Healya Try Healya

Legal

Public policies for Healya website visitors, app users, and business partners.

Privacy Policy

Version 1.3

Effective Date: September 9, 2026

1. Introduction

Healya, Inc. ("Healya," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect through the Healya digital health platform (the "Service"), how we use and share it, and the rights and choices you have over your information.

We built Healya to help you understand your health better — to investigate your symptoms, make sense of your lab results, and walk into every doctor's appointment prepared. Doing that well requires handling sensitive personal health information, and we take that responsibility seriously. We apply rigorous privacy and security standards to everything we do, even where the law does not strictly require it.

This policy applies to all personal and health information we collect through our mobile application, website, and related services. It covers users in the United States only. It does not cover third-party websites, apps, or services you may connect to Healya — those are governed by their own privacy policies.

By using the Service, you agree to the collection, use, and disclosure of information as described here. If you do not agree, please do not use the Service.

Summary of Key Points

This summary is for convenience only and does not replace the full policy below.

1.1 Our Commitment to HIPAA and Other Health Privacy Standards

Healya is a direct-to-consumer digital health platform. In many of our operations, we are not a "Covered entity" or "Business Associate" as defined under the Health Insurance Portability and Accountability Act (HIPAA), which generally applies to health care providers, health plans, clearinghouses, and the vendors that process data on their behalf. Where you connect Healya to a health system, patient portal, or provider through a HIPAA-regulated integration, HIPAA obligations may apply to that connection, and we structure those integrations accordingly.

Regardless of whether HIPAA strictly applies to a given activity, we apply safeguards modeled on the HIPAA Security Rule and Privacy Rule across our operations as a matter of policy, including but not limited to:

Certain demographic, health and/or health-related information that Healya collects about you as part of providing the Service and on behalf of a Covered Entity, may be considered "protected health information" (PHI) under HIPAA. This may be true when (i) we are providing administrative, operational, or other services to an entity that is classified as a "Covered Entity" as defined by HIPAA; (ii) in order to provide those services, we receive identifiable information about you on behalf of a Covered Entity, where Healya is acting as a Business Associate; and (iii) this identifiable information is regulated as PHI.

Healya executes a Business Associate Agreement (BAA) with every Covered Entity in which it exchanges PHI. BAAs are standard agreements required by HIPAA between a Covered Entity and a Business Associate to ensure the protection of your PHI. BAAs vary slightly based on the Covered Entity but all HIPAA required protections remain included in every BAA Healya executes.

This Privacy Policy does not apply to PHI, which is instead regulated by your provider's Notice of Privacy Practices (NPP) and other HIPAA disclaimers. HIPAA provides specific protections for the privacy and security of PHI and restricts how PHI is used and disclosed.

2. Information We Collect

To provide the Healya Service, we collect several types of information. Here is a plain-language breakdown of what we collect and where it comes from.

2.1 Information You Provide Directly

Account Registration. When you create a Healya account, we collect your name, email address, date of birth, and password. We may also ask for optional details like your gender or zip code to personalize your experience.

Health Entries and Journals. You can manually enter health data, including:

Communications With Us. If you contact our support team, we collect the content of your communications and your contact details.

Caregiver and Dependent Information. If you set up or manage a profile on behalf of a family member (such as a young child or an adult in your care), we collect similar information about that person. You are responsible for having the authority or consent to provide that information. How dependent and minor profiles work is described in Section 7.

2.2 Information From Connected Sources

With your explicit permission, we connect to external health sources to give you a comprehensive view of your health.

Electronic Health Records (EHR). You may link Healya to your patient portals or health systems via secure connections. When you do, we may import:

We will show you a summary of what we are accessing and ask for your consent before connecting. You can disconnect at any time.

Wearables and Health Apps. If you connect a wearable device or health app (such as Apple Health, Google Fit, or Fitbit), we collect the data types you permit, which may include activity data, heart rate, sleep data, and other metrics your device tracks. The specific data collected depends on the device and the permissions you grant.

We do not use data from HealthKit, Google Fit, Health Connect, or similar platforms for advertising or sell it to any third party.

If you connect Google Fit or Health Connect, our use of the data we receive through those APIs adheres to the Google Fit Developer and User Data Policy, including its Limited Use requirements — meaning we will never use that data for advertising, sell it, or use it to assess creditworthiness, and we will only request the specific data permissions our features need. See Section 11 for the full addendum.

2.3 Information Collected Automatically

When you use Healya, we automatically collect certain technical information, including:

No third-party tracking SDKs. We do not embed third-party advertising or cross-app analytics software development kits (SDKs) in the app. Our operational analytics and crash reporting are handled through our own infrastructure and our hosting provider's tooling, not through consumer ad or analytics networks.

