Hexis is operated by The Wizard Limited, a company registered in New Zealand (company number 5842171, NZBN 9429042055051) ("Hexis", "we", "us"). This policy explains what we collect when you use the Hexis website at myhexis.app and the app at app.myhexis.app, what we do with it, and the choices you have.
If you have a question about anything here, email contact@myhexis.app.
The short version
- Hexis stores the protocol and blood-test information you choose to enter. That information is about your health, and we treat it that way.
- You own your data. You can export all of it at any time, on every plan, and you can delete your account, which deletes your data immediately and permanently.
- We don't sell your data, we don't show ads, and we don't share your health information with advertisers or data brokers.
- Nobody else sees your data unless you give them access — a coach you invite, or a doctor you send a report link to — and you can take that access away.
- We use a small number of service providers to run Hexis (hosting, database, email and payments). They're listed below.
Who this policy covers
Hexis has two kinds of people in it, and the difference matters.
Account holders are people who sign in: someone tracking themselves, a coach, and a client who has accepted a coach's invitation. We collect their information directly and we're responsible for it.
People a coach records are clients whose information a coach enters before they have an account of their own. The coach decides what to record and is responsible for having the client's agreement. Until the record is handed over to the client, we hold it on the coach's behalf and act on the coach's instructions. Once the client claims it with their own login, it's theirs (see section 6).
1. What we collect
Your account
Your name and your email address. Your password is held by our sign-in provider (Neon Auth) in hashed form; Hexis never sees or stores it. If you sign up for a paid plan, we also store which plan you're on and the identifiers our payment provider uses for your subscription.
Your health and protocol information
This is the information Hexis exists to hold, and you decide what goes in:
- Records for yourself and, if you're a coach, for your clients — a name or handle, and optionally date of birth and sex.
- Protocols — the compounds you track, doses, frequencies, schedules, the vials or preparations you use, and notes you write.
- Blood tests — draw dates, the lab's name, whether you fasted, each result, the reference range your lab printed, any comments printed on the report, and notes you add.
- Body weight entries.
- A history of changes to your protocol, so you can see what changed, when, and by whom.
Lab reports you upload
When you upload a lab report PDF, Hexis reads the results from it so you don't have to type them in. We don't keep the PDF. The file is discarded once the results have been read; only the results you choose to save are stored.
Sharing and access
If you create a link to share a report with a doctor, we store the link's settings (what it includes and when it expires — never more than 90 days) and a record each time it's opened: the time, the type of browser, and a scrambled (hashed) form of the IP address. The link itself is stored only in scrambled form too, so we can't recreate it. If you give a coach or anyone else access to your records, we store who has access and at what level.
Early-access list
If you join the waitlist on our website, we store your email address, whether you said you're a coach, how you found us (for example, a link from a particular video), and the time and wording of the consent you gave.
Security and technical information
To keep accounts safe, we record sign-in attempts and limit how often certain actions can be repeated:
- Sign-in attempts — the email address entered, whether it succeeded, and the time, with the IP address stored only in scrambled (hashed) form. Kept for about 30 days.
- Rate limits — to stop repeated attempts at signing up, accepting an invite, joining the waitlist or confirming an email, we keep short-lived counters. They hold the IP address (and, for sign-up, the email address) only in scrambled (hashed) form, and are deleted after one day.
Our hosting provider also keeps short-lived request logs, as all web hosts do.
Website analytics
Our public website at myhexis.app uses Umami, a privacy-focused analytics tool that counts visits and clicks without cookies and without tracking you across other websites. It uses your IP address and browser type to count a visit without storing them. Umami doesn't run in the app at app.myhexis.app and never sees what you enter there.
Cookies and browser storage
The app uses one cookie, hexis_session, to keep you signed in. It's strictly necessary, lasts up to 12 hours, can only be read by our server (not by scripts in the page), and is never sent to other sites. We don't use advertising or tracking cookies. When you pay or manage your plan you're taken to Stripe's own pages, which set Stripe's own cookies.
The app also keeps a few things in your browser's local storage, on your own device: your language and display settings, the record you last viewed, your settings for the estimated-levels chart, and the report and invitation links you've created (so you can copy them again on that device). None of it is sent to anyone. Signing out doesn't remove it; clearing this site's data in your browser does.
2. Your health information
Information about medications, hormones, supplements, peptides and blood tests is sensitive. By entering it into Hexis, you ask us to store and process it so the app can work for you — to calculate estimated levels, show trends, compare results against reference ranges, and produce reports.
We use it only to provide Hexis to you and to the people you choose to give access to. We don't use it for advertising, we don't sell it, and we don't send it to AI services for analysis.
You can withdraw by deleting the information, or your whole account, at any time.
3. How we use information
We use the information above to:
- run the app and its features, including calculations, charts and reports
- let you and the people you authorise see and edit your records
- send emails you need — confirming your email address when you create an account or accept an invitation, password resets (sent by our sign-in provider), payment receipts (sent by Stripe), and replies to your messages
- send occasional product news to waitlist members who agreed to it (you can stop these at any time)
- process payments and manage subscriptions
- keep Hexis secure, prevent abuse, and fix problems
- meet our legal obligations
4. Who we share information with
People you choose. A coach or other person you give access to can see your records at the level you set. A doctor you send a report link to can see what that report includes, until it expires or you revoke it.
