Selja Health
Back to home

Privacy

Last updated: 28 September 2026.

This page describes how Leah AI, Inc., which trades as Selja Health, handles information when you visit our website at seljahealth.com and contact us. We try to keep this short because we collect very little. Leah AI, Inc. is the controller of the information described here, and you can reach us about any of it at privacy@seljahealth.com.

What we collect

Information you send us. Our website does not require accounts, sign-ups, or form submissions. The only personal information we receive is what you choose to send us by email through the contact link on the site. That includes your name, your email address, your organization if you mention it, and whatever you write in your message.

Information collected automatically. Our website is served by Cloudflare, Inc., our hosting and content delivery provider, which may collect basic technical information such as IP address, browser type, and the pages requested, for the purpose of operating the site and protecting it from abuse. Cloudflare processes that information on our behalf as our service provider. We receive no analytics from it and we do not use it to identify you.

What we do not collect. We do not use analytics, tracking pixels, advertising services, or embedded third-party content. Our fonts are served from our own domain rather than a font network. We do not build profiles, and we do not track you across other websites. We do not collect health information through this website.

In the language California law uses, the categories of personal information we collect are identifiers (your name, email address, and IP address), internet or other electronic network activity information (browser type and pages requested), and any other information you choose to put in a message to us, which may include professional or employment-related information such as your role or institution. We collect it from you directly, and automatically from your device when you request a page. We collect no sensitive personal information, and we have collected no other categories in the preceding twelve months.

Cookies and tracking

This website sets no cookies. It does not use local storage, session storage, web beacons, fingerprinting, or any similar technology, and it ships no JavaScript files at all. There is nothing here to consent to and nothing to opt out of.

Do Not Track. Some browsers send a "Do Not Track" signal. Because we do not track visitors across third-party websites or over time in the first place, there is no behaviour for that signal to change: we treat every visitor as though the signal were set. We also do not permit third parties to collect personally identifiable information about your activity on this site for their own purposes: no third-party scripts or embedded content run on it, and our hosting provider may use what it collects only to deliver and protect the site for us.

How we use information

We use the information you send us to respond to your message, to maintain a record of our correspondence, and to communicate with research partners and others who have asked to hear from us. We use technical information to operate, maintain, and protect the website, and we use either where the law requires it. We do not use any of it for advertising, for profiling, or to train machine learning models.

How we share information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months. We do not share information with advertisers or data brokers for their own marketing.

We disclose information only in these cases:

  • Service providers. Vendors who help us operate the site and our communications, such as our hosting and email providers, under contracts that limit what they may do with it.
  • Legal requirements. Where we are required to by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect rights, safety, or property.
  • Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will give notice on this website before your information becomes subject to a different privacy policy.

Research data and patient information

This page covers the website only. Patient data collected by the academic research program stays with that program, under its own agreements and approvals. The patient data Selja works with is de-identified before use, is governed by separate data use agreements with the institutions that provide it, and is handled under the Health Insurance Portability and Accountability Act (HIPAA) where that applies. None of it passes through this website, and we do not receive it here.

Please do not email us patient information. We hold no Business Associate Agreement with you, and ordinary email is not a secure channel for it. If you need to discuss a specific case, write to us first and we will arrange a secure channel.

How long we keep it

We keep correspondence for as long as the relationship it belongs to is active, and for a reasonable period afterwards so that we can pick a conversation back up. In practice, that is up to three years from our last exchange, unless a longer period is needed to meet a legal obligation, resolve a dispute, or enforce an agreement. Server logs held by our hosting provider are kept for the short period that provider uses for operations and abuse prevention. We do not maintain a public archive of correspondence, and you can ask us to delete your messages sooner.

Security

We use technical and organizational measures designed to protect information against unauthorized access, loss, and alteration. The site is served only over HTTPS. No system is perfectly secure, and we cannot guarantee the security of information sent to us. Email in particular is not a secure channel: if you have something sensitive to send, ask us about a secure method before sending it.

Your rights

Wherever you live, you can ask us to do any of the following, and we will do it unless the law requires us to keep something:

  • Access. Ask what information we hold about you and get a copy of it.
  • Correction. Ask us to correct information that is wrong or incomplete.
  • Deletion. Ask us to delete information we hold about you.
  • Portability. Ask for your information in a portable format.
  • Objection. Object to a particular use of your information.

To exercise any of these, email privacy@seljahealth.com. We will respond within the time the applicable law allows, and we may need to ask you for enough information to confirm who you are. You may use an authorized agent. We will never deny you a service, charge you a different price, or give you a lesser quality of service because you exercised a privacy right.

California. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have the rights above, plus the right to know the categories of personal information we collect and the purposes we collect it for, both set out on this page, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of and we provide no "Do Not Sell or Share My Personal Information" link. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit it.

Texas. Under the Texas Data Privacy and Security Act, Texas residents have the rights above, including the right to obtain a copy of personal data we hold. If we decline a request, you may appeal by replying to our decision at privacy@seljahealth.com. We will tell you the outcome of the appeal, with reasons, within sixty days, and if we deny the appeal we will tell you how to complain to the Texas Attorney General.

Where we operate. Leah AI, Inc. is based in the United States. This website is directed to clinicians, researchers, and health systems in the United States, and we do not offer goods or services to, or monitor the behaviour of, people in the European Economic Area, the United Kingdom, or Switzerland. We have not appointed a representative under Article 27 of the General Data Protection Regulation because we do not carry on the activities that require one. If you write to us from outside the United States, your message is received and stored in the United States, and the rights listed above are ones we will honour wherever you live. If our activities change so that European or United Kingdom data protection law applies to us, we will update this page and appoint a representative before that change takes effect.

Children

This website is intended for clinicians, researchers, and health systems. It is not directed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us information, email privacy@seljahealth.com and we will delete it.

Updates and contact

We will update this page as our practices change. The "Last updated" date at the top reflects the most recent revision. If a change is material (if we begin collecting something we do not collect today, or use it for something new), we will say so prominently on this website before the change takes effect.

For questions about this page or our handling of information, contact us at privacy@seljahealth.com.