Observatory, without running a server.

The pre-order rules

• No instance until 15 pre-ordersWe create instances only after 15 people have pre-ordered. Hosted doesn't exist yet; your pre-order is what decides whether we build it.
• Full refund until your instance existsAsk any time before we create your instance and Paddle refunds the whole $190. No questions.
• If 15 never arrive, everyone gets their money backWe decide within 45 days of opening pre-orders and write to every buyer either way.
• Founding price: $190 for the first yearPaddle charges it today. After that, Hosted is $19 a month or $190 a year. Your first year counts from the day your instance exists: we move your renewal date to match.

Two ways to run it, one price

You pick on the pre-order. Both cost the same, and you can switch later.

On the EU option, your health data sits on servers we run. That is a separate, opt-in service with its own privacy notice, published before the first instance exists.

Who it's for

People who want Observatory but won't run a server. Four cases come up most.

• You track a condition with a deviceA CGM, a CPAP machine, a blood pressure cuff. Before an appointment, Observatory prepares the document: your readings, your device data and your own questions, side by side, with the gaps in the record shown as gaps.
• You set it up for a parent or family memberThey keep their phone; the history lands in an instance they own. The dashboard shows how this week compares with their own usual weeks, plus the history, the gaps and the questions to bring.
• You want private AI on your own data, outside the USPoint your own AI at your record: Claude, ChatGPT or a local model, through a private MCP connection (planned for Observatory 1.2). The statistics engine computes every finding; the language model only puts them into words, and never diagnoses.
• You just don't want to run a serverEverything Community does, without Docker, updates or backups on your side.

How your data is kept

Hosted runs the same statistics on your data as a self-hosted Observatory, so the server has to read it. These are the protections it launches with.

• One instance per customerYour own database, credentials, network and encrypted volume. Nothing is shared between customers.
• Encrypted at restThe disk, and the daily backups we keep for 30 days.
• No standing accessNobody at HealthSave can open your instance by default. We open it only when you ask in a support ticket.
• Every access logged where you see itEach time we open your instance, an entry lands in a log inside your own Observatory. Built with Hosted
• Leave any time, with everythinghealthsave backup gives you one file that restores on any free Community install. Your history moves with you.
• AI stays opt-inRaw readings never go to a cloud model. Derived findings go only if you turn that on, redacted first. The same gate as self-hosted.

Hosted isn't running yet, so these are commitments, not features you can inspect today. The self-hosted security model they build on is on the Observatory security page.