Your health data is isolated, encrypted, and yours.
TrackMyMarkers is built so that only you can reach your data — and only the people you choose can reach data you manage. Here is exactly how that works.
Access controls
The foundations of how we keep your data private.
Row-level security (RLS)
Every table that stores your data is protected by row-level security policies. The database itself enforces that a request can only read or write rows belonging to the authenticated user — there is no application-level bypass.
Strict profile isolation
Each family profile keeps a fully independent history. Profiles cannot read or write another profile's data, even within the same family plan. Isolation is enforced at the database level, not just in the UI.
Private file storage
Uploaded lab reports are stored in private storage buckets. Files are never publicly accessible — access is granted on a per-user, per-profile basis.
Signed URLs
When you view an uploaded report, TrackMyMarkers issues a short-lived signed URL that grants temporary access to that specific file. Access expires automatically and is scoped to you.
Input validation
All user input — marker values, units, dates, notes — is validated before it is stored. Quantities, formats, and required fields are checked server-side to keep your history clean and consistent.
Audit logging
Significant actions on your account are recorded so there is a trace of what happened and when. This supports transparency and helps investigate unexpected changes.
Strict profile isolation
Family profiles are convenient, but convenience never compromises isolation. Each profile is a separate boundary. The database policies ensure that a request tied to one profile simply cannot reach another profile's rows or files.
- Profiles cannot read or write each other's data
- Isolation enforced at the database, not only in the UI
- Reminders, AI summaries, and exports are all profile-scoped
Profile boundaries
Alex · Self
Reports, markers, files
Jordan · Spouse
Reports, markers, files
Private storage & signed URLs
The lab reports you upload are kept in private storage. They are not publicly listed and cannot be guessed. When you need to view one, TrackMyMarkers generates a signed URL — a temporary, tamper-resistant link scoped to your account that expires shortly after.
- Files stored in private buckets, never public
- Access granted per user and per profile
- Signed URLs expire automatically after a short window
How a signed URL works
Input validation
Every value, unit, date, and note you enter is validated before storage. Required fields are enforced, numeric formats are checked, and out-of-range inputs are rejected — so your history stays clean and your charts stay accurate.
Audit logging
Significant actions — uploads, edits, deletions, exports — are logged so there is a trace of activity on your account. This supports transparency and helps you and us understand what changed and when.
You control your data
Your data is portable and deletable — on your terms.
Data export
Export your full marker history and recorded results at any time. Your data is portable — you can take it with you whenever you want, in standard formats.
Data deletion
You can delete individual results, entire reports, or your whole account whenever you choose. Deletion removes your data from your active history.
Your health data is never sold or shared with third parties. You control who sees it, and you can export or delete it at any time.
About our security posture
This page describes the technical controls TrackMyMarkers implements to protect your data. TrackMyMarkers is not certified under HIPAA, SOC 2, ISO 27001, or any similar compliance framework. The controls above are the ones we have built and operate; they are not a certification or a guarantee.
TrackMyMarkers helps users organize, track and understand laboratory results over time for educational purposes. It does not provide medical diagnosis or treatment and is not a substitute for professional medical advice.