LegalSecurity & Compliance Overview

Security & Compliance Overview

Version 5.0.0 · Effective 2026-10-18 · Operator Nativity Ltd

At a glance

Optimal processes health data, including pregnancy timing, meal logs, and related planner information. We take security seriously.
Data in transit is protected with TLS. Data at rest is encrypted using the controls of our infrastructure providers.
Sign-in is handled by our Authentication Provider. The public web application cannot use administrative database credentials.
Privileged operations such as account provisioning, deletion, and heavy compute run on a separate backend.
Access-control policies are designed so you can reach your own data, not other people's.
We do not use third-party advertising networks, session-replay tools, or marketing pixels on the product surfaces described in the Sub-processor List.
Report security issues to [email protected]. See our Vulnerability Disclosure Policy.

The full terms below control.

1. Why This Matters

Optimal is a pregnancy-nutrition planning product. The Services may hold information about your pregnancy timing, body metrics, laboratory results you enter, meals, symptoms, and conversations with the optional AI assistant. That is health information, and we treat it accordingly.

We use least privilege, encryption in transit, isolation of privileged credentials, and access controls that limit you to your own account. No method of transmission or storage is completely secure. We work to reduce risk, and we tell you how to reach us if something goes wrong.

2. Data Protection

In transit. Public endpoints are served over HTTPS with TLS.

At rest. Databases and object storage use encryption at rest provided by our infrastructure providers.

Authentication. Sign-in and sessions are managed by our Authentication Provider. Using the signed-in product requires a valid session.

Application isolation. The public web application does not hold or use administrative database credentials. Privileged operations, including account provisioning, deletion, and heavy compute, run on a separate backend.

Authorization. Access-control policies are designed so that a signed-in user can access their own data, not another user's data.

Secrets. Administrative credentials and operational secrets are kept on server-side systems. They are not shipped to browsers.

Product privacy choices. We do not embed third-party advertising networks, session-replay tools, or marketing pixels on the product surfaces described in the Sub-processor List. Named providers appear only in that list.

Full payment card numbers are handled by the Billing Provider. We do not store them.

3. What We Do Not Claim

We do not claim SOC 2, ISO 27001, HIPAA certification, "bank-grade" security, or "military-grade" security.

Optimal is a consumer wellness and nutrition product. We are not a healthcare provider. The consumer application is not a HIPAA covered entity unless we expressly enter a business associate agreement (BAA) for a future offering.

Payment card data remains in the Billing Provider's PCI scope.

4. Incident Response

If you believe there has been a security incident involving your account or our systems, please email [email protected]. If you are unsure whether something is a security issue, you may also write to [email protected].

When we become aware of a personal data breach, we assess severity, contain the issue, preserve evidence as appropriate, and notify affected users and regulators as required by law and our Privacy Policy.

This page is not a full incident-response playbook.

5. Vulnerability Reports

Good-faith security research is welcome under our Vulnerability Disclosure Policy. Write to [email protected]. Machine-readable contact information is published at https://beingoptimal.org/.well-known/security.txt.

6. Your Responsibilities

Protect your Authentication Provider credentials. Enable multi-factor authentication if it is offered.
Do not share your account, and do not send export files that contain health data over insecure channels.
Tell us promptly if you suspect account compromise: [email protected] or [email protected].
Nutrition scores and AI outputs are informational, not medical advice. See the Medical Disclaimer.