Privacy Policy

Lanza AI ("Lanza," "we," "us," or "our") is an AI marketing service for doctors and small medical practices, available at lanzaai.com. Lanza is a product of Endurant Healthspan, Inc., a Delaware corporation, the entity responsible for your data under this policy.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. If you have questions, contact us at privacy@lanzaai.com.

Account information: email address, password (stored securely by our auth provider), and sign-in method (email or Google).

Practice profile: specialty, location, practice name, marketing goals, voice preferences, brand details, and other information you provide during onboarding.

Connected channels: OAuth tokens and metadata needed to manage your social media accounts, video channels, Google Business Profile, advertising accounts, and related integrations. We do not receive or store your social media passwords when you connect through official platform authorization.

Content and workflow data: draft posts, approval decisions, publishing schedules, and performance summaries generated inside Lanza.

Billing information: subscription status and payment details processed by Stripe. We do not store full credit card numbers on our servers.

Usage data: log data such as IP address, browser type, pages visited, feature usage, and session replays of interactions with the Lanza interface. Rendered text, form and text-entry values, images, video, and canvas content are masked or blocked in session replays, and we do not record network request or response bodies.

Lanza is built for healthcare marketing, not clinical care. We do not ask you to enter patient names, diagnoses, treatment records, insurance details, or other protected health information (PHI).

Do not upload patient records, clinical notes, or identifiable patient information into Lanza. If PHI is submitted despite this policy, we will take steps to delete it and may suspend the account.

When you connect a channel, Lanza accesses and stores only the data and tokens needed to provide the features you request, and only for the accounts you authorize. By platform:

