This Privacy Policy explains how Asante Health, Inc. ("Asante Health," "we," "us," or "our") collects, uses, shares, and protects information when you use the Asante Health mobile application, websites, and related services (the "Services"). Please also review our Consumer Health Data Privacy Policy, which provides additional information and rights for health data under Washington, Nevada, Connecticut, and similar laws, and our Terms of Service. Some features described in this Policy, including Care Team connection, may not yet be available. This Policy applies to the information we collect at any given time.

1. About This Policy and Our Role

When You Use the Services Directly. When you obtain and use the Services directly as a consumer, Asante Health is the business responsible for the information you provide. In that direct relationship, Asante Health is generally not a HIPAA covered entity and is not acting as your healthcare provider, so the information you provide directly to us is generally not "protected health information" under HIPAA. Instead, it is protected by this Policy, the federal Health Breach Notification Rule, and applicable state privacy and consumer health data laws.

When We Act for a Provider or Health Plan. In some arrangements, Asante Health provides the Services on behalf of a healthcare provider, health system, employer, or health plan. In those arrangements, Asante Health may act as a "business associate" under HIPAA, and the information it handles on that entity’s behalf is governed by HIPAA and the relevant business associate agreement and notice of privacy practices, rather than this Policy. If you received the Services through your provider or plan, ask that organization for its privacy notice.

2. Information We Collect

Depending on how you use the Services, we may collect the following categories of information:

•  Identifiers and account information: name, email address, and the account identifiers we receive when you sign in with Apple or Google.

•  Health and wellness information: age, gender, height and weight; allergies and medical conditions; smoking and alcohol use; surgery type, date, surgeon, and hospital; injuries; your discharge date and the health information you report at discharge; answers you write in the surgery notepad; goals; and information used to calculate Prep Progress.

•  Activity and connected device data: data from wearables and health data sources you connect, such as Apple Health or Health Connect (currently steps, sleep, active calories, and walking distance), and other data types you choose to permit.

•  Nutrition and sleep information: meals, meal photos you submit, nutrient estimates, dietary logs, and sleep data you provide or connect.

•  Questionnaire and plan responses: answers to standardized questionnaires about physical function and emotional wellbeing, such as PROMIS-29 and PHQ-4, and your checklist and habit-tracking entries.

•  Communications: messages and support requests.

•  Subscription information: subscription status, plan, and trial dates. Payments are processed by Apple, Google, or another payment processor, and we do not receive your full payment card number.

•  Device and usage data: device time zone, push notification token, IP address and request logs, and records of the features you use.

•  Inferences: inferences we draw from the information above to personalize the Services, including Prep Progress.

3. Sources of Information

We collect information directly from you, automatically from your use of the Services, from Apple or Google when you choose to sign in with them, from devices and third-party services you connect, and, if you choose to connect a provider, from your Care Team.

4. How We Use Information

We use information to: provide and personalize the Services; provide educational content, calculate Prep Progress, and estimate meal nutrients from photos you submit; enable features you request, including Care Team connection if you opt in; communicate with you; measure engagement and outcomes; maintain safety, security, and quality; conduct research and product development as described below; comply with law; and, with your consent where required, send you optional communications.

5. AI Processing and Automated Decision-Making

We use artificial intelligence for photo meal logging. When you take a meal photo, we send it to a third-party AI service provider, which returns an estimate of the meal's nutrient content. We remove location and device information from photos before sending them. Prep Progress is calculated from your goals and logged activities using fixed rules and is not an AI output. AI outputs are advisory and educational only. We apply human oversight and quality review and do not use the Services to make legal or similarly significant decisions about you through solely automated means without a meaningful opportunity for human review. You can ask questions about, and request human review of, AI-assisted outputs by contacting us. We describe the AI Features and their limitations more fully in the Medical Disclaimer and AI Features Consent.

6. How We Share Information

We share information as follows:

•  Service providers and subprocessors: vendors that host, secure, analyze, or support the Services under contractual confidentiality and security obligations, including our AI service provider for photo meal logging.

•  Your Care Team: where you opt in and authorize sharing, as described in our Authorization for Care Team and Provider Data Sharing.

•  Legal and safety: to comply with law, respond to lawful requests, or protect rights, safety, and security.

•  Business transfers: in connection with a merger, financing, acquisition, or sale of assets, subject to this Policy.

Analytics and Diagnostics. We use service providers to measure app performance and diagnose errors. We configure these tools so that they do not receive the content of your health information, such as questionnaire answers, meal photos, or surgery details, and they may not use information they receive for their own purposes.

