Arxova Privacy Policy

• Arxova is a place to keep your health information together: medical records, wearable data, medications, symptoms, and what you enter yourself.
• We do not sell your health data. We do not use it for advertising. We do not pay anyone for it, and we do not pay you for it.
• Sharing with a clinic, a share link, a Circle contact, or a research study happens only when you take that step, and you can end it.
• Some features use AI from Anthropic, including background features. They run only if you allow them in the app; declining or withdrawing stops them. Section 6 explains this.
• Arxova holds the encryption keys for most records so features like ARIA and scores can work.
• You can download your data, report a problem with a record, and delete your account from Settings.
• Some things cannot be undone: encrypted copies on Arweave and older public receipts on Solana are permanent. Section 13 and Section 14 explain what that means.

This policy applies to everyone who uses the Service. Arxova is intended for adults 18 and older.

If you live in Washington, Nevada, or Connecticut, or your health data is otherwise covered by one of those states' consumer health data laws, our Consumer Health Data Policy also applies to you: https://arxova.health/consumer-health-data-policy. It describes your rights under Washington's My Health My Data Act, Nevada's consumer health data law, and Connecticut's Data Privacy Act. If the two policies conflict on information covered by one of those laws, the Consumer Health Data Policy controls.

Arxova is not a HIPAA covered entity. Section 16 explains when HIPAA applies, including when a clinic uses Arxova.

What we collect depends on the features you use and the connections you make.

Account information. Your email address, or the sign-in you use with Apple or Google, handled through our sign-in provider, Privy. The Solana wallet address for your account, either one created for you or one you connect. Your first name and display name, your preferences and settings, your language, and your time zone.

Health data you connect. When you connect a device or app, we receive the health data it makes available, depending on the permissions you grant. This can include heart rate, heart rate variability, resting heart rate, blood pressure, blood oxygen, respiration, temperature, weight, glucose, steps, activity, workouts, sleep, and energy expenditure. Sources include Apple Health, Android Health Connect, Samsung Health, Garmin (through ROOK), Oura, WHOOP, Withings, Polar, Strava, and Sensor Bio.

Medical records. When you connect a health system, you sign in to that health system's patient portal through Fasten Health, and your records come to Arxova. Records can include conditions, medications, allergies, immunizations, procedures, visits, lab results, imaging reports, clinical notes, the names of your clinicians and health systems, and the demographic details your health system keeps, such as your name, date of birth, sex, address, and phone number.

Information you enter or upload. Symptoms, manual vital signs, medications and doses, supplements, meals, cycle and reproductive health information, check-ins, survey answers, goals, notes, and questions you ask ARIA. Documents you upload, and photos of insurance or implant cards that you choose to scan.

Genetic information. If you upload a genomic data file, we store it and produce a summary from it.

Information we create. Summaries, trends, scores, alerts, patterns, insights, ARIA's memory of earlier conversations, and research study matches. This is health information too, and we treat it that way.

Information about other people. If you add contacts to Arxova Circle, we collect their names, their phone numbers or email addresses, and any replies they send. If you enter family history, it is about your relatives as well as you.

Usage and technical information. Which features you use, app version, device type and operating system, push notification tokens, crash information, and request logs, including IP addresses, on our servers. We use technical information to operate the Service, investigate errors and protect accounts. Product analytics is described separately in Section 7.

Website information. On arxova.health, website analytics is controlled by the cookie-choice banner. Section 7 has the details.

We do not collect your device's precise location. When you search for research studies, we use a coarse location, such as your state, taken from your profile.

We use information to:

• create and secure your account and sign you in;
• bring in, store, organize, and display your health information;
• calculate scores, trends, and alerts, and send you notifications and reminders;
• provide ARIA and the other AI features described in Section 6;
• carry out sharing that you start: share links, clinic access, Circle messages, and research steps;
• match you to research studies if you opt in, and count community insights if you opt in;
• understand how the app is used and fix problems;
• protect the Service, detect misuse, and keep security logs;
• respond to your requests and support questions; and
• comply with the law.

We do not use your health information for advertising, and we do not send marketing emails or text messages from the app. Notifications are about your own information, your medications and reminders, your studies, and your account.

