Synapse Social, Inc. (“Synapse,” “we,” “us,” or “our”) operates the Synapse research platform and the Hera mobile app for personal health cases. This Privacy Policy describes how we collect, use, share, and protect your information when you use synapsesocial.com, our mobile applications, and related services (collectively, the “Services”).
Information We Collect
Depending on how you use the Services, we may collect:
- Account information — name, email address, sign-in identifiers, timezone, professional affiliation, and profile photograph (likeness) when you register or complete your profile
- Health case information (Hera) — case titles and descriptions, chat messages, confirmed health profiles (conditions, medications, symptoms, lab values, notes), and medical records you upload (PDFs, images, text files)
- Voice input (Hera voice beta) — live microphone audio during an active voice session; raw audio is not stored by Synapse after the session ends
- Article text (browser extension) — when you ask the Synapse browser extension a question about a paper, the text of the article page you are reading is sent to Synapse to answer it. When you save or repost that paper while signed in, Synapse may store that article text with the paper to build its summary, PICO and key findings. It is used for those derived outputs and for answering questions; it is never published or redistributed as the article
- Usage data — pages visited, features used, device type, and interaction patterns within the platform
We collect health information directly from you when you type it, upload records, or speak during a voice session. We do not purchase health records from third parties.
How We Use Your Information
We use your information to:
- Provide, operate, and improve the Synapse and Hera Services
- Build and update your health case profile from the information and records you provide
- Generate citation-grounded research briefs, intake summaries, and suggested questions for your clinician
- Power conversational features (typed chat and voice) within your health case
- Send optional weekly digest emails when you enable them for a health case
- Communicate about product updates, support, and account matters
- Include your name, profile photograph, and professional affiliation in outreach emails and invitations we send to your coauthors and professional peers when relevant to your shared work (for example, to let a coauthor know you are on Synapse or invite them to a discussion) — you can opt out of this use at any time, as described in “Your Rights” below
- Analyze aggregated usage to improve reliability and product experience
- Create de-identified and aggregated datasets, and share them with research and AI data partners, as described in “Research and AI Data Partners” below
We do not use your health information for advertising, and we do not sell your personal information. Data we provide to research and AI data partners is either de-identified or shared at your direction, with your opt-in consent.
Third-Party AI and Service Providers
To provide Hera’s health-case features, we send certain personal data to third-party service providers. Before sending your health information to a third-party AI service, the Hera app asks for your explicit consent and explains what data is sent and who receives it.
Third-party AI providers we use for Hera:
- Google (Gemini / Google AI APIs) — we send your case description, chat messages, uploaded record contents, confirmed profile details, and live voice audio (during voice sessions) so Gemini can read your records, respond to questions, and generate research briefs. Google processes this data under its enterprise AI terms; we configure our use so your data is not used to train consumer advertising models.
- Exa — we send search queries derived from your case (not your full medical records) to retrieve recent medical research and news from the public web when generating briefs.
Other service providers that help us operate the platform (under contractual obligations to protect your data):
- Amazon Web Services (AWS) — encrypted hosting, storage, and databases
- Firebase (Google) — authentication
- Sentry — error monitoring (may include technical metadata, not medical record contents)
- Customer.io — transactional and digest email delivery
We require these providers to protect personal data with safeguards comparable to our own. We share only what is necessary to deliver the feature you requested.
Google User Data (Gmail Research Alerts)
Synapse lets you optionally connect your Gmail account to turn the research alerts you already receive (for example Google Scholar, PubMed and journal table-of-contents alerts) into Synapse feeds. Nothing is read until you click “Connect Gmail” and approve access on Google’s consent screen.
- What we access — using the Gmail read-only permission, we search your mailbox once for research-alert emails from the past 12 months (up to 600 messages). For those messages we read the sender, subject and date. For PubMed alerts only, we also read the message body, because PubMed places the saved search there. We do not read, open or store any other email.
- How we use it — only to extract the search terms, topics and journal names of your alerts and show them to you so you can choose which ones to turn into feeds. The extraction is done by our own code; email content is not sent to any AI model or third party.
