Security

Last updated: July 2026

This page describes how TianJi Health approaches security for user data, accounts, and AI-assisted content.

Data handling

We collect only the minimum needed to operate the Service: birth dates for wellness calculations, optional location for regional context, and anonymous session IDs for quota tracking. Inputs are processed to generate outputs and are not kept as a clinical record. Saved reports exist only when you explicitly save them to a registered account.

Account protection

When accounts are enabled, authentication, session management, and billing are handled through a dedicated gateway provider. Passwords are never stored in plaintext in this application — the gateway manages credential hashing and token-based sessions. Prefer a unique strong password and multi-factor authentication when the gateway offers it.

AI safety boundaries

Large language models only translate and format retrieved classical text. Core Yunqi calculation is deterministic and does not use AI. Citation verification and safety taxonomy filters run before AI-assisted output is displayed. AI must not invent pathology, diagnoses, or citations.

Transport and storage

Public traffic is served over HTTPS. Dynamic account data and saved reports live in managed infrastructure with encryption at rest where provided by the platform. Frontend-to-API calls should not expose secrets in the browser.

Responsible disclosure

If you believe you found a security vulnerability, contact us via the Contact page with enough detail to reproduce the issue. Please avoid public disclosure until we have had a reasonable window to investigate and remediate.

Incident response

If a personal-data breach is confirmed, we aim to notify affected registered users and relevant authorities as required by applicable law (including GDPR timelines where they apply). A summary may be published here after remediation when appropriate.

Changes to this policy

We may update this security page as the Service evolves. Material changes will be reflected in the last-updated date above.