• Meta (Facebook, Instagram, Threads): account profile and identifiers, the content you publish, and post analytics/insights. Used to publish and read analytics for the accounts you authorize, under the Meta Platform Terms and Developer Policies.
• TikTok: your creator and profile information (such as nickname, avatar, privacy options, interaction settings, and maximum video duration) and the content you publish. Used to publish the videos you direct and to show you accurate posting options.
• X (Twitter): account profile, the posts you publish, and post analytics. Used to publish and read analytics for your account.
• LinkedIn: profile information, the posts and articles you publish, and analytics. Used to publish on your behalf; we obtain your consent before accessing your LinkedIn content.
• YouTube (Google): channel profile, the videos you publish, and video analytics. Used to publish and read analytics for your channel.
• Google Business Profile: business profile, locations, reviews, and local insights. Used to align content with local patient discovery.
• Advertising connections (when connected): selected ad account identifiers and campaign information, including performance fields such as impressions, clicks, and spend when the platform returns them. Used to provide the reporting and campaign features you enable.
• Meta Business (when connected): selected Business, Page, ad account, catalog, pixel, campaign, creative and reporting-resource identifiers and fields needed for the advertising features you authorize, including selected Page posts used in that work. Lanza uses this information to answer your advertising questions and, where enabled and authorized, prepare and manage campaign work on your selected resources. Permissions, your saved action choices and any required approval limit what Lanza can do.
• Google Search Console (when connected): the selected site property identifier, search queries and performance, page URLs, inspection results, and sitemap information returned by Google. Depending on the enabled features and permissions you grant, Lanza may read this information and, where management access is enabled, manage the selected site property and its sitemaps when you allow or approve an action. The saved Search Presence cache records page URLs reduced to their origin and path (query strings and fragments are removed), clicks, impressions, click-through rate, average position, date ranges, and sync time.
• Google Analytics 4 (when connected): the selected property identifier, sessions, engaged sessions, engagement rate, configured key-event counts and rates, default channel groups, landing-page paths without query strings or fragments, date ranges, and sync time. When management discovery is enabled, Google also returns the property's associated account identifier. Depending on the enabled features and permissions you grant, Lanza may also read reports, configuration, and user-access information returned by Google and, where management access is enabled, manage settings, resources, and access within the selected connection when you allow or approve an action. When enabled and permitted for an Analytics task you request or authorize, Lanza may ask Google Analytics Advisor for help. Lanza sends a task-relevant question and selected-property context to Google's Advisor API and displays its response, following your saved permission choice or asking for approval. Google says Advisor chat activity may be used to improve its product; see Google's Chat AI Privacy Hub. Lanza does not infer that a configured key event is an appointment or revenue event.
• Google Calendar, when you connect it: the list of calendars on that Google account and the events on them. Lanza uses this to show times and, only after you approve, to create, change, respond to, or remove an event. An event title or a guest's name or email can identify a patient. That detail stays in the conversation where you asked. It is not saved into a Lanza document, memory, or the practice file.
• Gmail, when you connect it: messages and settings, plus drafts. Lanza can search and read a thread you ask about, and list drafts and labels. Saving a draft or changing a label happens only after you approve. Lanza does not send mail. Google's draft permission also allows sending; Lanza does not use that. Message contents stay in that conversation and are not saved into a Lanza document, memory, or the practice file.
• Google Drive, when you connect it: files you ask Lanza to find, and files you use with Lanza. Lanza can search and read a file, and, only after you approve, create or copy one. Lanza does not delete files. File contents stay in that conversation and are not saved into a Lanza document, memory, or the practice file.
• Google Docs, when you connect it: documents you ask about. Lanza can read a document, and change it only after you approve. Lanza does not delete documents. Document text stays in that conversation and is not saved into a Lanza document, memory, or the practice file.
• Google Sheets, when you connect it: spreadsheets you ask about. Lanza can read the grid, and change cells only after you approve. Spreadsheet contents stay in that conversation and are not saved into a Lanza document, memory, or the practice file.
• Google Ads through the Lanza connectors app uses a separate hosted Google Ads MCP service and OAuth authorization. It reads the ad accounts that Google user can access, and campaign, keyword and spend fields returned by a search. Lanza does not change bids, budgets or campaigns on this connection. Google's Ads permission is broader than this use. This is separate from other advertising connections.
• For Search Console and Google Analytics, Lanza stores a normalized, practice-scoped last-good cache so the Your Brand view can remain useful during a temporary refresh failure. The cache includes the metrics and provenance described above, but no OAuth token. Those Google OAuth credentials remain encrypted and server-side in Lanza's integration backend. Calendar, Gmail, Drive, Docs and Sheets use Vercel Connect for your user's authorization. Meta Business uses a separate practice-scoped Vercel Connect grant.
• Publishing and analytics credentials are managed server-side. Vercel Connect manages the grants described above. For the separate Google Ads MCP connection, Lanza temporarily caches the user's MCP access token in runtime memory; the hosted MCP service manages its own Google OAuth configuration.

We use your information to operate Lanza: authenticate your account, generate marketing content in your practice voice, prepare posts for your review, publish approved content to connected channels, read analytics, process subscriptions, and provide support.

We may use aggregated or de-identified usage data to improve product reliability and features. We do not sell your personal information.

Lanza uses third-party AI providers to generate marketing drafts and answer questions. Your prompts, practice context and relevant results from connected services, including Meta and Google advertising reports, may be sent to the configured AI provider to perform the work you request or authorize. Conversation history and action records may also be stored by Lanza's infrastructure providers. These services operate under their applicable API and data-protection terms.

We do not use data received from connected-platform APIs (including Google, YouTube, Meta, TikTok, X, or LinkedIn) to develop, train, or improve generalized machine learning or artificial intelligence models. Platform data is used only to provide the user-facing features you request. We do not use your account content to train public AI models.

Lanza's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Calendar, Gmail, Drive, Docs and Sheets are used only to do the thing you asked in Lanza. We do not sell that data, use it for advertising, or let Lanza staff read it except to keep the service secure, to comply with the law, or with your explicit permission. Writes wait for your approval. Gmail is not used to send mail. Drive and Docs are not used to delete your files. The separate Google Ads MCP connection is limited to the read-only reporting described above.

