Privacy Policy

1. Who is responsible

Myron is operated by the operator of sana.health (“Sana”, “we”, “us”). Sana is the controller of the personal data described in this policy. You can reach us about privacy at privacy@sana.health.

This policy applies to the Myron web application at studio.sana.health and any other address where we host it, its APIs and MCP connector (the “Service”). It does not cover Sana's public websites, telehealth services or other products, which have their own notices. Our Terms of Service govern use of the Service.

2. Whose data this covers

• Team members: employees, contractors, agency staff and other people a Sana administrator has invited to the Service.
• People who appear in content: people whose image, voice, name or words appear in material uploaded to or generated in the Service, for example in a reference ad or a creator's footage.
• People who contact us about the Service.

If you are a Sana employee or contractor, Sana's internal privacy notices for staff also apply to you. This policy adds detail about the Service.

3. What we collect

From you and your administrator

• Account data: name, email address, role (admin, manager or member), team, spend limits and the date your account was created, changed or disabled.
• Credentials: your access token and password, which we store only as one-way hashes (SHA-256 for tokens, scrypt for passwords), and your sign-in links.
• Content: everything you upload, import, paste or write, such as products and product images, reference ads, video, audio, voices, briefs, scripts, research, prompts, notes, comments, approvals and feedback, and the Outputs you generate.

Automatically, when you use the Service

• Activity data: what you did and when, such as sign-ins and sign-outs, projects and runs you create, generations and their prompts, models and settings, edits, downloads, connector requests, credits quoted and spent, and top-ups granted and by whom.
• Technical data: IP address, browser user agent, request paths, timestamps, error messages and the name and redirect address of any AI tool you connect through the connector.

From third parties

• Content the Service downloads at your instruction from public sources (for example a public Google Doc, a Google Drive file or a public ad), which may contain images, voices or words of the people in it.
• Rows from Sana's Creative Sheet in Google Sheets, which may include team members' names and comments.
• Ad performance figures for Sana's own ad accounts from Meta. These are aggregate metrics about ads, not data about the people who saw them.

4. Why we use it and our legal bases

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on these legal bases:

Where we rely on legitimate interests, we have weighed them against your rights and interests. You can object at any time (see section 11). Account data is required to use the Service. Without it we cannot give you access.

5. Health and other sensitive data

The Service is not designed or intended to process health data or any other special category of personal data, and it is not a system for patient or customer records. Our Terms prohibit uploading patient, customer, prescription or order data, protected health information under HIPAA, and any information about an identifiable person's health, sex life or sexual orientation. Customer comments and research may only be used after anything that identifies the person has been removed.

If such data reaches the Service despite this, we delete it as soon as we become aware of it. If you think you have uploaded it, tell us at privacy@sana.health straight away.

6. AI processing

• The Service uses third-party AI models to write, analyse, review and generate content. Content you submit for a task is sent to the provider that performs it (section 7).
• We do not use your personal data to train AI models. We use providers' API or business offerings. Their own use of the data is governed by their terms.
• The Service scores and reviews creative work (for example ad concepts and renders). It does not make decisions about individuals that have legal or similarly significant effects. Spend limits are applied automatically, but administrators set them and can change them.
• If you connect your own AI assistant (such as Claude) through the MCP connector, the data that assistant reads from the Service is processed by its provider under your account with that provider. That provider acts independently of Sana for that processing.

7. Who we share it with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Inside Sana: administrators and managers can see team members' accounts, projects, Outputs, activity and spend. Other members can see shared projects and work in the team workspace.
• Service providers that process data on our behalf or provide the models and services the Service uses, currently:

• Professional advisers, such as lawyers, accountants and auditors, under confidentiality duties.
• Authorities and others where the law requires it, or where it is necessary to protect our rights, our users or others, or to respond to a valid legal request.
• Affiliates and successors: companies in Sana's group, and a buyer, investor or successor in a merger, acquisition, financing or sale of assets, subject to this policy.

We may change providers as the Service develops. We update this list when we do.

8. International transfers

The Service is hosted in the EU, but several providers process data in other countries, including the United States, Singapore and China. Where we transfer personal data outside the European Economic Area, the UK or Switzerland, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients), the European Commission's standard contractual clauses or their UK equivalent, or another transfer mechanism permitted by law. You can ask us for more information, or a copy of the relevant safeguards, at privacy@sana.health.

9. How long we keep it

We keep personal data only for as long as we need it for the purposes in section 4, then delete or anonymise it. We may keep data longer where it is needed for a legal claim, an investigation or a legal obligation.

10. Security

We use technical and organisational measures appropriate to the risk, including encrypted connections (TLS), one-way hashing of tokens and passwords, signed session cookies that scripts cannot read, sign-in rate limits and lockouts, role-based access, per-member spend limits, credentials that administrators can rotate or revoke at once, and storage on an access-restricted EU server with backups. No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the authorities where the law requires it.

11. Your rights

Depending on where you are, you may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have data erased, or its processing restricted;
• object to processing based on our legitimate interests;
• receive data you provided in a portable format, where processing is based on contract or consent and carried out by automated means;
• withdraw consent at any time, where we rely on consent (this does not affect earlier processing); and
• lodge a complaint with a data protection supervisory authority, in particular where you live, work or where the alleged infringement occurred.

Residents of California and some other U.S. states may also have rights to know, delete and correct personal information, and not to be discriminated against for exercising them. We do not sell or share personal information as those laws define it.

To use your rights, email privacy@sana.health. We may need to verify your identity. We respond within one month, which can be extended where the law allows. Some rights are limited by law, for example where data must be kept for legal claims, or where a copy would reveal other people's personal data or Sana's trade secrets or confidential information. Content and Outputs you created for Sana belong to Sana. Erasure or portability rights apply to your personal data, not to Sana's business records as such.

12. Cookies and local storage

The Service uses one cookie, swiper_session. It is strictly necessary to keep you signed in, cannot be read by page scripts, and lasts up to 30 days. Your browser's local storage also keeps display preferences on your device, such as light or dark appearance, sidebar state, studio preferences and unsent drafts. These stay on your device and are not sent to us.

The Service uses no analytics, advertising or third-party tracking cookies or pixels.

13. If you appear in content in Myron

If you believe your image, voice, name or words are in the Service without a lawful basis, for example in a reference ad that was imported for study, email privacy@sana.health with enough detail for us to find it. We will review the request promptly and, where appropriate, delete the material.

14. Children

The Service is only for people aged 18 or over. We do not knowingly collect personal data from children. If we learn that we have, we delete it.

15. Changes to this policy

We may update this policy, for example when we add providers or features. The updated version takes effect when it is posted at this address, unless a later date is stated. For material changes, we will try to give notice in the Service or by email.

16. Contact

Privacy questions and requests: privacy@sana.health. Other legal matters: legal@sana.health.