1. Why this document exists
Washington's My Health My Data Act, Nevada's SB 370 and Connecticut's health data provisions each require a business that handles consumer health data to publish a policy about that data alone. This is that policy. Everything else about how Neuraphic handles personal information is in the Privacy policy.
These laws define health data far more broadly than most people expect. It is not limited to a diagnosis, a medical record or anything a clinician wrote. Under Washington's definition it includes bodily functions, vital signs and symptoms, and information inferred from data that is not itself about health, including by algorithm.
We do not run a health service and we do not ask anybody for health information. This policy exists because a general-purpose assistant receives whatever a person chooses to type into it, and some of that is capable of being health data under those definitions.
2. What consumer health data we may receive
We do not collect consumer health data as a category, seek it, or ask for it. We may receive it in one way only:
2.1 Content you send us. If you write something to one of our products that describes a physical or mental health condition, a symptom, a medication, a treatment, a health-care service, or an attempt to find one, that content is consumer health data under these laws for as long as we hold it. It reached us because you typed it, not because we asked.
2.2 We do not collect precise location, and we therefore do not collect location capable of indicating that somebody sought health services.
2.3 We do not perform biometric identification. Where our identity products use a passkey, the check happens on your own device and we receive confirmation that it succeeded, never a fingerprint, a face scan or any biometric template.
2.4 We do not buy health data, we do not receive it from data brokers, and we do not obtain it from third parties.
3. What we do with it
3.1 We use it for one purpose: to give you the response you asked for, and to run and secure the service while we do. That is the purpose you supplied it for.
3.2 It is excluded from model training. Health data is filtered out before any content is used to improve our models. This is not governed by the training setting in your account and cannot be switched on.
3.3 We do not use it to profile you, to infer anything about you, or to decide anything about you.
3.4 We do not use it for advertising. We do not run advertising of any kind.
4. Who we share it with
4.1 We do not share consumer health data with anyone for their own purposes.
4.2 The only parties who may handle it are the infrastructure providers who host and transmit our services on our behalf, listed on our Sub-processors page. They act only on our instructions, they may not use it for anything of their own, and they are bound by contract to those limits.
4.3 Affiliates. Neuraphic, Inc. has no subsidiaries or affiliates. If that changes, this policy will name each one before any consumer health data is shared with it.
4.4 We may disclose it if the law compels us to, such as under a valid court order. Where we are permitted to tell you, we will.
5. We do not sell it
5.1 Neuraphic does not sell consumer health data, and has never sold it. We do not license it, trade it, or transfer it to anyone in exchange for money or anything else of value.
5.2 These laws allow a sale only with a signed authorization that is separate from any other agreement and that expires after one year. We do not ask anybody to sign one, and we do not intend to. If that ever changed, it would require your signed authorization first, and no sale could happen without it.
6. How long we keep it
6.1 For as long as the content it is part of remains in your account. Delete the content, or delete your account, and it goes with it.
6.2 Deleting your account removes your content within 30 days. The only thing that survives is the accounting record of any payment, which tax law requires us to keep and which contains no health information: who paid, how much, when, and what tax applied.
7. Your rights
Whoever you are and wherever you live, you can:
7.1 See it. Ask us for a copy of the consumer health data we hold about you, and a list of anyone we have shared it with.
7.2 Delete it. Ask us to delete it. We will delete it from our systems, and we will tell the providers who host it on our behalf to do the same. We will not refuse this because deleting it is inconvenient for us.
7.3 Withdraw consent. If we are holding it because you gave it to us, you can tell us to stop, and we will.
7.4 How. Write to privacy@neuraphic.com. We answer within 45 days, and we will tell you if we need the one extension the law allows and why. There is no charge, and we will not ask you to justify the request.
7.5 If we say no. We will tell you why, in writing, and how to appeal. If the appeal fails, we will give you the contact details of your state's Attorney General so you can complain.
8. Geofencing
We operate no geofence of any kind, anywhere. We do not collect precise location, we do not build virtual boundaries around health-care facilities, and we do not send messages to anybody based on being near one. These laws prohibit that practice within 2,000 feet of a health-care facility in Washington and 1,750 feet in Nevada and Connecticut; we are not near the line, because we do not do it at all.
9. Who we are, and who to write to
Neuraphic, Inc., a Delaware corporation, United States of America, is responsible for the consumer health data described in this policy.
Privacy: privacy@neuraphic.com
Legal: legal@neuraphic.com
10. Changes
If we change this policy in a way that affects what we do with consumer health data, we will tell you directly rather than expecting you to notice, and we will do it before the change takes effect. Previous versions stay published with the dates they applied.