Service providers who run parts of Hexis for us, under contracts that limit them to doing so:
| Provider | What they do | Where |
|---|---|---|
| Neon | Database, sign-in, and password reset emails | Sydney, Australia |
| Vercel | Hosting: the app's server runs in Sydney; pages are delivered through a global network | Sydney, Australia, and global |
| Stripe | Payments, subscriptions and receipts | United States and other countries |
| Postmark | Sending account and waitlist email | United States |
| Cloudflare | Domain and DNS, and forwarding email sent to contact@myhexis.app | Global network |
| Our email inbox (messages you send us) | United States | |
| Umami | Website analytics on myhexis.app only (cookieless) | United States and European Union |
Stripe handles your card details directly. We never see or store your full card number.
When the law requires it. We'll disclose information if we're legally required to, and we'll push back on requests that aren't valid.
If the business changes hands. If Hexis is sold or merged, your information may transfer to the new owner, who must keep honouring this policy. We'll tell you before that happens.
We don't sell personal information, and we don't share it with advertisers or data brokers.
5. Where your data is stored
Your Hexis data — your account, records, protocols, blood tests and history — is stored on servers in Sydney, Australia, and the app's server runs there too. Some providers, such as Stripe, Postmark, Google and Umami, process the information they need in the United States and elsewhere. Wherever it goes, we only use providers that protect it to a standard comparable to New Zealand's Privacy Act 2020.
6. Coaches and clients
Hexis lets coaches work with clients, and it's built so clients own their own data.
- A record a coach creates for someone who doesn't have an account belongs to the coach's account until it's handed over.
- When a coach gives a client their own login, the client confirms their email address, and then that record — and everything recorded in it — moves into the client's account. From then on the client owns it, and the coach has access only because the client allows it.
- A client can see who has access to their records, change that access between view-only and edit, pause it, or end it at any time. Ending access doesn't delete anything; the client keeps all their data.
- Coaches are responsible for having their clients' permission before entering information about them.
7. How long we keep information
- Your account and records — for as long as your account exists.
- Sign-in attempt records — about 30 days.
- Rate-limit counters — one day.
- Email confirmation records (from signing up or accepting an invitation) — until used, and at most about a week after the link expires; deleted with your account.
- Report link view records — for as long as the link exists.
- Waitlist details — until you ask us to remove them, or until you delete a Hexis account using the same email.
- Backups — our database keeps a restore history for recovery that covers the last 6 hours, so anything deleted is gone from it within 6 hours.
- Payment records — Stripe keeps records of payments it has processed for as long as financial law requires, even after your account is deleted.
8. Export and deletion
Export: you can download everything in your account, at any time, on every plan, from Settings. Downgrading or cancelling never removes this.
Delete: you can delete your account from Settings. Deletion is immediate and permanent: your account, your records, your protocols, your blood tests, your history, your report links, your sign-in details, your sign-in attempt records, any waitlist entry with the same email, and your customer record at Stripe (which ends any subscription) are all removed. It also leaves our 6-hour restore history within 6 hours. If a coach had access, they'll see a notice that a client deleted their account — not who it was, and none of their data.
If you're a coach, records you created for clients who never claimed their own account belong to your account and are deleted with it. Clients who have their own login keep everything.
Cancelling a paid plan doesn't delete anything. Your data stays, and anything over the free plan's limits becomes read-only until you upgrade again.
9. Keeping your information safe
We protect your data with encryption in transit and at rest, strict access controls enforced inside the database itself as well as in the app, scrambled storage of passwords and of the links and codes we send (report links, invitations and email confirmations), and security reviews. No system is perfectly secure, so if we ever learn of a breach that puts you at risk, we'll tell you and the relevant authorities as the law requires.
10. Your rights
Wherever you live, you can ask us to:
- see the personal information we hold about you
- correct anything that's wrong
- delete your information
- give you a copy in a portable format (the export in Settings does this)
- stop sending you product news
- withdraw consent to us processing your health information, by deleting it
Most of this you can do yourself in Settings. For anything else, email contact@myhexis.app and we'll respond within 20 working days.
Hexis is operated from New Zealand and follows the Privacy Act 2020. If you're unhappy with how we've handled your information, you can complain to the New Zealand Privacy Commissioner at privacy.org.nz. Depending on where you live — for example in Brazil, Chile or a US state with its own privacy law — you may have additional rights, and we'll honour them.
Legal basis (European Economic Area, UK and Switzerland)
We use your information to provide the service you signed up for, which is necessary for our agreement with you. We process your health information because you choose to enter it and ask us to store and analyse it for you, which is your explicit consent; you can withdraw it at any time by deleting it. We use security records and website analytics because keeping Hexis safe and understanding, anonymously, how the website is used are our legitimate interests. Where a coach enters information about a client, the coach is responsible for having a legal basis to do so.
11. Age
Hexis is only for people 18 and over. We don't knowingly collect information from anyone younger. If you believe someone under 18 has an account, tell us and we'll delete it.
12. Emails
We send account and billing emails because the service needs them. If you joined the waitlist and agreed to product news, you can stop it at any time by replying to any email or writing to contact@myhexis.app.
13. Changes to this policy
If we change this policy, we'll update the date at the top. If a change is significant, we'll let you know by email or in the app before it takes effect.
14. Contact
The Wizard Limited, New Zealand
contact@myhexis.app