Privacy Policy

1. Introduction and application operator

Mark's Health Grok Bot is an independent application operated by Wyvern Innovations, also known as Wyvern Corp. The operator publishes this website at wyvern.com.ph. The application is not an official Google product and not an official xAI product. Google has not approved or verified it.

The operator’s published address is 12/F Times Plaza Building, United Nations Avenue, Ermita, Manila, Metro Manila, Philippines. Privacy contact: hello@wyvern.com.ph, or +63 906 215 3757 on weekdays from 9:00 AM to 6:00 PM.

For information collected through this application, Wyvern Innovations is the personal information controller under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173).

2. Personal information collected

The overview, privacy, and terms pages are public. They do not ask for an account, a name, or a health file.

Like other pages on this website, a request can produce ordinary server logs at the host: the page address, the time, the browser type, and the IP address used to deliver the page. Those logs are used to operate and secure the site. This application does not add a separate analytics account, advertising pixel, or marketing list.

The Wyvern contact form is a separate business-inquiry service. It is not part of Mark's Health Grok Bot and is not a way to submit medical records.

3. Health and medical information processed

These pages do not collect, read, or store health or medical information. There is no health account, no patient profile, and no connection to a clinic, laboratory, or insurer.

Health information is sensitive personal information. It will not be processed until a feature is built, this policy is updated, and the person has agreed to that specific use. Planned categories, which are not collected now, are laboratory results the person uploads, health history the person types, and wellness metrics from a Google service if that service is later connected.

4. Laboratory reports and uploaded medical documents

There is no upload control on these pages. Please do not email laboratory reports, medical images, prescriptions, or clinical notes to hello@wyvern.com.ph, and do not put them in the Wyvern contact form. The company does not operate a medical-file inbox here.

If a person sends health information anyway, it may sit in the company’s ordinary email or inquiry record until it is deleted. You may ask for that deletion at the address above. Before any upload feature opens, the application will have to state where the file is stored, who can open it, how long it is kept, and how to delete it.

5. Google account authorization

These pages do not offer Google sign-in. They do not receive a Google access token, refresh token, email address, or profile. No Google user data is accessed by Mark's Health Grok Bot today.

6. Google API permissions and requested scopes

No OAuth scope is requested. The application does not use a universal Google Health permission, because Google does not provide one permission that opens every medical record.

For accuracy, these are the relevant Google options and the application’s current use of each:

• Google Health API (health.googleapis.com) can cover specific data types, with separate read and write scopes such as activity and fitness, sleep, nutrition, and health metrics. This application calls none of those scopes.
• Health Connect uses on-device Android permissions. It is not a website OAuth scope. This application does not use it.
• Google Fit, including its REST API, is closed to new developers and is scheduled to remain supported only through the end of 2026. This application does not use it.

A future version will request only the scopes required for a feature that is actually available, and the Google consent screen will list them. Write access to health records is not requested and is not available.

7. Purpose of health-data processing

No health data is processed now. If processing begins, the purposes will be limited to the ones shown before consent:

• explaining information the person submitted, in plain language;
• organizing that information for the same person;
• summarizing metrics the person authorized from a supported source;
• offering general wellness information, not a diagnosis or prescription;
• securing the service, preventing abuse, and meeting a legal duty.

Health information will not be used for advertising, sold, or used to decide credit, insurance, or employment.

8. How health information is analyzed using AI

No health information is sent to an AI system from this website. The intended design is that a person confirms a specific request, and Grok, or another named model, returns an explanation of the information in that request.

The company has not verified a provider term that would forbid the provider from retaining prompts or using them to train models. Because that has not been verified, the upload and analysis feature stays off. It will not be enabled until the provider, the retention rule, and the training rule are stated on this page and shown again at the moment of consent.

9. Disclosure of information to xAI or other service providers

These pages do not disclose health information to xAI, Google, or any other AI provider.

The website itself is hosted so that pages can be delivered. The host can process the ordinary request logs described above. That hosting relationship is not a transfer of medical records.

If an AI provider is later used, the disclosure will name the provider, the country or region where processing occurs if the provider states it, and the categories of information in the request. No hidden recipient will be added for advertising.