- What we keep — Synapse never stores your email messages or a long-term Google access credential. The one-time access token is used for a single scan and then revoked. The list of alerts we found is deleted automatically within 24 hours. Only the feeds you choose to create are kept, as part of your account.
- Sharing — we do not sell, share or transfer data obtained from Gmail to anyone, and we do not use it for advertising, for building user profiles for advertising, or to train AI or machine-learning models. No Synapse employee reads it.
- Your control — you can disconnect from within Synapse or remove Synapse’s access at any time at myaccount.google.com/permissions.
Synapse’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Advertising Measurement (LinkedIn)
When we run LinkedIn ads, we may load the LinkedIn Insight Tag to measure how many people those ads bring to Synapse. It starts only when you arrive on one of our “This Week” research pages from one of our LinkedIn ads, and only for visitors in the United States. It never starts on any other page, when you arrive from a link we sent you personally, for visitors outside the United States, for traffic we identify as automated, or when your browser sends a Global Privacy Control signal. Once it starts, it stays active for the rest of that visit in the same browser tab: LinkedIn may set cookies and receive the address of that page and of other Synapse pages you open in that tab, along with standard browser information. LinkedIn reports results to us only in aggregate. We use the tag only for this measurement, not to build audiences for targeting ads. We never share your account details or health information with LinkedIn. LinkedIn members can turn off ad measurement in their LinkedIn advertising data settings, and you can block cookies in your browser.
Research and AI Data Partners
Synapse may share data with research organizations and AI developers, including third-party AI companies, that use expert medical judgment to build, train, and evaluate AI models. This applies only to data created on or after November 20, 2026; earlier data is shared only if you opt in.
- De-identified and aggregated data — such as aggregated reading and engagement signals and poll or debate votes, with your name, email, photograph, and other direct identifiers removed, keeping only broad attributes such as specialty and training stage. We take reasonable measures so this data cannot be linked to you, keep it in de-identified form, and contractually prohibit recipients from re-identifying anyone. This is shared unless you opt out.
- Your words, voice, and identity — the text of your comments, takes, and debate arguments, your research questions, recordings or transcripts of your voice, and anything that names you are shared only if you opt in to a Synapse expert data program.
- Never shared with these partners — Hera health case information, data obtained from Gmail, and account credentials.
Partners must use the data only for research and AI development and protect it with appropriate safeguards. Our Terms of Service describe this program in full.
Data Sharing
We may share your information only in these circumstances:
- With the service providers described above, to operate the Services you use
- With LinkedIn, limited to the advertising measurement described above, when you arrive from one of our LinkedIn ads
- If required by law, regulation, or valid legal process
- In connection with a merger, acquisition, or sale of assets (with notice where required by law)
- With your explicit direction (for example, when you request researcher contact)
- With your coauthors and professional peers, limited to your name, profile photograph, and professional affiliation, when we send the outreach emails described above
- With research and AI data partners, limited to de-identified data or data you opt in to share, as described above
Data Security
We use commercially reasonable technical and organizational measures to protect your information, including encryption in transit (TLS) and at rest for stored medical records. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Data Retention and Deletion
We retain your account and health case data while your account is active. You may delete your Hera account from within the app, which permanently removes your account, health cases, and associated records from our systems (subject to limited backup retention). You may also request deletion by contacting us at nikko@synapsesocial.com.
Your Rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to withdraw consent for AI processing (which may limit Hera features). You may also opt out of the use of your name, profile photograph, and professional affiliation in outreach emails to your coauthors and peers; opting out applies to future communications and does not retract messages already sent. You may opt out of de-identified data sharing with research and AI data partners, or withdraw from an expert data program; this applies to data shared after we process your request and does not recall data already delivered. Contact us at nikko@synapsesocial.com to exercise these rights.
Educational Use Only (Hera)
Hera is an educational and informational tool. It does not provide medical advice, diagnosis, or treatment, and is not a substitute for professional medical care.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the effective date. Material changes to how we use health information or share it with AI providers will be communicated in-app where required.