ForeSight privacy notice
Effective October 10, 2026 (beta version 1.0).
ForeSight collects only what it needs to show you your own health picture, and it never sells or advertises with your data.
Who we are
ForeSight is run by Rajesh Dubey, doing business as Xero Labs, Fremont, California. Contact: hello@xerolabs.ai.
What we collect and why
| What | Examples | Why |
|---|---|---|
| Account | Email address, a one-way (argon2id) password hash | Sign-in, password reset, service email |
| Security records | Each signed-in device's IP address and browser, sign-in attempts | Your device list, sign-out of other devices, stopping attacks. Never used for analytics or support |
| Health data you add | CGM readings (CSV upload or Libre sync), lab reports and values, blood pressure, weight, meals, medications, activity, notes | Charts, metrics, trends and summaries for you |
| Profile | Optional name, date of birth, diabetes type, targets, timezone | Correct calculations and labels |
| AI summaries | Weekly and period summaries generated for you | Shown in the app and, if you opt in, emailed |
| Access log | Which automated job or tool touched your data, when | So you can see every access to your data |
We do not collect a medical record number, social security number or insurance details. We do not use advertising, analytics or third-party tracking.
We use your data only to run ForeSight for you: calculating metrics, generating summaries, sending email you asked for, and keeping the service secure.
AI
Summaries are written by AI models running on servers Xero Labs owns and operates, reached over a private encrypted network link. For summaries, only aggregated metrics (such as averages and time in range) are sent to the model, never your name, email or date of birth. When you upload a lab report, the whole document is read by a model on those same servers to extract your results; it never goes to a third-party AI provider. Summaries describe patterns only. They never give dosing, medication or treatment advice. If we ever move summaries to a third-party AI provider, we will tell you before the change and update this notice.
Sharing and service providers
We do not sell or share your data for advertising. We use these service providers to run ForeSight:
| Provider | Role | What it can see |
|---|---|---|
| DigitalOcean (US, San Francisco region) | Hosts the app, database and backups | Stores encrypted and access-controlled data on our server |
| Proton | Sends app email from xerolabs.ai | The emails we send you; Proton keeps a copy of sent mail with its zero-access encryption |
| Tailscale | Private network link between our servers | Coordinates the encrypted link; your data travels inside the encryption |
| Abbott LibreLinkUp (only if you turn on Libre sync) | Source of your live CGM readings | Your Libre sign-in, which you give us; we use it only to fetch your readings |
| Cloudflare | Hosts the xerolabs.ai website and waitlist, and the xerolabs.ai domain's DNS | Website visits and waitlist answers, not your ForeSight health data |
Libre sync uses an unofficial Abbott interface. It is an optional beta feature and may stop working without notice.
We disclose data if the law requires it, and we will tell you unless we are legally prevented.
Security
- Your documents, notes, personal details and AI summaries are encrypted with a key unique to you.
- Your readings and lab values are protected by per-account access controls enforced inside the database, and all data is kept on encrypted storage.
- Backups are encrypted.
- Our staff tools cannot read your health data; operator tools see counts only, and every access by a job or tool is logged and visible to you under Account security.
- No method is perfectly secure; we will tell you promptly if a breach affects your data (see below).
How long we keep data
| Data | Kept for |
|---|---|
| Your account and health data | Until you delete it or your account |
| Encrypted backups | 30 days, then destroyed |
| Access log (contains no health data) | 1 year |
| Security records for signed-out devices | Removed when the session expires |
Your rights
You can export or delete everything yourself, at any time, from Account security.
Export. After re-entering your password, you get one file with all your data and documents, decrypted, as JSON and CSV.
Delete. After your password and typing your email, your account and all your data are deleted immediately, and your encryption key is destroyed so nothing left can be read. Copies inside backups made before the deletion expire within 30 days.
Correct. You can edit or remove any entry in the app, or ask us at hello@xerolabs.ai.
State privacy laws. We ask for your consent before collecting health data, and you can withdraw it by deleting your account. California and Washington residents (including under Washington's My Health My Data Act) have rights to access, delete and withdraw consent; email hello@xerolabs.ai and we will respond within the legal deadline. Xero Labs is not a healthcare provider or a HIPAA covered entity.
Breach notice. If a security breach exposes your health data, we will notify you and, where required, the US Federal Trade Commission, without unreasonable delay.
Children
ForeSight is for adults 18 and over.
Changes
We will email you before any material change takes effect, and ask for your consent again where the change affects how your health data is used.
Contact
hello@xerolabs.ai
Version 1.0-beta