needed to coordinate a requested draw.
- Independent collection and testing partners, receive the information needed to confirm and perform a draw you request and to issue the clinical result.
These parties receive data only for the functions described above. Independent collection and testing partners are responsible for the services they perform.
6. International transfers and data location
The primary location of your stored data is India (Mumbai). Because some of our processors operate globally, your data, or parts of it, may be processed in other countries when those services run. Where data crosses borders, we rely on the consent you provide and on the contractual protections we have in place with our processors. If you are in the EU/EEA or the UK, transfers out of those regions are made on the basis of appropriate safeguards such as Standard Contractual Clauses.
7. Security
We protect your data with encryption in transit and at rest, least-privilege access controls, and access logging. We restrict who on our side can reach health data and we keep a record of access. No system is perfectly secure, and we do not claim otherwise, but we treat your health record as data that deserves real care, and we build accordingly.
8. How long we keep your data
We keep your data for as long as your account is active, so the Service can read your history and track your trends over time. That longitudinal record is the point of Depth. If you ask us to delete your data, or you close your account, we delete it, subject to any limited retention the law requires. You can also delete individual uploads at any time. Imported Apple Health records remain in your Depth account until you delete the relevant data or your account; revoking Apple Health access alone does not delete records already imported. Processor backups and records may remain only for the limited period required for security, legal, or operational purposes before deletion or de-identification.
9. Your rights
Whatever regime applies to you, you can:
- Access the personal data we hold about you.
- Correct data that is inaccurate or out of date.
- Delete your data, including your uploaded reports.
- Export your data in a portable form.
- Withdraw consent to our processing of your health data.
You can revoke Depth's Apple Health access in iOS Settings → Privacy & Security → Health → Depth. Revocation stops future access but does not delete Apple Health records already imported into Depth. Delete those records or your account in Depth, or email privacy@depth.fit, to request deletion.
If you are in India, the Digital Personal Data Protection Act, 2023 (the "DPDP Act") is the primary regime that governs how we handle your data, and you have the rights it grants, including the right to access, correction, erasure, grievance redressal, and to nominate another person to exercise your rights. You can raise any concern with our Grievance Officer (section 12).
If you are in the EU/EEA or the UK, you have the rights granted by the GDPR, including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your data protection authority.
If you are in California, you have the rights granted by the CCPA/CPRA, including the right to know what we collect, to delete it, to correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell your personal information, and we will not discriminate against you for exercising your rights.
To exercise any of these rights, email privacy@depth.fit. We may need to verify your identity before we act, to protect your health data from anyone pretending to be you.
10. Health data is not medical advice
Depth is a general wellness product for fitness and lifestyle optimization and is not a medical device. The scores, insights, and Recaps we produce are informational and wellness-oriented only. They do not diagnose, treat, cure, or prevent disease and are not a substitute for professional medical care. Always consult a qualified clinician about your health, and never disregard or delay seeking medical advice because of something Depth showed you. In an emergency, contact your local emergency services.
11. Children
Depth is for adults. You must be at least 18 years old to use the Service. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.
12. Grievance Officer and contact
In line with India's DPDP Act, you can reach our Grievance Officer about any question or complaint relating to your data:
- Grievance Officer: Raghav Dua
- Email: dpo@depth.fit
- Owner and operator: Depth Intelligence Private Limited
For general privacy questions, email privacy@depth.fit. We will respond within the timelines the applicable law requires.
13. Changes to this policy
We may update this policy as the Service evolves. When we make a material change, we will update the effective date above and, where appropriate, notify you. Your continued use of the Service after a change means you accept the updated policy.
See also our Terms of Service.