COMPANY · TRUST

Privacy and security: how Apnealytics protects your CPAP data

Your therapy data is some of the most personal information you have. CPAP data privacy at Apnealytics is not a policy we ask you to trust; it is a set of design decisions you can check. This page explains them in plain words. The binding documents are the privacy policy and terms.

Create your free account Read the privacy policy

Privacy and security: how Apnealytics protects your CPAP data

The short version

Only your account can see your data
Only your account can see your data. Row-level security is enforced on every table.
Raw card files live in private storage and are reachable only through short-lived signed links
Raw card files live in private storage and are reachable only through short-lived signed links.
Everything travels over TLS
Everything travels over TLS.
No ads
No ads. No third-party trackers on health pages. Your data is never sold.
You can export everything or delete everything
You can export everything or delete everything. Deletion completes within 30 days.
Share links exclude health identifiers by default, and health numbers never appear on your lock screen
Share links exclude health identifiers by default, and health numbers never appear on your lock screen.
Apnealytics is not a medical device
Apnealytics is not a medical device.

How your data is stored

Row-level security on every table
Our database enforces, at the row level, that a request from your account can only read or write rows that belong to your account. This is not a filter in the application that a bug could skip; it is a rule the database itself applies to every query. If our application code had a mistake, the database would still refuse to hand over another person's nights.
Private file storage
The raw files from your SD card, which can run to several gigabytes, upload directly from your browser to private cloud storage on Cloudflare R2. They never pass through a middle server. The storage bucket is private; files are read only through short-lived signed links generated for your session. Nothing in that storage is publicly addressable.
Encryption in transit
Every connection to the web portal, the apps and storage uses TLS. There is no unencrypted path.
What leaves your phone
If you connect Apple Health or Health Connect, only daily summaries sync: resting heart rate, HRV (SDNN), SpO₂ average and low, sleep hours and weight. Raw sensor streams stay on the device. You can disconnect in your phone's health settings at any time.

How your account is protected

Sign-in options
passwordless magic link, Google sign-in, or email and password with email verification and password reset.
Sessions are server-side and revocable
Signing out on one device, or revoking sessions from Settings, ends them immediately everywhere.
Rate-limited sign-in
slows down anyone trying to guess credentials.
Family logins
each have their own credentials; nobody shares a password to share an account.
API keys (Pro)
are scoped to your account and can be revoked at any time.

What we do not do

No advertising
There are no ads anywhere in Apnealytics, and no advertising identifiers.
No third-party trackers on health pages
Pages that show your therapy data do not load analytics or marketing scripts from third parties.
No selling or renting data
Ever, to anyone, in any form including "anonymised" datasets.
No training on your data
Ask your data sends questions and the needed figures to the AI provider you chose using your own key, under their terms. Apnealytics does not train models on your data.
No health numbers on lock screens
Push notifications cover gear reminders and usage slips only.
No health identifiers in share links by default
, and none in our logs.

Sharing on your terms

Clinician share links are tokenized, read-only and aggregate-only. They are not indexed, they exclude health identifiers unless you turn on "Show health data in shares", and you can revoke any link instantly from your share list. The PDF report includes your name only if you add it. See Share with your doctor.

Leaving

Export

Data export is free on every plan. Take a copy of your nights and settings whenever you like.

Delete

Delete your account from Settings on the web or in the app. Deletion removes your account data and your raw card files from private storage and completes within 30 days. Nothing is retained for marketing.

Where things run

Apnealytics is operated by Creative Labs LLC in Lynchburg, Virginia, USA. Raw files are stored on Cloudflare R2.

Reporting a security issue

If you believe you have found a vulnerability, email info@apnealytics.com with the details. We will acknowledge your report and keep you informed as we address it. Please do not access other people's data while testing.

FAQ

Questions people ask

Help center →

Can Apnealytics staff see my CPAP data?

Row-level security is enforced in the database, and routine operation does not involve anyone looking at individual accounts. Support staff access your data only with your permission, to resolve a problem you have reported, and only the parts needed to do so.

Is my data encrypted at rest?

Raw files on Cloudflare R2 and our database are stored on infrastructure that encrypts data at rest, and all transit uses TLS. The protection you can most directly rely on is isolation: row-level security and private, signed-link-only file access.

Does Apnealytics use cookies or analytics?

Essential cookies keep you signed in. Pages that display your health data load no third-party analytics or marketing scripts.

Is Apnealytics HIPAA compliant?

Apnealytics is a consumer tool you use for your own data, not a covered entity or a business associate under HIPAA, so HIPAA does not apply in the usual way. We nonetheless build to the standards above. If your clinic wants to use Apnealytics with patients, the forthcoming Clinic tier will address agreements and compliance; talk to us.

What happens to my data if Apnealytics shuts down?

You would be notified in advance and given time to export everything, which you can do for free at any time regardless. Your data would not be transferred to another party for any purpose other than returning it to you.