Search Console and Google Analytics read-only connections request read access. Where management access is enabled, Lanza may request additional Google API access for the selected connection. Google checks your account role, and Lanza also applies your Allow, Ask, or Deny choices to management operations. Removing one of these properties in Lanza deletes its saved Search Presence cache and local property link, but does not undo changes already made in Google, revoke a shared Google OAuth grant, or interrupt another Google connector such as YouTube. Google connections can use separate authorizations, including the Google Ads MCP service. Review and revoke each relevant grant separately from your Google Account permissions.

Lanza uses YouTube API Services. By using Lanza's YouTube features, you also agree to be bound by the YouTube Terms of Service, and your information is handled in accordance with the Google Privacy Policy.

You can review or revoke Lanza's access to your Google and YouTube data at any time through the Google security settings page. For questions or complaints about how we handle Google or YouTube data, contact privacy@lanzaai.com.

Lanza's Facebook, Instagram and Threads publishing connections and its Meta Business advertising connection are separate integrations. We use the Meta data described above for the accounts, resources and features you authorize, in accordance with the Meta Platform Terms and Developer Policies. Meta Business uses Meta's hosted Ads MCP service and supported Graph API operations; Vercel Connect manages its authorization grant.

We do not sell Meta platform data, use it for surveillance, or use it to build or augment user profiles. For the publishing connections, signed deauthorization and data-deletion callbacks let Lanza remove or disable the provider-linked credentials and records covered by the request. The native Meta Business connection has a separate disconnect and revocation process, described below.

When you connect TikTok, Lanza accesses your creator and profile information and publishes the content you direct, under TikTok's developer terms. You control each post's visibility and interaction settings.

We use TikTok data only to provide the service and delete the related tokens and account linkage when you disconnect TikTok or delete your account.

We use service providers for hosting and connection management (Vercel), database and authentication (Supabase), payments (Stripe), product analytics and session replay (PostHog), error monitoring (Sentry), public-website analytics (Google Analytics), and AI processing, including Google and other configured model providers. Depending on the feature, these services may process connection metadata, conversation and action records, or the platform data needed for that feature, under their applicable service and data-protection terms. We may add or change providers as the product evolves.

Each platform you connect has its own privacy policy. When you connect a channel, you authorize Lanza to interact with that platform on your behalf according to its terms.

We use a small number of cookies and similar technologies, kept to what the service needs:

• Essential and authentication cookies that keep you securely signed in. The service does not work without these.
• Payment cookies set during checkout and for fraud prevention when you manage your subscription.
• Product analytics and session replay: we use first-party analytics identifiers to understand pages visited, feature usage, errors, and interactions within Lanza. Session replay masks rendered text and form values, blocks images, video, and canvas content, and does not record network request or response bodies. We do not use this data for cross-site advertising or retargeting.
• Website acquisition analytics: Google Analytics measures visits to published marketing pages and completed account signups and first paid subscriptions using analytics identifiers. We send public page paths and referring origins without query strings or fragments, and limited completion events with signup method or subscription amount, currency, plan and an opaque transaction identifier. We do not send account or practice identities, form contents, or authenticated application page views. Advertising personalization and Google Signals are disabled.

Some pages may display content or previews from connected platforms. Where that happens, the platform may set its own cookies or collect data about your browsing under its own policies. Most browsers let you block or delete cookies through their settings; blocking essential cookies will prevent you from signing in. Because we do not use cross-site advertising or tracking cookies, there is no interest-based advertising to opt out of.

Lanza supports HIPAA-aware marketing workflows: approval before publishing, no PHI in the product by design, and educational marketing content rather than clinical records.

Lanza is not a covered entity and is not offered as a Business Associate for clinical data. You remain responsible for the accuracy, compliance, and appropriateness of content you approve and publish, including compliance with state medical board advertising rules.

We do not sell, rent, or license your personal information or platform data. We do not use platform data for surveillance, to build or augment advertising profiles, to retarget or serve interest-based advertising, or to discriminate against any person.

