What holds your record, and what it refuses to do with it.

Traffic between the application and its database is encrypted and the database’s certificate is verified against a pinned authority, so an encrypted connection to the wrong host fails instead of succeeding quietly. That verification is checked by its own command rather than assumed.

Passwords are stored as argon2 hashes, never as recoverable text. Credentials live in their own isolated part of the schema, separate from health data.

Sessions use a short-lived access token in memory and a refresh cookie the browser cannot read from JavaScript, restricted to the site and to the authentication path. Repeated failed sign-in attempts are rejected before they reach the password check.

Access to health data is recorded, and those records cannot be edited or deleted — a database trigger refuses both, so the guarantee does not depend on application code remembering to honour it.

There is one exception and it is deliberate: when a person asks to be erased, the trail keeps what happened and drops the link to who they were. That is anonymisation rather than revision, and every other column stays byte for byte as it was written.

The boundaries this product holds to — that a running experiment must have a prediction recorded before it starts, that a completed one must have an outcome, that a blocked protocol cannot be activated — are enforced by database constraints as well as by application logic, and the test suite attacks them directly over SQL rather than through the application that is supposed to prevent them.

A safety rule that only exists in a code path is one refactor away from not existing.

There is no analytics script, no advertising network and no third-party tracker on this site. Cookies are set only after you sign in and only to keep you signed in; the cookie policy names each one and what it does. Privacy covers what is held, for how long, and how to get it back or have it erased.

Wellovue has not completed an external security audit and holds no security certification. It is not a certified medical device and has not been through clinical or regulatory review. Its legal terms carry placeholders pending review by a qualified lawyer.

None of that stops the engineering above being real, and none of it should be discovered by a reader after they have trusted the product with a health record.

If you believe you have found a vulnerability, please get in touch with enough detail to reproduce it. Please do not access, modify, or retain anybody else’s data while investigating.