Consumer Health Data Privacy Policy

This notice applies to consumers in Washington, Nevada, Connecticut, and any other U.S. jurisdiction with a comparable consumer-health-data law. Where the protections in those laws exceed the protections in our general Privacy Policy, this notice and the underlying law control. Where the general Privacy Policy provides stronger protections, the general Policy controls.

The Services are in a limited beta. The list below describes the categories we actually hold today, not a planned end-state.

• Individual health conditions, diagnoses, treatments, medications, and procedures (past, present, or future).
• Reproductive- and sexual-health information, where it appears in a record you provide or connect.
• Mental-health information, where it appears in a record you provide or connect.
• Substance-use information, where it appears in a record you provide or connect. Read Section 12 of the Terms of Service first: we do not have the machinery that 42 C.F.R. Part 2 requires and we do not hold ourselves out as a Part 2 compliant recipient.
• Genetic information, which reaches us only as a file you upload (a 23andMe or AncestryDNA raw export). There is no genetics account connection, and nothing genetic enters your record unless you put it there.
• Bodily functions, vital signs, symptoms, and measurements (heart rate, heart-rate variability, sleep stages, respiratory rate, temperature, blood pressure, blood oxygen, weight, activity, and similar).
• Laboratory results, allergies, immunizations, pregnancy records, social history, practitioner details, and visit records received through Android Health Connect’s Medical Records FHIR R4 feed or entered by you or a clinician you authorize.
• Coarse location captured at each sign-in, and continuous precise location where you grant that permission. The setting that enables continuous location and travel detection is on by default for new accounts and can be turned off at any time. Precise location can indicate an attempt to acquire or receive health services or supplies, and we treat it accordingly.
• Health-appointment and travel information derived from your calendar, including events that Google itself generated from your email and placed in your calendar. We hold no mail permission, but those events are visible to us through the calendar connection.
• The inventory of health applications installed on your device, which the operating system reports when you connect a health platform.
• Biometric identifiers are not collected. If a future feature collects them, we will obtain a separate written release first.

We collect consumer health data directly from you, from the sources you authorize, from clinicians you authorize, and automatically from your interaction with the Services. A source not named here is not connected.

• Wearables and recovery platforms: Whoop, Oura, Withings, Polar, Wahoo, and devices such as Fitbit that report through Google Health.
• Apple Health on iOS and watchOS, and Android Health Connect, including its Medical Records FHIR R4 feed.
• Google Calendar, on read access plus a dedicated Aler calendar we write to.
• Files you upload, including genetics raw exports, lab PDFs, and photographs of documents.
• Messages and documents you send into your vault by email.
• Clinicians you have authorized to contribute to your record.

What is not a source. Direct hospital EHR connections, pharmacy systems, and claims feeds are not built. Laboratory connections exist in the code but are credentialing-gated and are not enabled. No Sponsor program is live, so we receive no data from a sponsoring organization today. An earlier version of this notice named lab vendors, pharmacies, and genetics services as connected sources. That described an intended architecture and has been corrected. See the general Privacy Policy for details.

We use consumer health data only to (i) provide the Services you have requested and to build your personal-baseline model, (ii) communicate with you about the Services, (iii) operate, secure, and develop the Services, (iv) comply with law, and (v) generate de-identified or aggregated information consistent with the de-identified data terms in the general Privacy Policy. We do not use consumer health data for cross-context behavioral advertising and do not provide consumer health data to insurers, employers, or marketers in identifiable form.

Two uses worth stating explicitly. First, producing a reply to a question you ask requires transmitting the context assembled for that question, which can include your conditions, medications, laboratory values, and recent metrics, to a third-party inference provider. Second, your baseline is computed inside your own account from your own history, while the shared models that read it are trained on de-identified data, including de-identified data derived from your account. Data that could identify you never enters training.

What we do not do. We do not run product analytics, session recording, or behavioral tracking, we do not send consumer health data to an analytics or attribution vendor, and we do not run advertising in the Services.