Information You Share Yourself. Some features let you export or share your own information, for example by creating a PDF summary and sending it with your device's sharing options. When you do, you choose the recipient, and the recipient's use of that information is governed by its own practices, not this Policy.

No Sale of Health Data; Advertising. We do not sell your personal information or health information for money or other valuable consideration, and we do not use your health information for cross-context behavioral advertising. We do not share consumer health data for any purpose without the consent or authorization required by applicable law. See our Consumer Health Data Privacy Policy.

7. De-Identified and Aggregated Information

We may create de-identified and aggregated information from the data we collect and use and disclose it for research, benchmarking, analytics, product development, and the training and improvement of our models. We de-identify information using methods consistent with recognized standards, which may include the HIPAA Expert Determination method or the Safe Harbor method, or comparable standards. We maintain processes intended to prevent re-identification, do not attempt to re-identify de-identified information except to test our de-identification, and require recipients to agree not to re-identify it. We do not use data from Apple Health or Health Connect to train models, as described in Section 8.

8. Apple Health and Health Connect

If you connect Apple Health or Android Health Connect, we read only the data types you permit (currently steps, sleep, active calories, and walking distance) to show your progress and calculate Prep Progress. We do not use this data for advertising or marketing, do not sell it, do not use it for decisions about credit, insurance, or employment, and do not use it to train artificial intelligence models. We share it only with service providers that help us operate the Services or with your explicit consent. You can stop access at any time in your device's health settings. Data already collected is retained and deleted as described in Section 10 (Data Retention).

9. Federal Health Breach Notification

If we experience a breach of unsecured individually identifiable health information that is subject to the Federal Trade Commission Health Breach Notification Rule, we will notify affected individuals, and the Federal Trade Commission and media where required, in accordance with that Rule. We will also comply with applicable state breach-notification laws.

10. Data Retention

We retain information for as long as your account is active and as needed to provide the Services, and thereafter as needed to comply with legal obligations, resolve disputes, maintain security, and enforce our agreements. We retain de-identified and aggregated information for longer. When information is no longer needed, we delete or de-identify it. Specific retention periods by data category are maintained in our internal retention schedule.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect information, including encryption in transit, encryption at rest where applicable, access controls, audit logging, and vulnerability management. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

12. Your Privacy Rights

Subject to applicable law, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to withdraw consent, and to appeal a decision on a request. To exercise these rights, contact us using the details below or use the in-app privacy controls. We will verify your request and respond within the time required by law. We will not discriminate against you for exercising your rights. Where applicable law permits, you may submit a request through an authorized agent; we may require proof of the agent's authority and verification of your identity.

Deleting Your Account. You can delete your account and associated personal information in the app's account settings. We will delete or de-identify your information as described in this Policy, except where we must keep it by law. Deleting your account ends your access, including any remaining time on a Surgery Cycle pass, and does not give a refund. Refund requests for app store purchases go to Apple or Google.

13. State-Specific Privacy Rights

California. California residents have rights under the California Consumer Privacy Act, as amended, including the rights to know, access, delete, correct, and limit the use of sensitive personal information, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined under California law for cross-context behavioral advertising. We honor the Global Privacy Control where required by law.

Virginia, Colorado, Connecticut, and Similar States. Residents of states with comprehensive privacy laws have rights to access, correct, delete, and obtain a portable copy of personal data, to opt out of targeted advertising, sale, and certain profiling, and to appeal. We process sensitive data, including health data, only with consent where required.

Florida. Florida residents have rights under the Florida Digital Bill of Rights to the extent it applies, including access, correction, deletion, portability, and opt-out rights.

14. Consumer Health Data

If you are a resident of Washington, Nevada, Connecticut, or another state with a consumer health data law, additional disclosures, consent requirements, and rights apply to your "consumer health data." These are described in our separate Consumer Health Data Privacy Policy, which is linked alongside this Policy.

15. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies for authentication, preferences, security, and analytics. You can manage cookies through your browser or device settings. We honor recognized opt-out preference signals, including the Global Privacy Control, where required by law. Because there is no uniform standard for browser "Do Not Track" signals, the Services do not respond to them at this time. We do not use these technologies for cross-context behavioral advertising of our Services.

16. Children’s Privacy

The Services are intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. If you believe a minor has provided us information, contact us.

17. International Users

The Services are intended for users in the United States and are operated from the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States, which may have different data-protection rules than your location. Some of our service providers, including software development and support vendors, may access information from outside the United States. We require them by contract to protect it and to use it only to provide services to us.

18. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new Effective Date and, for material changes, provide additional notice through the Services or by other reasonable means.

19. Contact Us and Privacy Officer

Asante Health, Inc., Attn: Privacy Officer

admin@asantehealthy.com