By accessing or using Heal Your Human, you acknowledge that you have read and understood this Privacy Policy.

1. Scope of This Policy

This Privacy Policy applies to information collected through:

• Our website
• Our mobile or web applications
• Our AI-powered Health Concierge
• Any related services (collectively, the “Services”)

This policy does not apply to third-party services that may be linked from our platform.

2. Information We Collect

We collect information in the following categories:

A. Information You Provide Directly

You may provide:

• Name and contact information
• Account credentials
• Health-related information
• Symptom descriptions
• Wellness goals
• Messages submitted to the Health Concierge
• Uploaded laboratory reports
• Uploaded DNA or genetic data files
• Payment-related information

You are never required to upload laboratory or genetic data to use the Services.

B. Sensitive Personal Information

Certain data you provide may qualify as “Sensitive Personal Information” under applicable privacy laws, including:

• Health information
• Genetic information
• Biometric identifiers (if applicable under state law)
• Account credentials

We process Sensitive Personal Information only for purposes necessary to provide the Services and as described in this Policy. We do not use Sensitive Personal Information for cross-context behavioral advertising.

3. Biometric & Genetic Information (BIPA Compliance)

If you upload genetic data (such as raw DNA files), certain information extracted from that file may be considered “biometric information” under Illinois law or similar statutes.

Purpose of Collection

We collect and process genetic data solely to:

• Extract relevant markers (e.g., SNPs or other data points)
• Generate personalized health insights
• Support your account experience

We do not collect genetic information for identification, surveillance, marketing, or advertising purposes.

Retention Schedule

• Raw uploaded DNA or laboratory files are stored on our servers while your account is active. You can request deletion of these files at any time.
• Extracted genetic markers and derived insights are retained only while your account remains active or as required for legal compliance.
• Upon account deletion, biometric identifiers and genetic markers are permanently deleted within 45 days unless legally required to retain them.

Destruction Guidelines

Biometric and genetic information is permanently deleted when:

• The initial purpose for collection has been satisfied; or
• You request deletion; or
• Your account is closed and retention is no longer legally required.

4. Handling of Uploaded Lab & Genetic Files

When you upload a laboratory report or a DNA/genetic file, we:

• Process the file to extract necessary data points
• Store extracted markers and relevant values
• Retain the original file on our servers while your account is active

You can request deletion of your files and all associated data at any time. Upon account deletion, all files are permanently and securely removed.

5. Payment Information

Payments are processed by third-party payment providers (e.g., Stripe). We do not store full credit card numbers. We may retain transaction records for:

• Accounting
• Tax compliance
• Fraud prevention
• Legal obligations

6. Technical & Usage Information

We may automatically collect:

• IP address
• Browser and device information
• Log files
• Platform interaction data
• Session information
• Analytics data

We collect this information to maintain system functionality, ensure security, improve performance, and prevent fraud or abuse.

7. How We Use Your Information

We use information to:

• Provide personalized health insights
• Operate our AI-powered Health Concierge
• Maintain your account
• Process payments
• Communicate service-related updates
• Improve system accuracy and reliability
• Ensure security and prevent misuse
• Comply with legal obligations

8. Artificial Intelligence & Automated Processing

Heal Your Human uses artificial intelligence systems to generate personalized insights based on user-provided information.

AI Processing Transparency

• AI outputs are generated based on patterns in data and may not be medically accurate.
• AI responses are informational and educational in nature.
• AI outputs should not be considered medical advice.

AI Model Training

Unless explicitly disclosed otherwise:

• We do not use identifiable personal health or genetic data to train generalized AI models.
• We may use aggregated or de-identified data to improve system performance.
• De-identified data is processed in a manner designed to prevent re-identification.

Third-Party AI Providers

Your data is sent to third-party AI providers (Anthropic and OpenAI) solely to generate your personalized health analysis. These providers do not use API data to train their models. We are
pursuing zero-retention agreements to ensure no data is stored on their systems after processing is complete.

9. HIPAA Status & Medical Disclaimer

10. California Privacy Rights (CPRA Notice)

If you are a California resident, you have the right to:

• Know what personal information we collect
• Know the categories of sources
• Know the business purposes for collection
• Know categories of third parties with whom data is shared
• Access your information
• Correct inaccurate information
• Request deletion
• Request data portability
• Limit use of sensitive personal information
• Opt out of sale or sharing (we do not sell or share personal information)

Categories Collected

• Identifiers (name, email)
• Commercial information (transactions)
• Internet activity (usage data)
• Health and genetic information (if provided)
• Account information

Retention

We retain data only as long as reasonably necessary to fulfill disclosed purposes or comply with legal obligations.

Exercising Rights

To submit a request, email: info@healyourhuman.com. We will respond within 45 days as required by law. You may designate an authorized agent. We will not discriminate against you for exercising privacy rights.

11. Data Retention

We retain information only as long as necessary to provide Services, maintain your account, fulfill legal obligations, resolve disputes, and enforce agreements.

General Retention Framework

• Account data: Retained while account is active
• Raw lab/genetic uploads: Retained while account is active, deleted on request or account deletion
• Extracted markers: Retained during active account
• Transaction data: Retained per tax/accounting laws
• Analytics logs: Retained per operational necessity

Upon account deletion, personal information is deleted within 45 days unless retention is legally required.

12. Data Security

We implement administrative, technical, and physical safeguards including:

• Encryption: Data encrypted in transit
• Secure Hosting: Secure cloud hosting infrastructure
• Access Controls: Strict access controls limit who can view your data
• Monitoring: Active monitoring systems
• Internal Policies: Team members do not access, view, or review your uploaded files, health data, or conversation history unless you initiate a support request or we are required to by law.

No system is completely secure. In the event of a data breach, we will provide notice as required by applicable law.

13. Disclosure of Information

We may disclose information:

• To service providers under confidentiality agreements
• To comply with legal obligations
• To protect rights, safety, or property
• In connection with mergers, acquisitions, or asset transfers
• With your consent

Service providers are contractually restricted from using data for independent purposes.

14. Cookies & Tracking

We use cookies to:

• Maintain sessions
• Ensure functionality
• Analyze usage

You may adjust browser settings to manage cookies.

15. Children’s Privacy

The Services are not intended for individuals under 18. We do not knowingly collect information from minors. If discovered, such data will be deleted.

16. International Users

If you access our Services from outside the United States, you acknowledge that data may be transferred to and processed in the United States. Where required, we implement appropriate safeguards for cross-border data transfers.

17. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated through an updated “Last Updated” date and platform notice where appropriate. Continued use of the Services after updates constitutes acceptance.

18. Contact Information

If you have questions about this privacy policy or how we handle your data, please contact us:

Heal Your Human