Consumer Health Data Privacy Policy

1. Scope

This Consumer Health Data Privacy Policy supplements the ARDA Privacy Policy. It explains ARDA AI, INC.’s practices for information that is or may be treated as “consumer health data” under applicable United States state law, including the Washington My Health My Data Act.

This notice applies when you use ARDA as a consumer in a jurisdiction that provides applicable consumer health data rights. It does not state that ARDA is a health care provider or that all information covered by this notice is protected health information under HIPAA.

2. Consumer health data we may collect

Depending on what you choose to share and which features you use, ARDA may collect or derive:

• Self-reported physical health, symptoms, body measurements, sleep, activity, exercise, nutrition, or fitness information.
• Self-reported mood, stress, confidence, emotional state, mental-health context, or personal well-being information.
• Information concerning substance use, alcohol, smoking, gambling, recovery, or other behavioral-health circumstances.
• Goals, commitments, plans, conversations, and accepted evidence related to health or well-being.
• ARDA ratings, confidence, explanations, trajectories, and plans that may reveal or be inferred from health-related information.
• Safety-related signals needed to display reviewed support or crisis resources.

ARDA does not collect HealthKit records, clinical records, medical-device data, precise location, photographs, audio, or connected health-provider information in the initial launch build.

3. Sources of consumer health data

We collect consumer health data:

• Directly from you through Life Audit answers, conversations, corrections, goals, updates, support requests, and other information you choose to provide.
• From your interaction with ARDA when the Service creates ratings, plans, evidence records, or other results based on the information you supplied.
• From an integration only if you deliberately connect and authorize it. No external health integration is included in the initial launch build.

4. Why we collect and use consumer health data

ARDA may use consumer health data to:

• Provide the Life Audit, Life Profile, domain ratings, confidence, explanations, accepted evidence, goals, plans, conversations, and Weekly Audits you request.
• Personalize questions and outputs to your active domains, priorities, goals, constraints, and permissions.
• Let you inspect, correct, export, or delete information and understand how a result was reached.
• Display reviewed safety or crisis resources when an applicable signal is detected.
• Secure, operate, debug, and support the Service using content-minimized operational records.
• Comply with law and protect users, ARDA, or others from fraud, abuse, or harm.

We do not use consumer health data for third-party advertising, cross-context behavioral advertising, data brokerage, or unrelated profiling. We do not treat engagement, app opens, or positive language as evidence that your health or life has improved.

5. Consumer health data we share

We may disclose the minimum relevant consumer health data to service providers that process it for ARDA’s purposes:

• Supabase: Application database, authentication, private storage, server functions, queues, and backups in the East US region.
• OpenAI: Bounded AI interpretation, drafting, explanations, planning, and safety classification through secure API requests. ARDA does not opt API content into model training.
• ARDA support personnel: Only when needed for a support or safety purpose. Access to intimate content is not available by default and is intended to be purpose-limited, time-limited, and audited.
• Professional advisers, regulators, law enforcement, or transaction parties: Only when reasonably necessary and legally permitted.

Apple operates Sign in with Apple, the App Store, and Apple-controlled platform services under its own terms. ARDA does not send Life Audit answers or private conversations to Apple merely because the app is distributed through the App Store.

Google, Microsoft Clarity, and Railway help operate or measure the public website. ARDA does not send private Life Audit answers, health-domain evidence, or app conversations to the public website’s analytics tools.

6. Sale of consumer health data

ARDA does not sell consumer health data. ARDA does not exchange consumer health data for money or use it to create advertising audiences. If this practice were ever to change, ARDA would update this notice and obtain any authorization required by law before the sale occurs.

7. Your consumer health data rights

Subject to applicable law and appropriate verification, you may have the right to:

• Confirm whether ARDA collects, shares, or sells your consumer health data.
• Access the consumer health data ARDA maintains about you.
• Receive a list of third parties or affiliates with whom your consumer health data has been shared or sold, where required.
• Withdraw consent for future collection or sharing.
• Delete consumer health data.
• Appeal ARDA’s decision concerning a request.

Withdrawing consent stops future processing covered by the withdrawal but does not automatically delete existing information or undo processing completed before the withdrawal. You may make a separate deletion request.

8. How to exercise your rights

Use the controls described on the Privacy Choices page or email contact@ardaapp.com with the subject “Consumer health data request.” Tell us which right you want to exercise and use the email address associated with your waitlist entry or account when possible.

We may request information reasonably necessary to verify your identity, your state of residence, or an authorized agent’s authority. We will not discriminate against you for exercising a privacy right.

9. Appeals

If we deny a consumer health data request in whole or in part, we will explain the basis where permitted and provide instructions for appeal. You may appeal by replying to the decision or emailing contact@ardaapp.com with the subject “Consumer health data appeal.” We will respond within the time required by applicable law and provide any further complaint mechanism required for your jurisdiction.

10. Retention and deletion

ARDA retains consumer health data only for the periods and purposes described in the Privacy Policy. The intended launch design deletes abandoned anonymous audits after seven days, lets account holders delete selected records or the full account, and prevents deleted account content from returning through a restored backup.

Under standard OpenAI API controls, limited abuse-monitoring logs may remain with OpenAI for up to 30 days unless verified Zero Data Retention applies. These logs are not ARDA product memory and are not available to ARDA as an account record.

11. Changes to this notice

We will update the date above when this notice changes. If ARDA proposes to collect or use an additional category of consumer health data, or use an existing category for a materially different purpose, we will provide any additional notice and obtain affirmative consent required by applicable law before the new collection or use.

12. Contact

Questions, requests, or concerns may be sent to:

ARDA AI, INC.
contact@ardaapp.com