We only share platform data as you direct (for example, to publish to a channel you connected), with the service providers described above, for security purposes, or as required by law.

You can disconnect supported connections or request deletion of information Lanza holds using the options below. We verify deletion requests and handle them under applicable law, subject to records we may need to retain for legal, billing, or security purposes:

• Disconnect a channel in-app: open Settings, then Connectors, and disconnect a channel. For Google Search Console or Google Analytics, this immediately removes the selected property link and its normalized Search Presence cache from Lanza; the shared Google OAuth grant and other Google connectors remain intact. For publishing channels, disconnecting removes or disables the account's access credentials as described in the confirmation dialog.
• Remove an organic Facebook, Instagram or Threads publishing connection from Meta using that platform's connected-app controls. Lanza's signed data-deletion callback removes the provider-linked data covered by that request and returns a confirmation code and status URL. Deauthorization can disable access first while outstanding delivery reconciliation is completed. This process does not delete a separate Meta Business advertising connection.
• Disconnect Meta Business: a practice owner can disconnect it from its details in Connectors. Lanza disables the binding, deselects its resources, invalidates pending work and attempts to revoke the Vercel Connect grant. If revocation fails, a stored job records the failure for bounded retry. Disconnecting does not automatically erase retained conversation or action history; email privacy@lanzaai.com to request deletion of remaining Lanza records. Ads and content already held by Meta remain subject to Meta's controls and policies.
• Revoke a Google grant: use the Google security settings page. Google connections can have separate grants, including the Google Ads MCP service; review each relevant authorization. Revoking one does not necessarily revoke another or delete data already stored by Lanza or the connected service. To request deletion of remaining Lanza account data after an external revocation, email privacy@lanzaai.com.
• Disconnect Calendar, Gmail, Drive, Docs, or Sheets in Lanza: that removes the Connect grant for your user. Mail, files, documents, spreadsheets, and events already in Google stay in Google.
• Revoke from TikTok, X, or LinkedIn: remove Lanza in that platform's connected-apps settings. To request deletion of information Lanza still holds after revocation, email privacy@lanzaai.com.
• Request deletion of your account: email privacy@lanzaai.com or support@lanzaai.com from the address on your account. We will verify your request, disconnect applicable connections and handle the associated data under applicable law, subject to limited records we may need to retain as described below.

We retain account and practice data while your subscription is active and for a reasonable period afterward to meet legal, billing, and security obligations. We may retain limited records where required for legal, billing, or security purposes.

While a Search Console or Google Analytics property remains connected, we retain its normalized last-good metrics and provenance and replace them as the connection refreshes. Removing that property in Lanza deletes those cached rows immediately. Disconnecting one Google property does not revoke the shared Google grant; revoke the full grant through Google Account permissions.

Note that content already published to a platform lives on that platform; deleting Lanza data does not remove posts from Instagram, Facebook, Threads, TikTok, X, LinkedIn, or YouTube. Remove those directly on each platform. Disconnecting Calendar, Gmail, Drive, Docs, or Sheets does not delete the mail, files, or events that remain in Google.

Depending on where you live, you may have the right to access, correct, delete, or export personal information we hold about you, and to opt out of certain processing.

California residents (under the CCPA) and residents of Virginia and other states with comprehensive privacy laws have rights to know, access, correct, delete, and port their personal information, and not to be discriminated against for exercising them. We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months.

To exercise these rights, email privacy@lanzaai.com. We will respond within a reasonable timeframe.

We use industry-standard safeguards including encryption in transit and at rest, access controls, and scoped database permissions. Connection credentials are managed through the integration backend and authorization services described above.

No online service can guarantee perfect security, but we design Lanza so patient health information is not part of the system.

Lanza is operated from the United States. Our service providers may process or store information in the United States and other countries where they operate. Privacy and data-protection rules in those countries may differ from the rules where you live.

Lanza is a business service for medical practices and is not directed to individuals under 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Continued use of Lanza after changes means you accept the updated policy.

Questions about privacy? Email privacy@lanzaai.com.