If you use our website, we may use cookies to keep you logged in, remember preferences, and understand navigation patterns. You can control cookies through your browser settings.

We do not continuously track your GPS location. We may infer general location (city or state level) from your IP address for security purposes.

2.4 Sensitive Information

By the nature of this Service, much of the data we collect is sensitive health information. We treat all of it with the highest level of security and confidentiality. We do not collect Social Security numbers, financial account numbers, or driver's license numbers, as those are not needed for our Service.

2.5 Children's Information

Please see Section 7 (Children's Privacy) for a full description of how we handle information about minors. In short: children under 12 do not have their own logins — a parent or legal guardian creates and manages a dependent profile for them — and minors aged 12–17 may only obtain a self-controlled account by invitation from a verified parent or legal guardian. In every case we collect only what is needed for the Service. An adolescent's account is private to the adolescent by default, as described in Section 7.3.

3. How We Use Your Information

We use the information we collect for the following purposes.

3.1 To Provide and Personalize the Service

3.2 To Power AI Analysis

A core feature of Healya is using artificial intelligence to help you understand your health data. We access AI models only through enterprise-grade services operated within Healya's own controlled cloud environment, under a Business Associate Agreement (BAA) and data-processing terms that govern how your information may be handled. Under these agreements, the provider processes your data solely to return the analysis we request, is contractually prohibited from using it to train or improve its own models, and applies enterprise data-handling and retention controls. We transmit only the data needed to fulfill each request, and we do not use consumer AI apps or public AI APIs to process your health information. Section 5 describes this in more detail.

3.3 To Communicate With You

3.4 For Internal Research and Improvement

If we ever wanted to use identifiable data for research, we would seek your explicit consent through a separate research consent process.

3.5 To Ensure Security and Prevent Misuse

3.6 With Your Consent

If we want to use your information for any purpose not described above, we will ask for your consent first.

We do not use your health information for advertising. We do not allow third-party advertising networks to collect data about you through our app. We do not sell or rent your information to data brokers.

4. How We Share Your Information

We share your information only in the limited circumstances described below. We do not sell your personal information.

4.1 Service Providers

We use trusted third-party companies to help us operate the Service. These providers are given access to your information only as needed to perform their specific tasks. They are contractually required to protect your data and may not use it for any other purpose. Where a provider stores or processes health information on our behalf, that relationship is governed by a Business Associate Agreement or equivalent data-protection terms. Categories of service providers include:

4.2 Sharing at Your Direction

You may choose to share your health data with others through the Service, including:

Any sharing of this kind is entirely under your control. You can revoke access at any time.

4.3 Business Transfers

If Healya is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and ensure your data remains protected under commitments at least as strong as those in this policy.

4.4 Legal and Safety Disclosures

We may disclose your information if required to do so by law, or if we believe in good faith that disclosure is necessary to:

We will disclose only the minimum information necessary to satisfy the specific request, and we will attempt to notify you when permitted by law.

Additional protection for sensitive health categories. For information relating to reproductive health, mental health treatment, or substance use treatment — for any user, not only minors — we will not disclose this information in response to a request unless we are presented with valid legal process specifically compelling disclosure (such as a warrant or court order), or unless disclosure is necessary to prevent imminent harm to someone's safety. We will not voluntarily disclose this category of information based on an informal request alone.

4.5 De-Identified and Aggregated Information

We may share information that has been de-identified or aggregated — processed using recognized statistical or expert-determination methods so that it cannot reasonably be used to identify you — for purposes such as internal research, product improvement, or public health reporting. We do not re-identify de-identified data, and we contractually prohibit recipients from attempting to do so.

We do not share de-identified or aggregated health or biometric data with advertisers, sponsors, or promotional partners, and we do not use it for marketing purposes, even in de-identified form.

5. AI Processing

Using artificial intelligence to generate personalized health insights is central to what Healya does. We want to be transparent about how that process works and the protections we have in place.

5.1 How AI Processing Works

When you use an AI-powered feature, relevant portions of your health data are sent to a third-party AI service for analysis, and the result is returned to your account to generate your insights. We do not use consumer AI apps or public AI APIs for this. Access is limited to enterprise services operated under a Business Associate Agreement and contractual data-processing terms, within a cloud environment we control.

5.2 Protections We Apply

If we change the AI providers we rely on, or if we ever begin operating our own models, we will update this section to reflect any material changes to how your data is handled.

6. Data Security

We apply rigorous security measures to protect your personal and health information. Here is an overview of our approach.

6.1 Technical Safeguards

6.2 Organizational Safeguards

6.3 Your Responsibilities

Security is a shared responsibility. To help protect your account:

6.4 Breach Response

If a security breach occurs that affects your personal information, we will notify you promptly — without undue delay, and within any timeframes required by applicable law. Our notification will describe what happened, what types of information were involved, what we are doing about it, and steps you can take to protect yourself. See Section 10 for full details on our breach notification process.

