Effective Date: September 5, 2026
This Consumer Health Data Privacy Policy applies to "consumer health data" as defined by the Washington My Health My Data Act (RCW 19.373), the Nevada Consumer Health Data Privacy Law (SB 370), and the Connecticut Data Privacy Act as amended. It describes how HALai, Inc. ("HALai," "we," "us") collects, uses, shares, and retains consumer health data, and how you can exercise your rights. This policy covers consumer health data only. Health information we process on behalf of a healthcare provider under HIPAA, as that provider's business associate, is not consumer health data under these laws and is governed by that provider's Notice of Privacy Practices and our Business Associate Agreement with them. 1. Categories of Consumer Health Data We Collect, and the Purpose for Each - Health conditions, symptoms, diagnoses, and status you enter or describe — Purpose: to answer your questions and generate guidance and summaries for you in the HALi application. - Medications, dosages, and treatments you enter — Purpose: to answer your questions about your medications and treatment. - Laboratory results, imaging, and clinical documents you upload — Purpose: to summarize and explain those documents to you at your request. - Health-related questions, prompts, and conversation content you submit — Purpose: to generate a response to you and to maintain your conversation history in your account. - Voice recordings when you use voice features to ask health questions — Purpose: to convert your speech to text and generate a response during that session. - Health information about family members that you choose to enter — Purpose: to answer your questions about the care of a family member at your direction. - Appointment, provider, and care-coordination details you enter — Purpose: to help you organize and understand your care at your request. - Bodily functions, vital signs, measurements, and wellness data you enter — Purpose: to answer your questions and generate guidance for you. - Precise location data — We do not collect precise location data. - Biometric or genetic data — We do not collect biometric or genetic data. - Data related to gender-affirming care — We do not seek this data. If you choose to enter it, it is treated as consumer health data under this policy and is subject to the same protections and restrictions. - Data related to reproductive or sexual health — We do not seek this data. If you choose to enter it, it is treated as consumer health data under this policy and is subject to the same protections and restrictions. 2. Sources of Consumer Health Data - Directly from you, when you type, upload, dictate, or otherwise enter information into the HALi application. - From a healthcare provider or family member, only where you have expressly directed or authorized that sharing within the HALi application. We do not purchase consumer health data, and we do not collect consumer health data from data brokers, advertising networks, or public sources. 3. Categories of Consumer Health Data We Share, and With Whom We share the following categories of consumer health data with the following recipients, for the following purposes: - Microsoft Corporation (Microsoft Azure) — Categories shared: all categories listed in Section 1 that you provide. Purpose: cloud hosting, storage, and processing of the HALi application. - OpenAI, L.L.C. — Categories shared: health questions, prompts, conversation content, uploaded document text, and voice audio you submit. Purpose: to generate the AI response you requested. Operated under a Business Associate Agreement with zero data retention on the endpoints we use. - Anthropic, PBC — Categories shared: health questions, prompts, conversation content, and uploaded document text you submit. Purpose: to generate the AI response you requested. Operated under a Business Associate Agreement with zero data retention on the endpoints we use. - A healthcare provider or family member you designate — Categories shared: only the categories you select when you choose to share. Purpose: to fulfill a sharing request you initiate. Specific affiliates. We share consumer health data with one affiliate: Artificial Healthcare Intelligence, Inc., our parent organization, and only for the purpose of operating and supporting the HALi application. We do not share consumer health data with any other third party. We do not share consumer health data with advertisers, data brokers, analytics providers, or social media platforms. Auth0 by Okta, Inc. (authentication) and Stripe, Inc. (payment processing) support the HALi application but do not receive consumer health data. 4. We Do Not Sell Consumer Health Data We do not sell consumer health data, and we have not sold consumer health data. We do not collect or process consumer health data for targeted advertising. If we ever propose to sell consumer health data, we will first obtain your separate, specific, written, and revocable authorization as required by law, and we will not condition your access to the HALi application on giving that authorization. 5. Your Rights You have the right to: - Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom we have shared it and an active contact for each. - Withdraw your consent to our collection and sharing of your consumer health data. - Delete your consumer health data. - Appeal our refusal to act on any of the above. How to exercise your rights. Email privacy@halai.ai, or use the privacy controls in your HALi account settings. State which right you are exercising. How we authenticate you. We will verify your request using the email address associated with your HALi account. If we cannot verify you through that address, or if the request is made by an authorized agent, we may request additional information sufficient to confirm your identity or the agent's authority. We will not use information you provide for authentication for any other purpose. Our response. We will respond within 45 days of receiving your request, and may extend once by an additional 45 days where reasonably necessary, in which case we will tell you before the first period ends. Deletion. When you request deletion, we will delete your consumer health data from our records and will notify each affiliate, processor, and third party with whom we have shared it, directing them to delete it as well. Appeals. If we decline your request, we will tell you why and how to appeal. Email privacy@halai.ai with the subject line "Privacy Appeal." We will respond to an appeal within 45 days. If we deny your appeal, we will provide you with a method to contact your state Attorney General to submit a complaint. 6. How Long We Keep Consumer Health Data, and How We Decide - Health questions, prompts, conversation content, and AI responses — Retained for the life of your account, or until you delete the conversation or your account. Criteria: retained only while needed to give you access to your own history. - Uploaded documents, lab results, and images — Retained for the life of your account, or until you delete the item or your account. Criteria: retained only while needed to give you access to your own uploads. - Health conditions, medications, and profile health details you enter — Retained for the life of your account, or until you delete them or your account. Criteria: retained only while needed to personalize responses for you. - Voice audio submitted to voice features — Not retained beyond the session, unless you save it, in which case it follows the retention above. Criteria: retained only for the duration needed to generate your response. - Consumer health data shared at your direction — Retained until you revoke the share, or the recipient deletes it. Criteria: retained only while your sharing authorization remains active. After account deletion, we delete consumer health data within 30 days, except where a longer period is required by law, in which case we isolate and protect the data and delete it when the legal obligation ends. 7. Contact and Changes to This Policy Contact for privacy inquiries: HALai, Inc. — Attn: Privacy Officer privacy@halai.ai Changes. If we materially change this policy, we will post the updated policy at this address with a new Effective Date and, where the change affects data we have already collected, we will obtain your consent before applying the change to that data.
Related: Privacy Policy · HALi User Agreement · Terms of Use · Healthcare Provider User Agreement · Security & Compliance
