Privacy
Stellis Health keeps your health records encrypted with a key that only your password or your recovery key unlocks. This page states what Stellis collects, where it is stored, who processes it and what you can change. Effective October 27, 2026.
Stellis Health is an early test version. Use it to try Stellis with sample or test records until this page says otherwise.
What Stellis collects
- Account: your username, and the name and email in your profile if you add them. Stellis stores a one-way check of your password, never the password itself.
- Health records you add: reports and photos you upload, recordings and their transcripts, notes, readings, medicines, care plans, goals and conversations with Stellis.
- Connected calendars: if you connect Google or Microsoft Calendar, the sign-in tokens needed to read your events.
- Usage counts: how many AI tokens your account uses each day, to apply the daily limit.
- Server logs: the time, your IP address, the page or action requested without its search terms, and the result code. Logs never contain your records or messages.
- Debugging data, only if you choose it: "Keep my data for debugging" at sign-up keeps call audio and replies with your records.
Storage and encryption
- Your records are stored on a Stellis server in a Nebius AI Cloud data centre in the United States (region us-north1).
- Your records are encrypted with AES-256. The key is locked twice: once with your password and once with a recovery key shown to you once at sign-up. Stellis never stores your password, your recovery key or the unlocked key, so Stellis cannot read your stored records.
- While you are signed in, the server unlocks your records in memory to run Stellis for you. It locks them again when you sign out, after 30 minutes without activity, or when the server restarts.
- Every saved version is checked when it is opened. A changed or damaged file is refused, and your browser warns you if it is ever shown an older version than it last opened.
- Nebius also encrypts the server's disk.
- If you forget your password, your recovery key sets a new one. Without either, nobody can recover your records, including Stellis.
- Connections to Stellis use HTTPS. The server accepts only web and administrator connections, and its administrators sign in with keys.
Services that process your data
Nebius AI Cloud
Nebius runs the server that stores your encrypted records.
Nebius Token Factory
Answers, summaries, filing and care changes use the Nemotron models on Nebius Token Factory. Stellis sends only the records a task needs. Before sending, it replaces names, email addresses, phone numbers, record and health card numbers and birth dates with placeholders, and puts them back in the reply. Dates of tests and their results are sent as they are, because answers depend on them.
Zero data retention is on for Stellis's Token Factory account, so Nebius does not keep requests or replies. Nebius states that it does not use them to train models.
Nebius states that it does not use requests or replies to train models. Zero data retention is not yet confirmed for Stellis's Token Factory account, so Nebius may keep requests and replies in Finland to speed up later answers.
Public medical search
When an answer needs outside sources, Stellis searches Tavily directly when a key is available and otherwise searches MedlinePlus and PubMed. Searches use general medical terms only. A check before sending refuses any search that still holds names, numbers or other personal details.
Calendars
If you connect a calendar, Stellis reads your events from Google or Microsoft. It does not send them your records.
Speech
Transcription and the call voice run on the Stellis server. Recordings are not sent to another company.
What Stellis never does
- Stellis does not sell your data or share it for advertising.
- Stellis does not use your records to train AI models.
- Stellis does not show advertising.
Your choices
- Export: download your notebooks as Markdown or as a Stellis archive from each notebook's menu.
- Delete items: deleted items wait in Recently Deleted for 30 days, then are removed.
- Delete your account: Settings deletes your account and destroys your encryption key straight away, so every stored version becomes unreadable and is removed.
- Password: changing your password in Settings re-encrypts your key without changing your records. Forgot password on the sign-in page uses your recovery key.
- Calendars: disconnect a calendar in Settings at any time.
How long data is kept
- Records stay until you delete them or your account.
- Stellis keeps your latest encrypted version and the one before it.
- Server logs rotate at 30 MB, so they keep only recent requests.
Changes
Stellis updates this page when its practices change and changes the effective date above.