Privacy Policy

1. Information we collect

Information you give us

• Account information: your email address. We don't ask for your name.
• Profile and health background: month and year of birth, sex assigned at birth, your goals, and how often and since when you have had symptoms.
• Conversations: what you tell AlphaDX by text or voice, and AlphaDX's replies.
• Voice: when you talk to AlphaDX, we process your voice to respond to you, and we keep the recordings you send as part of your conversation history until you delete them or your account. We don't use your voice to identify you.
• Health journey: headache episodes, medications, reminders, sleep, water, daily check-ins, notes and other entries you log.
• Files: photos, documents and medical records you choose to attach or upload, such as prescriptions or scan reports, and the information AlphaDX reads from them.
• Messages to us: anything you send when you contact support.

Information created by the Services

• Summaries and insights that AlphaDX generates from your information, including visit summaries, lists of possible causes, weekly and monthly reports, and patterns in your journey.
• Memory: facts you have told AlphaDX that it remembers so you don't have to repeat them. You can review and remove them in the app.

Information we get from others

• Sign-in providers: if you sign in with Apple or Google, the email address they share with us.

Information collected automatically

• Technical information: device type, operating system and app version, a notification token if you allow notifications, and basic logs of requests and errors needed to keep the Services working and secure. The app contains no advertising or third-party analytics SDKs, and it does not track you across other companies' apps or websites.
• Location: if you choose to share your location, or enter a city or ZIP code, we use it to show specialists near you. Your location is not added to your health record.

2. How we use information

We use information to:

• provide the Services: run conversations, generate summaries and reports, keep your journey, send the reminders you set, match you with specialists and export PDFs;
• personalize the Services, for example by remembering your health background so you don't have to repeat it;
• keep the Services safe: authenticate you, prevent fraud and abuse, and fix errors;
• communicate with you about your account, security and changes to the Services;
• improve the Services, including the quality and safety of AlphaDX's questions and summaries, as described in Section 4;
• comply with law and enforce our Terms.

If we ever want to use or share your information in a way this Policy doesn't describe, we will update this Policy first and ask for your consent where the law requires it.

3. How we share information

We share information only as follows:

• With service providers that help us run the Services, such as cloud hosting and storage, sign-in, AI and speech processing, notifications and customer support. They may use your information only to provide services to us, and must protect it.
• For legal reasons: to comply with law, legal process or a valid government request, or to protect the rights, safety and security of our users, AlphaDX or others.
• In a business transfer: as part of a merger, acquisition or sale of assets, subject to this Policy.
• With your consent for any other purpose.

AI processing. To understand what you say and write, read the files you attach, and generate replies, summaries and reports, your information is processed by AI models, including models run by third-party AI providers that act as our service providers. They process it only to provide the Services to us and may not use it to train their own models. Where the law requires it, we ask for your permission before sharing your information with third-party AI providers.

4. Improving AlphaDX

We may use information about how the Services are used, and de-identified information that can no longer reasonably be linked to you, to maintain and improve the quality and safety of AlphaDX. We keep de-identified information in that form and do not try to re-identify it.

5. Health information and HIPAA

AlphaDX is built to meet HIPAA requirements. We protect all health information you give us with administrative, physical and technical safeguards designed to meet the standards of the HIPAA Security Rule, including encryption in transit and at rest, access controls and audit logging. Service providers that handle health information for us do so under business associate agreements or equivalent written obligations to protect it.

6. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Services, unless the law requires us to keep it longer.

Deleting your account. When you delete your account in the app (Settings → Delete account), your account stops working immediately and can't be recovered. We start deleting your personal information right away, including your conversations, summaries, health journey, files and reminders, and your sign-in account, and all of it, including copies in backups, is permanently removed from our systems within 30 days. We may keep a minimal record that your account was deleted, and information we are required by law to keep. De-identified information that can no longer be linked to you is not affected.

Deleting individual items. When you delete a conversation or a record, we delete it from our active systems within the same period.

7. Your choices and rights

• Access and export: view your information in the app and export your summaries as PDFs. You can also email us for a copy of your data.
• Correction: edit your profile and journey in the app, or ask us to correct information.
• Deletion: delete conversations, records or your whole account in the app (Settings → Delete account), or email us.
• Emails and notifications: we send emails about your account and the Services. If we send you marketing emails, you can unsubscribe using the link in any of them. You can turn notifications off in iOS Settings.
• Permissions: turn microphone, camera or location access on or off in iOS Settings at any time.
• Consent: where we rely on your consent, you can withdraw it at any time by contacting us or deleting your account.

We will not discriminate against you for exercising these rights. We will respond within the time required by law, usually 45 days, and may need to verify your identity first. An authorized agent may make a request for you with proof of authorization.

8. U.S. state privacy rights

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states, you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to get a portable copy; and to opt out of the sale or sharing of personal information and of targeted advertising. We use sensitive personal information, such as health information and precise location, only to provide the Services you ask for, and not to infer characteristics about you. We honor Global Privacy Control signals as an opt-out request where the law requires it. If we deny your request, you may appeal by replying to our decision.

California "Shine the Light". California residents can ask us, once a year, whether we have disclosed personal information to third parties for their own direct marketing purposes, using the contact details below.

Consumer health data. If you live in Washington, Nevada, Connecticut or another state with a consumer health data law, the health information described in this Policy is "consumer health data" under that law. Sections 1 to 3 explain what we collect, why, where it comes from and who we share it with. You have the right to confirm whether we collect or share your consumer health data, to access it, to get a list of the third parties we have shared it with, to delete it, and to withdraw your consent. To exercise these rights, use Settings in the app or email us at the address below.

9. Security

We use encryption in transit (TLS) and at rest, access controls, and least-privilege access for our staff. On your device, AlphaDX stores data with iOS file protection and keeps your sign-in session in the iOS Keychain. No system is completely secure, and we cannot guarantee the security of your information. If we learn of a breach that affects your information, we will notify you as the law requires.

10. Cookies and similar technologies

Our website uses only the cookies and similar technologies it needs to work and stay secure. We do not use advertising or analytics cookies, and we do not track you across other websites or apps. You can block or delete cookies in your browser settings, though parts of the website may not work without them.

11. Children

The Services are intended for adults 18 and over, and are not directed at, marketed to or intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact us and we will promptly delete it.

12. International users

The Services are offered in the United States, and we store and process information in the United States.

13. Links and third-party content

The Services may link to websites, articles and services we don't operate, such as a clinic's website or an article in your news feed. Their own privacy policies apply, and we are not responsible for how they handle your information.

14. Changes to this Policy

We may update this Policy. If a change is material, we will notify you in the app or by email before it takes effect. The date at the top shows when it last changed.

15. Contact us

AlphaDX Inc.

Privacy questions and requests: info@alphadx.ai