7. Children's Privacy

Protecting children's privacy is a priority for us. This section explains how we handle information about users under 18. Registration, family-plan membership, and access to a person's profile are three separate things: joining a family plan or being labeled a family member does not, by itself, grant anyone access to another person's information.

7.1 Parental Consent and Guardian Verification (All Users Under 18)

As a baseline business policy, unless otherwise prohibited by applicable federal, state, or local law, no one under 18 may create a Healya account on their own. Every account for a person under 18 begins with an invitation from a parent or legal guardian whom we have verified.

Conflicting guardian claims, identity collisions, and ambiguous account-recovery situations are resolved conservatively or through support review. They never automatically merge profiles or create access.

Adults 18 years of age or older may register independently after confirming their age, accepting the current Terms of Service, Privacy Policy, making the product's separate AI-processing choice, and completing any other consent step we require before use of the Service.

7.2 Children Under 12

Children under 12 do not have their own Healya logins. Any profile for a child under 12 is created and managed by a parent or legal guardian as a dependent profile, after the guardian reviews the managed-profile notice and completes our parental-consent confirmation. We comply with the U.S. Children's Online Privacy Protection Act (COPPA):

7.3 Adolescents Aged 12–17

An adolescent aged 12 to 17 may obtain their own Healya account only through an invitation initiated by a verified parent or legal guardian. Adolescents cannot self-register.

The account is private to the adolescent by default. When a guardian creates the invitation, we show them a plain-language notice explaining that the adolescent will control the account, that the guardian will not be able to see what is in the account, and that only the adolescent can decide to change account access permissions. The guardian must affirmatively consent to this private default before the invitation is sent.

Accepting the invitation therefore grants the inviting guardian no access to the adolescent's account or to anything contained therein.

The adolescent may control the account. They may grant a guardian, family member, or caregiver Viewer, Editor, or Manager access at any time, and may reduce or withdraw that access at any time, down to No Access. Access follows the adolescent's choice, not the family relationship.

7.4 Adolescents with Disabilities or Special Needs

Some adolescents cannot manage their own account or privacy settings. If a legal guardian needs continuing access for this or a similar reason, the legal guardian may request an exception when the account is created.

During the invitation flow, the guardian may select a checkbox indicating that the adolescent has a disability or special needs affecting their ability to manage their own account. Selecting that option opens a case that a trained member of our privacy team reviews.

7.5 Transitions at Ages 12 and 18

When a child with a dependent profile reaches age 12, we notify the managing guardian and offer to convert the profile into an adolescent account under Section 7.3. Account history is preserved. On conversion, any access the guardian previously held is reset to No Access, and the adolescent may choose to restore it, unless an exception under Section 7.4 has been approved.

Reaching adulthood is not a second reset. Any access an adolescent granted after age 12 is already under their sole control and remains in place until the account holder changes it. We do not automatically revoke access at 18.

7.6 Discovered Violations

If we discover we have inadvertently collected personal information from a person under 18 without the guardian consent and verification described in Section 7.1, we will delete it promptly and close the account. If you suspect a child is using the Service improperly, please contact us at privacy@healya.ai.

8. Your Rights and Choices

You have meaningful control over your personal and health information. Many of these rights can be exercised directly in the app. For anything else, you can reach us at privacy@healya.ai.

8.1 Right to Access

You have the right to request a copy of the personal and health information we hold about you. Much of your data is viewable directly in the app. For a full export, you can use the "Download My Data" feature (if available) or contact us. We will respond within 30 days (with a possible 30-day extension if needed), and provide your data in a readable, portable format.

8.2 Right to Correct

You can edit your profile and most health entries directly in the app. If you believe any information we hold is inaccurate or incomplete and you cannot correct it yourself, contact us and we will investigate and address it within 30 to 60 days.

8.3 Right to Delete

You can request deletion of your personal information at any time. The simplest way is to use the "Delete Account" option in app settings, or to contact us at privacy@healya.ai. When you delete your account:

Deleting your account means losing access to your data. We cannot restore a deleted account once the data has been purged.

8.4 Right to Data Portability

You have the right to receive your data in a portable, machine-readable format (such as JSON or PDF) so you can take it elsewhere. Contact us if you need a specific format. There is no charge for one copy of your data.

8.5 Right to Restrict Processing

You can disconnect any data integration (such as a wearable or patient portal connection) at any time, which will stop us from processing data from that source and allow you to request deletion of data we already collected from it.

