CLINICS

Security: how Apnealytics protects CPAP data

CPAP data security at Apnealytics rests on a few plain commitments: every database row is locked to the account that owns it, raw files sit in private storage reachable only through short-lived signed links, nothing that could identify a person's health goes into logs, and you can export or delete everything, with deletion complete within 30 days. This page is written for the person at a clinic or DME whose job is to ask.

Create your free account Talk to us

Security: how Apnealytics protects CPAP data

The model in one paragraph

A patient owns an account. Everything in it, nights, vitals, gear, raw card files, belongs to that account and is isolated at the database layer. Family members are separate logins on the same account. Providers see data only through what the patient shares: a tokenized read-only link or a PDF. There is no provider back door today; the coming roster view will be built on explicit, per-provider, patient-revocable consent.

Data isolation

Row-level security on every table
Every table in the database carries a row-level security policy that ties rows to the owning account. Queries run as the signed-in user, so a request can only ever return that account's rows, even if application code had a bug. This is enforced by the database, not by a filter the app remembers to apply.
Scoped tokens for share links
A clinician share link is a random, unguessable token tied to one account and one scope: aggregate therapy data, read-only. Share pages are served with headers that keep them out of search engines. Health identifiers are excluded by default; the patient can switch them on per link. Revoking the token ends access immediately. Links also stop working if the owner's Pro plan lapses.
Ask your data is read-only
The AI assistant reads your account's aggregates and nothing else. It cannot write, delete or reach another account. Questions and the figures needed to answer them go to the provider whose key you supplied (OpenAI or Anthropic), under their terms.

File storage

Direct-to-storage uploads

Card files upload from the browser straight to private object storage (Cloudflare R2). No Apnealytics server handles the bytes in transit, which removes a whole class of risk. Uploads are resumable and folder-aware; integrity is checked per file.

Private buckets, signed URLs

Buckets are private. Nothing is publicly listable or fetchable. When the app needs a raw file, for example to parse a night's waveforms in the browser, it requests a short-lived signed URL scoped to that object, valid for minutes.

Transport and sessions

TLS on every connection, web and mobile.
Magic-link, Google sign-in and email plus password, with email verification and rate-limited sign-in.
Sessions are server-side and revocable. Signing out one device, or all devices, invalidates tokens immediately rather than waiting for them to expire.
Optional app lock behind Face ID, Touch ID, fingerprint or device PIN on the phone apps.
Push notifications never carry health numbers; the lock screen shows only that a reminder exists.

Logging and telemetry

No health values, identifiers or raw file contents in application logs. Logs record that an action happened, for which account ID, and whether it succeeded.
No advertising SDKs. No third-party trackers on pages that show health data.
Crash reporting excludes payloads that could contain health data.

Your data stays yours

Export everything from Settings, on Free or Pro, at any time.
Delete your account in-app. Deletion removes database rows and raw files and completes within 30 days; backups age out on the same schedule.
Disconnect Apple Health or Health Connect from your phone's settings at any time; only daily summaries ever synced.
Never sold. No data is sold or shared with advertisers.

Infrastructure

Application and database hosting, object storage on Cloudflare R2, subscriptions through RevenueCat, covering web checkout and in-app purchase on iOS and Android. Card details never touch Apnealytics; RevenueCat, Apple and Google handle them.

Compliance posture for providers

Apnealytics is a tracking and coaching tool, not a medical device, and makes no diagnoses. When patients share their own data with you via links and PDFs, Apnealytics is acting for the patient. For the coming roster view, where providers would access patient data inside Apnealytics under consent, we expect to operate as a business associate and to sign BAAs. We will not claim certifications we do not hold.

Reporting a vulnerability

Email info@apnealytics.com with details. We acknowledge reports promptly and will tell you what we did.

FAQ

Questions people ask

Help center →

Is Apnealytics HIPAA compliant?

Patients sharing their own data with a provider through revocable links and PDFs does not make Apnealytics a business associate. For the coming provider roster view we expect to sign BAAs. The technical controls on this page, row-level security, private storage, signed URLs, no PHI in logs, apply to every account today.

Where is my CPAP data stored?

Parsed nights live in a database with row-level security tied to your account. Raw card files live in private object storage on Cloudflare R2, reachable only by short-lived signed URLs. Uploads go directly from your browser to that storage.

Can Apnealytics staff see my data?

Access to production data is restricted to a small number of engineers for support and incident response, logged, and never used for anything else. Health values are never in logs, and the AI assistant only ever reads your own account.

What happens when I delete my account?

Your database rows and raw files are removed and deletion completes within 30 days. Share links stop working immediately. Health summaries synced from Apple Health or Health Connect are deleted with the account; the originals stay on your phone.

Are share links safe to send by email?

They are unguessable tokens, read-only, aggregate-only and not indexed, and they exclude health identifiers by default. Anyone with the link can view it, so treat it like a document: send it to the clinician, and revoke it when the visit is done.