Privacy Policy

Effective: March 29, 2026

1. Information We Collect

METIS collects the following information when you create an account: your name, email address, and branch of military service. During the pilot program, we also collect your VA Benefit Summary Letter for verification purposes only. All health data you upload or connect (medical records, wearable data, genetic data) is stored exclusively on your device and is never transmitted to or stored on any METIS server.

2. How We Use Your Information

Account information (name, email) is used solely to: verify your eligibility for the disabled veteran pilot program, communicate with you about your METIS account and the pilot program, and provide customer support. We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Data Storage & Security

METIS is built local-first. Health data retrieved through METIS is stored on your device and encrypted at rest. Encryption keys are derived and held on your device only — Divergent Labs LLC does not hold them and cannot decrypt your health data. There is no METIS server that stores, processes, or has access to your health data. Your data is yours.

METIS implements the following technical safeguards:

Encryption at rest: health data is encrypted using AES-256-GCM.
Key derivation: the master key is derived from your password, on your device, using PBKDF2 with 250,000 iterations (SHA-256).
Non-extractable keys: session encryption keys are held as non-extractable CryptoKey objects and cannot be exported from your browser.
Local audit logging: authentication events (sign-in, sign-out) are recorded locally on your device.

4. Third-Party Data Sources

When you connect external data sources (currently VA.gov), METIS uses OAuth 2.0 to securely access your data from those services. Data retrieved from these sources is processed on your device and stored locally in encrypted form. METIS does not store your OAuth tokens on any server — they are kept in your browser session only.

5. VA Data

METIS accesses VA health data through the VA Lighthouse API program with your explicit authorization. VA data is subject to the VA's own privacy policies in addition to this policy. METIS does not share your VA data with any third party. All VA data retrieved is processed and stored exclusively on your device.

6. Cookies & Analytics

METIS does not use tracking cookies, advertising cookies, or third-party analytics services. The only browser storage used is your encrypted health data (IndexedDB), application settings (localStorage), and short-lived sign-in parameters such as OAuth CSRF and PKCE values (sessionStorage) — all stored on your device only.

7. Data Retention & Deletion

METIS gives you two distinct and independent deletion rights — one instant and fully in your hands, one governed by our 45-day commitment:

🔒 Your health data — instant, self-serve deletion, anytime.

All health data (medical records, wearable data, genomic data, lab results) is stored exclusively on your device, encrypted with keys only you hold. It is never transmitted to or stored on any METIS server. You can permanently delete it yourself at any time directly within the app, by clearing your browser data, or by uninstalling the PWA — no request needed, no waiting, no approval required. This is immediate and irreversible.

📋 Your pilot account data — deleted within 45 days of your request.

The only information Divergent Labs LLC holds is your name, email address, and branch of service, used solely for pilot verification and communication. The METIS pilot program runs for 2 months from the date of your enrollment. Upon your written request to support@divergentlabs-evolve.com, Divergent Labs LLC will permanently delete 100% of your pilot account data within 45 days of receiving your request. At the conclusion of the pilot program, all pilot account data is permanently deleted regardless. Divergent Labs LLC retains zero participant data after the pilot ends.

In short: your health data is yours to destroy instantly, at any time, without asking anyone. The 45-day window applies only to the minimal administrative record we hold for pilot verification — your name, email, and branch of service. That is the entirety of what Divergent Labs LLC stores.

8. Children's Privacy

METIS is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When changes are made, we will notify you directly via the email address associated with your account prior to the changes taking effect. Changes will also be posted on this page with an updated effective date. Continued use of METIS after changes constitutes acceptance of the revised policy.

10. Contact Us

For privacy-related questions or to request deletion of your account information, contact: support@divergentlabs-evolve.com

11. Data Breach Notification

In the event of a data breach affecting your pilot account information (name, email address, branch of service), Divergent Labs LLC will notify you at your registered email address within 72 hours of becoming aware of the breach. The notification will describe:

The nature and scope of the breach
The specific information affected
Steps Divergent Labs LLC has taken to contain and address it
Actions you may take to protect yourself, including requesting immediate account deletion, updating credentials on any connected services, or contacting relevant consumer protection authorities

Important: Your health data cannot be breached from METIS servers because it is never stored there. All health data lives exclusively on your device, encrypted with AES-256-GCM keys that only you hold. The only information held by Divergent Labs LLC is your name, email, and branch of service.

12. Business Transfer or Dissolution

In the event of a merger, acquisition, transfer of ownership, or dissolution of Divergent Labs LLC, you will be notified via email no less than 30 days in advance. At that time, you will have the right to choose one or more of the following options:

(i) Secure disposal or download — export or permanently delete your pilot account information and any locally stored health data before the transition occurs;
(ii) Continuity under consistent policies — Divergent Labs LLC will only complete a business transfer to an entity that agrees in writing to privacy and data protection policies at least as protective as those stated in this document; or
(iii) Account closure — request immediate deletion of all pilot account data prior to any ownership change, with confirmation provided to you within 45 days.

Any business transfer is additionally contingent upon the receiving entity honoring the permanent free access commitment made to all pilot program Veterans (see Terms & Conditions Section 11). This is a non-negotiable condition of any ownership transfer.

13. HIPAA Disclaimer

METIS Health Navigator is a personal health management tool designed to help individuals organize and understand their own health information. METIS is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), as it does not provide healthcare services, process insurance claims, or operate as a healthcare clearinghouse.

If you use METIS to connect to a HIPAA-covered entity (such as VA), your data from those sources remains subject to the privacy protections of the originating covered entity. METIS does not alter or diminish those protections.

14. VA Lighthouse API Compliance

METIS accesses VA health data exclusively through the VA Lighthouse API platform, operated by the U.S. Department of Veterans Affairs. Use of VA data through METIS is subject to the VA Lighthouse API Terms of Service in addition to this Privacy Policy.

Specifically, METIS commits to the following in compliance with VA API program requirements:

No secondary use: VA health data retrieved through METIS is used solely for the purpose you authorized — personal health management. It is never sold, shared, or repurposed.
No server-side retention: VA data is never transmitted to or stored on any METIS server. All VA data is processed and stored exclusively on your device.
User-initiated access only: METIS only retrieves VA data when you explicitly initiate a connection or sync. No background polling or automated data collection occurs without your action.
Token handling: OAuth 2.0 tokens issued by VA are stored in your browser session only. They are never logged, exported, or stored persistently. Tokens are cleared when you log out or close your browser.
Revocation support: You may revoke METIS's access to your VA data at any time through your VA.gov account settings. Upon revocation, no further VA data can be retrieved, and previously downloaded data remains on your device under your control.