10. Health-data storage, retention, and deletion

Mark's Health Grok Bot does not store health records, laboratory files, or Google health data, so it has no health-data retention period.

Ordinary website logs are kept by the host for its operational period. The company does not use those logs to build a health profile.

When a health feature exists, the product will state a retention period before the first upload, keep information only as long as the stated purpose requires, and delete it when the person asks or when the account is closed, unless a law requires a longer hold. That period is intentionally not invented here.

11. Data encryption and security measures

These pages are served over HTTPS. On an HTTPS request, the site also sends HTTP Strict Transport Security. The public pages do not store health information at rest, so there is no separate health-record encryption product to describe.

The company website limits the admin area, uses a content security policy, and does not put this application behind a public password because the pages are meant to be readable without an account. Those are website controls. They are not a claim of a certified medical-security program. No HIPAA, ISO, or other certification is stated because none has been established for this application.

OAuth tokens are not issued or stored, because Google sign-in is not implemented. A later version that stores a token will have to keep it secret, limit who can use it, and delete it when access is revoked.

12. User consent and privacy controls

Reading this policy does not authorize the company to collect your health information. Consent will be requested at the time a feature needs it, for the purpose shown then. You may refuse. The public pages remain available if you do.

You may ask what information the company holds about you, ask for a correction, or ask for deletion, using the contact details above. For these pages, the usual answer is that no health file is held.

13. Google API Services User Data Policy and Limited Use

The application currently receives no Google user data, so Limited Use has no Google data to cover.

If Google user data is later received, Wyvern Innovations will use it only to provide or secure the user-facing feature the person enabled, and to comply with applicable law. It will not be sold. It will not be used for advertising, creditworthiness, or training a generalized model unrelated to that feature. Human access will be limited to cases where the person asks for it, where it is needed for security or a legal obligation, or where it is aggregated and cannot reasonably identify the person. This is the Limited Use commitment in the Google API Services User Data Policy.

14. Revoking Google account access

There is no Google connection to revoke. If one is added later, you can remove Mark's Health Grok Bot from Google Account permissions. You can also ask the company to delete tokens and stored Google data. Revocation stops further access. It is not, by itself, the same as deleting copies already stored, so the deletion request still matters.

15. Health record correction and deletion requests

Send correction and deletion requests to hello@wyvern.com.ph. Include the email address you used and enough detail to find the record, without attaching more medical information than necessary.

The company will not correct a clinician’s original laboratory report. It can correct or delete a copy that the application itself stored, once that storage exists. Today there is no application copy to correct.

16. User rights under applicable data protection laws

Under the Philippine Data Privacy Act, a data subject may be informed, object, access, correct, erase or block, and lodge a complaint with the National Privacy Commission, subject to the conditions in the Act and its rules. Where another law applies because of where you are, the company will honor the rights that law actually gives you.

Rights requests can be sent to hello@wyvern.com.ph. The company may need to confirm that the requester is the person concerned before releasing or deleting information. Sensitive health information will not be sent to an unverified address.

17. Data breaches and security incident management

If a breach involves personal information the company holds, Wyvern Innovations will assess the incident, contain it, and notify the National Privacy Commission and affected persons when the Data Privacy Act and its regulations require notice. Because this application does not hold health records today, a breach of these public pages would concern ordinary site logs rather than a medical file.

18. Third-party integrations and processors

Current processors are limited to the infrastructure that delivers this website. No laboratory partner, Google health API, Health Connect connection, or xAI processing step is in use for this application.

The company will not add a processor for health information without naming it in this policy first. Processors will be bound to the purpose the person was shown.

19. Privacy policy updates

If the application begins to collect health information, connect to Google, or send information to an AI provider, this policy will be updated before that change, and the effective date at the top will change. Continued use of a new feature after the updated policy is presented will follow the consent step shown for that feature. Reading the public pages does not lock you into a future feature.

20. Contact information and effective date

This policy is effective 12 November 2026.

Wyvern Innovations (Wyvern Corp.)
12/F Times Plaza Building, United Nations Avenue, Ermita, Manila, Metro Manila, Philippines
hello@wyvern.com.ph
+63 906 215 3757

Related pages: application overview and Terms of Service.