Privacy Policy
Template drafted for the Toucan beta — have a lawyer review before public launch.
Last updated: July 2026. Toucan ("we") is a text-message wellness companion. Your health information is sensitive, and this page explains exactly what we do with it.
What we collect
- Your phone number, name, timezone, and feature preferences (from signup).
- The messages you exchange with Toucan, and the structured data Toucan extracts from them: symptoms, medications and doses, food logs, and check-in preferences.
How we use it
- To provide the service: reminders, check-ins, summaries, and pattern detection — for you only.
- To deliver the service, your messages necessarily pass through two service providers acting on our behalf: our messaging provider (Blooio, which operates the iMessage delivery infrastructure) and our AI provider (Anthropic, which generates Toucan's replies). Anthropic does not use API data to train its models by default.
- We do not sell your data. We do not share your health information with advertisers. Ever.
Storage & security
- Encrypted at rest: your health information — messages, symptoms, medications, doses, food logs, conditions, allergies, and doctor notes — is encrypted in our database with AES-based encryption, with decryption keys stored separately from the data. A stolen copy of the database is unreadable without the key.
- Encrypted in transit: all connections use TLS/HTTPS.
- Strictly separated: every account's history is isolated by design. The AI is only ever given your data when talking to you — no other user's information can appear in your conversation, or yours in theirs.
- An honest note on end-to-end encryption: a texting service like Toucan can't be end-to-end encrypted the way your personal iMessages are — Toucan has to read your messages in order to reply. What we can do is minimize what's stored, encrypt it, restrict who can access it, and never sell it. That's our commitment.
- We are a consumer wellness service, not a healthcare provider — HIPAA does not apply to Toucan. We still treat your data with that level of care, and we comply with the FTC Health Breach Notification Rule: if your health data is ever breached, we will notify you.
Your controls
- Text STOP anytime to stop all messages; START to resume.
- Text "delete my data" (or email us) and we will permanently delete your account and all logs within 30 days.
- Ask Toucan "what do you know about me?" for a copy of your stored info.
Contact
Questions: contact the Toucan team at the email listed on our website footer.
← Back to Toucan