Identifiable consumer health data is not sold. We do not sell consumer health data in identifiable form. Where any provider of the Services to you is also processing data on our behalf, that provider is bound by a written agreement that limits use to our instructions and prohibits unauthorized disclosure.

De-identified data. Aler may license or sell de-identified data derived from consumer health data, on the terms described in the general Privacy Policy. Where this stands today: we build and use de-identified datasets internally, principally to train and evaluate our own models, and no dataset has been licensed or sold to an outside party. Before one is, de-identification must follow HIPAA Safe Harbor or Expert Determination, and recipients must be contractually prohibited from attempting re-identification.

The research setting is on by default. Creating an account accepts our Terms of Service, whose research-contribution section opts the account in, so the “Research & data licensing” setting starts on. You can turn it off at any point. Because nothing has been licensed to an outside party, opting out today removes your past contributions from the internal de-identified store as well as stopping future ones.

An honest note on consent. Opt-out by default is a weaker posture than the affirmative opt-in that Washington’s My Health My Data Act, Nevada SB 370, and the Connecticut consumer-health-data provisions contemplate for this category of data. We disclose it here rather than burying it so that you can make the choice knowingly, and closing the gap is on our pre-launch list.

Affirmative authorization. If we ever propose to sell identifiable consumer health data, we will obtain a valid, separately-signed written authorization that satisfies the requirements of the applicable law (including RCW 19.373.060). We do not currently seek such authorization.

Categories with whom we share. We share consumer health data with: (a) sub-processors and service providers that help us operate the Services, the full current list of which is at /legal/sub-processors, most consequentially the third-party inference provider that generates replies; (b) care-team members you authorize, scoped to the data they need (no Sponsor program is live today); (c) law-enforcement and government authorities only as required by valid legal process or to prevent imminent harm. We have not received a government request for user data to date.

One gap stated plainly. No Business Associate Agreement is in place with our inference provider. Putting that paperwork in place is on our pre-launch list, and it is disclosed here because the alternative is letting you assume it exists.

You may at any time:

• Confirm whether Aler is collecting, sharing, or selling your consumer health data and access that data.
• Withdraw consent, including consent to processing of consumer health data and to inclusion in de-identified data licensing.
• Request deletion of your consumer health data, subject to limited exceptions required by law.
• Appeal a denial of a rights request as described in the general Privacy Policy.
• Lodge a complaint with the Washington Attorney General (atg.wa.gov), the Nevada Attorney General, the Connecticut Attorney General, or any other applicable state authority.

To exercise these rights, contact [email protected]. We respond within thirty (30) days, with extensions only where the law permits.

We retain consumer health data only as long as necessary to provide the Services, comply with legal obligations, and resolve disputes. The retention windows in the general Privacy Policy apply.

How deletion works today, stated plainly. You can delete individual records at any time, and closing your account schedules the whole record for deletion with a thirty-day window. The automated purge worker that erases the marked record at the end of that window is not built yet, so that final erasure is currently performed manually. Turning off continuous location stops new location from being recorded but does not by itself delete the history already recorded; deleting that history is a separate action you can take.

We protect consumer health data with the safeguards described in the general Privacy Policy and at /trust/security. Both split honestly between the controls in place today and the ones on our pre-launch roadmap, and you should read them as written rather than assuming a mature security program. In place today: column-level encryption on encrypted volumes, TLS in transit, role-based access on least privilege, mandatory two-factor authentication for clinicians, device-bound revocable sessions, row-level isolation of each account inside a shared database, an append-only audit log, and health content stripped from logs and error reports. Not in place today: a retained security-event pipeline, anomaly detection, an annual third-party penetration test, multi-zone redundancy, and vendor Business Associate Agreements. We are HIPAA-aware. We are not HIPAA-certified, no such certification exists, we hold no SOC 2 report, and we do not claim HITRUST.

We will announce material changes to this notice in the product, by email to active users, and on this page at least thirty (30) days before they take effect, except where a faster change is required by law.

Privacy Officer · Aler Health, Inc.
Email: [email protected]
Notice address: 1209 Orange Street, Wilmington, DE 19801, USA