Very interesting, I am evaluating paying for the service and giving it a try.

But first:

1 - Your data retention policy, can you share more about this - in plain english?

From this: https://www.empirical.health/hipaa-privacy

There are some red flags here:

1. Vague Use of “Affiliated Covered Entity” Why it’s a concern: Without proactively disclosing who the affiliated entities are, this creates ambiguity about where and with whom your PHI might be shared.

2. Broad Language Around Business Operations Lack of transparency about exactly what operations include would be ideal. Is the data ever anonymized and aggregated for business development?

3. Generic Breach Notification Clause Clarify your internal threshold for notifying patients of a breach—even if it’s not legally required.

Minor but Worth Confirming The contact email uses a different domain (@empirical.health) than the company name (525 Medical Group). Make sure the branding/ownership is consistent to avoid confusion or phishing risk.

From this: https://www.empirical.health/data-collection

1. Extremely Broad Data Collection Scope Why it’s a concern: The scope includes highly sensitive health and mental health information, including GAD7 and PHQ9 questionnaire data (mental health), Sleep Apnea Events, and Atrial Fibrillation Burden—which could pose elevated privacy risks.

2. Vague on Purpose and Usage “We never take more than we need to make sure we are providing you with the best care possible.” Why it’s a concern: There’s no specific justification per data type. Are they using your blood pressure for real-time alerts, or just storing it? Without more transparency, it's hard to judge.

3. Data Deletion Requires Account Deletion “Users can always request data deletion in our app if they wish to delete their account.” Why it’s a concern: If you want your health data deleted but want to continue using the service, it appears that’s not allowed. It’s all or nothing.

4. No Mention of Data Sharing with Third Parties Why it’s a concern: There is no statement clarifying whether data is shared with, sold to, or used by third parties (e.g., insurers, researchers, or advertisers).

5. Mental Health Data Handling Includes GAD7 and PHQ9 (mental health questionnaires) Why it’s a concern: This is especially sensitive and should be governed by strict standards. There is no mention of how these results are stored, who can see them, or whether they're used for diagnostics, analytics, or alerts.

Full disclaimer: Not a lawyer, simply a Hacker News occasional reader.

Well, I made the mistake of giving you an email address, but bailed when you you wanted more PII just to find out where a lab was in Maryland. Since then I have received 5 emails in my Yahoo spam folder. The "Unsubscribe - Unsubscribe Preferences" links in the emails don't function. I replied with unsubscribe in the subject line, but still get what is now clearly spam.

We follow HIPAA (the US privacy law for health data). And we take the security precautions I think you'd expect -- encryption in transit and at rest, MFA, running service accounts under least privilege, everything is in a VPC, dedicated secret manager, threat detection. While these are the "basics" that you'd expect from a modern tech company, they're not always practiced consistently in healthcare.