Well, I intentionally designed it in a way to avoid any HIPAA issues. First of all, the system does not analyze data or store any reports tied to personally id

Well, I intentionally designed it in a way to avoid any HIPAA issues. First of all, the system does not analyze data or store any reports tied to personally identifiable information (PII) - so no names, birthdays, emails, security numbers etc. Also, the analysis report (which again is not tied to any PII) is deleted after user requests the report or at latest in 15min if the user does not request it (aka it expires and is removed completely). Lastly, the only way to get this report is to consent it being sent to you via (unencrypted) email you provide. You can always opt out and not agree to this and the report will never be linked to any email and will be deleted shortly after.