8.6 Right to Opt Out of Communications

You can opt out of optional communications (like newsletters or feature updates) by clicking "unsubscribe" in those emails or adjusting your notification preferences in-app. You cannot opt out of essential service communications such as security alerts or legally required notices.

8.7 Right to Withdraw Consent

If we process any of your information based on your consent (for example, connecting a specific data integration), you can withdraw that consent at any time by disconnecting the integration or contacting us. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

8.8 California Residents

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale of personal information. We do not sell personal information. We will not discriminate against you for exercising any of these rights.

8.9 Other State Privacy Rights

Users in states including but not limited to Virginia, Colorado, Connecticut, Texas, and Illinois have rights under their respective state privacy laws. We honor access, correction, deletion, and portability rights for all U.S. users regardless of state.

8.10 How to Submit a Request

Contact us at privacy@healya.ai or through the in-app help feature. We will verify your identity before processing a request and respond within the timeframe required by applicable law. You will not face any penalty or reduced service quality for exercising your privacy rights.

9. Data Retention

We retain your information for as long as necessary to provide the Service or as required by law.

9.1 Active Accounts

While your account is active, we retain your data to provide you with the Service, including historical records and trends that are medically relevant over time.

9.2 Deleted Accounts

When you delete your account or request deletion of specific data, we remove it from our active systems promptly. As noted in Section 8.3, trace data may remain in encrypted backups for a short period until those backups expire.

9.3 Inactive Non-Paying Accounts

If your non-paying account has been inactive for an extended period (currently defined as 1 year without login), we may reach out to ask if you want to maintain it. If we receive no response and inactivity continues, we may delete your account. We will give you advance notice before taking any such action.

9.4 Legal Retention Requirements

Some information may need to be retained longer than your account activity requires, including:

9.5 De-Identified Data

If we de-identify your data, we may retain the de-identified version indefinitely for aggregate research or analytics purposes, since it can no longer be linked to you. As described in Section 4.5, we do not share this data with advertisers, sponsors, or promotional partners.

10. Data Breach Notification

Despite our security measures, no system is completely immune to incidents. Here is our commitment and process if a breach occurs.

10.1 Notifying You

If we determine that a security breach has resulted in unauthorized access to or disclosure of your personal information, we will notify you without undue delay — and within any timeframes required by applicable law, which under most U.S. state laws means within 30 to 45 days of discovery, and in some cases sooner. We will notify you by email to your registered address, or by other means if required.

10.2 What Our Notice Will Include

10.3 Notifying Regulators

We will notify relevant state and federal authorities as required by applicable law. If the breach affects a large number of users, we may also be required to notify media outlets in affected states.

10.4 Remediation

After a breach, we will contain the incident, conduct a thorough investigation, and implement measures to prevent recurrence. Depending on the nature of the breach, we may offer affected users credit monitoring or identity protection services.

11. Third-Party Platform Addenda

11.1 Google Fit and Health Connect — Limited Use Disclosure

If you connect a Google Fit or Health Connect data source to Healya, our access, collection, and use of the information we receive through those APIs adheres to the Google Fit Developer and User Data Policy, including its Limited Use requirements. In practice, this means:

11.2 Apple Health (HealthKit)

If you connect Apple Health, we follow Apple's HealthKit developer guidelines, including not using HealthKit data for advertising or for any purpose other than providing health-related features within Healya, and not selling HealthKit data to third parties or data brokers.

11.3 Future Integrations

As we add new connected sources — such as additional EHR networks, national health information exchange frameworks, or other wearable platforms — we will add a corresponding addendum to this section describing any platform-specific obligations that apply.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. If we make material changes, we will notify you prominently — by email, in-app alert, or both — before the changes take effect. We will always update the Effective Date at the top of this policy.

If you continue using the Service after a policy update takes effect, you accept the updated policy. If you disagree with a change, you may stop using the Service and request deletion of your data as described in Section 8.3.

We may maintain prior versions of this policy for transparency. Contact us if you would like to review an earlier version.

13. Contact Information

We welcome your questions, concerns, and feedback about privacy. If you want to exercise any of your rights or have questions about this policy, please reach out.

Healya, Inc. — Privacy Office

Privacy inquiries: privacy@healya.ai

General support: support@healya.ai

Security vulnerabilities: security@healya.ai

We aim to respond to privacy inquiries within 30 days, and often sooner for straightforward questions.

If you believe we have not addressed your concern adequately, you have the right to contact your state's Attorney General or relevant privacy regulator. For health-related privacy concerns, you may also contact the U.S. Department of Health and Human Services' Office for Civil Rights at hhs.gov/ocr or 1-800-368-1019.

We will not retaliate against you for asking questions or exercising your privacy rights.

By using the Healya Service, you acknowledge that you have read this Privacy Policy and understand how your information is handled. Thank you for trusting us with your health.