Privacy Policy

Last updated: October 2026. Toucan ("we") is a text-message wellness companion. Your health information is sensitive, and this page explains exactly what we do with it.

What we collect

• Your phone number, name, timezone, and feature preferences (from signup).
• The messages you exchange with Toucan, and the structured data Toucan extracts from them: symptoms, medications and doses, food logs, and check-in preferences.
• If you add a caregiver: their phone number and the name you give them.

How we use it

• To provide the service: reminders, check-ins, summaries, and pattern detection, for you only.
• Caregiver updates happen only if you add someone. They get a short weekly note with how many med doses you logged and how many days you checked in, never your symptoms or details, and you can remove them anytime without them being told.
• If you start a text with FOR DEVELOPER:, that note (and your first name, if you've shared one) goes to the person who builds Toucan, so they can fix bugs and add what you ask for.
• To deliver the service, your messages necessarily pass through two service providers acting on our behalf: our messaging provider (Blooio, which operates the iMessage delivery infrastructure) and our AI provider (Anthropic, which generates Toucan's replies). Anthropic does not use API data to train its models by default.
• We do not sell your data. We do not share your health information with advertisers. Ever.

Storage & security

• Encrypted at rest: your health information (messages, symptoms, medications, doses, food logs, conditions, allergies, and doctor notes) is encrypted in our database with AES-based encryption, with decryption keys stored separately from the data. A stolen copy of the database is unreadable without the key.
• Encrypted in transit: all connections use TLS/HTTPS.
• Strictly separated: every account's history is isolated by design. The AI is only ever given your data when talking to you. No other user's information can appear in your conversation, or yours in theirs.
• An honest note on end-to-end encryption: a texting service like Toucan can't be end-to-end encrypted the way your personal iMessages are, because Toucan has to read your messages in order to reply. What we can do is minimize what's stored, encrypt it, restrict who can access it, and never sell it. That's our commitment.
• We are a consumer wellness service, not a healthcare provider, so HIPAA does not apply to Toucan. We still treat your data with that level of care, and we comply with the FTC Health Breach Notification Rule: if your health data is ever breached, we will notify you.

Your controls

• Text STOP anytime to stop all messages; START to resume.
• Text "delete my data" and we will permanently delete your account and all logs within 30 days.
• Ask Toucan "what do you know about me?" for a copy of your stored info.

Contact

Questions or requests: text Toucan a message that starts with FOR DEVELOPER: and it comes straight to the team.

← Back to Toucan