Privacy Policy

Available Health, Inc. ("we," "us," or "our") operates Available Health (the "App") and the associated website. This Privacy Policy describes how we collect, use, and protect your information when you use our services.

By using Available Health, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

A. Health Data (Stored Locally on Your Device)

Available Health allows you to import, store, and manage personal health records. By default, the health data you import into Available Health is stored locally on your device and encrypted with AES-256-GCM encryption. Encryption keys are stored in Apple's Secure Enclave (on supported devices) and protected by biometric authentication (Face ID or Touch ID). Two features are exceptions to local-only storage and are described separately below: visit recordings (Section 1E) and managed care mode (Section 1F).

If you enable iCloud sync, your encrypted health data syncs across your devices via iCloud. The encryption keys sync separately through iCloud Keychain's end-to-end encryption. We cannot read your health data at any point in this process. For full technical details, see our Security page.

When you interact with AI features, portions of your health data may be sent to third-party AI providers (see Section 3). Before transmission, we apply de-identification processes designed to remove or obscure personally identifiable information such as names, dates of birth, addresses, and insurance identifiers. However, we cannot guarantee that all personal information will be successfully de-identified in every case.

Documents you import (for example a PDF from a patient portal) and the text we extract from them are stored on our servers, in the United States, on Google Cloud Platform, encrypted at rest. We use them to read large files, extract records, and answer your questions about them. When you delete a document in the app, we delete our copy.

B. Account Information (Stored in the Cloud)

When you create an account using Sign in with Apple or Sign in with Google, we collect and store the following information on our servers:

• Your email address
• Your name (as provided by the authentication service)

This account information is stored in Google Cloud Platform (Firestore) and is used to manage your account.

C. Payment Information

Available Health is currently free to use, and we do not collect any payment information. If we offer paid plans in the future, payments would be processed by Stripe, our third-party payment processor, and we would not store your credit card details on our servers.

D. Usage Analytics

We collect anonymized usage analytics from both the App and our website to understand how our services are used and to improve the user experience. This analytics data does not include your health information.

E. Visit Recordings

If you record a doctor visit, the audio is uploaded to Google Cloud Storage and transcribed by an AI model (Google Cloud Vertex AI) so the App can produce a written transcript and summary. We work with these cloud providers under data protection agreements intended to safeguard health information. You can delete a visit recording, its audio, and its transcript from the App at any time, which removes them from our active cloud systems; residual copies in encrypted backups and operational logs are removed within 30 days.

F. Managed Care Mode

If you activate Available Health with a care program using a provider code, the health records you share in managed care mode are stored in the cloud with your care program, and authorized care-program staff may access them to support your care. Provider-search inquiries you send are handled by our team. Your care program's agreement and the disclosure you accept during setup govern how your care program uses this information. You can delete your managed care account and its cloud-stored data at any time from Settings.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve Available Health
• Communicate with you about your account or our services
• Analyze usage patterns to improve the App (using non-health analytics data)
• Comply with legal obligations

3. Third-Party Services

Available Health integrates with third-party services to provide AI-powered features. When you use these features, de-identified portions of your health data may be transmitted to these services. Our PII Redaction System automatically scans every message and replaces identifying information (names, birth dates, phone numbers, addresses, insurance IDs) with anonymous equivalents before any data leaves your device. See our Security page for details on how this works.

A. AI Chat & Document Import

AI chat uses a HIPAA-compliant AI infrastructure hosted on Microsoft Azure with a zero-data-retention policy. Chat messages sent to this service are processed and returned to your device and are not retained in the cloud. Document import is processed through Google Cloud Platform (Vertex AI) under a HIPAA Business Associate Agreement. Imported documents and the text we extract from them are retained on our servers as described in Section 1A until you delete them.

B. Bring Your Own API Key

If you choose to use your own OpenAI API key instead, your de-identified health data is sent to OpenAI's standard API services. This data is subject to OpenAI's Privacy Policy.

C. Other Third-Party Services

• Google Cloud Platform (Firestore): Stores account information
• Google Cloud Storage & Vertex AI: Stores and transcribes visit recordings under data protection agreements intended to safeguard health information
• Stripe: Processes payments
• Analytics providers: Collect anonymized usage data

4. Data Security

We take the security of your health data seriously. Available Health implements multiple layers of protection to ensure your information remains private and secure. For comprehensive technical details, please visit our Security page.

A. Encryption

All health data is encrypted with AES-256-GCM encryption before storage. This is the same encryption standard used by governments and financial institutions worldwide. Your data is encrypted at the field level, meaning even with direct database access, your information would be unreadable.

B. Secure Key Storage

Your encryption keys are stored in Apple's Secure Enclave on supported devices. The Secure Enclave is a dedicated security chip physically isolated from the rest of your device, the same technology Apple uses to protect Face ID data and Apple Pay credentials. On devices without a Secure Enclave, keys are protected by Apple's Keychain Services with hardware-backed protection.

C. Biometric Authentication

Access to your health data requires Face ID, Touch ID, or your device passcode. Your biometric data never leaves your device. When the app is locked or backgrounded, encryption keys are immediately cleared from memory.

D. iCloud Sync Security

If you enable cross-device sync, your health data is encrypted on your device before being synced via iCloud. Only encrypted ciphertext is transmitted to Apple's servers. Your encryption keys sync separately via iCloud Keychain's end-to-end encryption. Neither Apple nor Available Health can read your health data.

E. Account Security

Account information stored on our servers is protected using industry-standard security measures provided by Google Cloud Platform, including encryption at rest and in transit.

5. Data Retention and Deletion

Health data: Health data stored locally on your device is under your full control. You can delete it at any time through the App or by removing the App from your device.

Cloud-stored data: For visit recordings and for records held in managed care mode, deleting your account in the App purges the associated data from our active cloud systems (audio, transcripts, and managed-care records); residual copies in encrypted backups and operational logs are removed within 30 days. You can also delete individual visit recordings from the App.

Account data: If you wish to delete your account and associated data from our servers, please delete your account in the App, or send a written request to support@available.health. We will delete your account information within 30 days of receiving a written request.

6. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or health data to third parties for marketing or advertising purposes.

7. Legal Disclosure

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

8. Children's Privacy

Available Health is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected personal information from someone under 18, we will take steps to delete that information.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We post any changes on this page and in the App's Settings under Privacy, and we update the "Last Updated" date at the top of this policy. Changes take effect on the Last Updated date. Your continued use of Available Health after that date constitutes acceptance of the revised policy.

10. Contact Us

If you have any questions about this Privacy Policy or our security practices, please contact us at: support@available.health

For detailed information about our security architecture, visit our Security page.