Required to use Arxova: an account; the health data consent described in Section 5; storing and displaying the information you bring in; security logging; and the encrypted storage and audit receipts described in Sections 12 to 14.

Features you can choose or control, as described in the sections below:

• connecting medical records;
• connecting each device or health app;
• AI features (Section 6);
• product analytics in the app (Section 7);
• push notifications;
• Arxova Circle messages;
• share links and clinic access;
• research matching, study pre-screening, and joining a study; and
• community insights.

Turning off an optional feature does not stop you from using the rest of Arxova.

How long each choice lasts

You can change each of these in the app.

Before setting up a new account, the app asks for your consent to collect and use your health data, and confirms you are 18 or older. Earlier accounts were not asked for specific health-data collection consent beyond the Privacy Policy acceptance. They are asked the next time they open the updated app; until they answer, collection continues, including wearable syncs and incoming records.

If you decline or withdraw this consent, or tell us you are under 18, we stop all new collection: no new wearable data, no new records. The app stays locked until you consent again or delete your account.

This consent covers collection. Sharing with people, clinics and research teams is separate: it happens through your own actions, such as creating a share link, giving a clinic access, adding a Circle contact, or consenting to research. Each has its own step. Service providers also receive information as described in Sections 6, 7 and 10, including default-on analytics.

ARIA and several other features use Claude, an AI service from Anthropic, PBC. We use Anthropic’s commercial AI services. We do not authorize Anthropic to use information sent through these services to train its models. A Business Associate Agreement is required before these services process protected health information on behalf of a clinic.

When your information is sent to Anthropic:

• ARIA chat;
• ARIA's memory of earlier conversations;
• building a map of how your health information connects;
• finding patterns in your data;
• daily insights and proactive messages, which are prepared in the background even when you have not opened ARIA;
• doctor and visit summaries;
• tagging meals you log;
• choosing search terms for article citations;
• reading documents you upload; and
• reading photos of insurance or implant cards.

What is sent. A capped, minimized snapshot of your information, not your whole history. Depending on the feature, it can include records, lab results, medications, supplements, symptoms, wearable data, notes, cycle information, a genomics summary, scores, alerts, ARIA's memory, and recent conversation. Your name is removed from the health record before ARIA sees it, and no account details, email, phone number, address, or device identifiers are attached. Card photos, documents, and the text you type are sent as they are and can include your name or other details. Because dates, clinicians, and clinical notes can remain, we treat everything sent to Anthropic as health information, not as de-identified data. Anthropic keeps information only as allowed by its retention terms with us.

Your choice. The app asks separately whether to allow these AI features. Until you allow them, no AI features run for your account, including background features such as morning insights. Older app versions cannot show this choice, so AI features do not work on them until you update the app and answer. If you decline or later withdraw in Settings, AI features stop. Earlier ARIA permissions have been retired; they are not treated as permission under the new choice.

ARIA’s answers, scores, and alerts are informational and may be inaccurate. They are not medical advice or final clinical decisions. Automated research matching can affect which studies you see; the study team makes final eligibility and enrollment decisions.

Product analytics. We use PostHog to understand how the app is used. App analytics is on by default; we have not asked for a separate app-analytics permission. You can turn off analytics events sent by the app in Settings. Some usage events are sent from Arxova’s servers, and the setting does not stop those. This switch controls the app events described here; it does not stop necessary sign-in, security or operational logging.

Since September 30, 2026, events are limited to an approved list of feature-use events, contain no health values, and are tied to a pseudonymous identifier derived from your account, not to your name or email. Events sent before that date included limited health details, such as a symptom type or a daily step total, and some were tied to your wallet address. Which features you use can suggest something about your health, for example using a glucose feature, so we treat these events as consumer health data.

On our website, PostHog loading is controlled by the cookie-choice banner. The app’s analytics setting does not control website cookies. There are no advertising, attribution, or social media tracking tools in the app, and no AppsFlyer SDK. Some of our marketing links use AppsFlyer OneLink to send you to the right app store; when you tap one, AppsFlyer records the click.

Push notifications are delivered through Expo, Apple Push Notification service, and Google Firebase Cloud Messaging. Notifications sent from Arxova's servers do not include health readings, medication or supplement names, condition names, or clinic or study names. They tell you an update is ready and ask you to open the app. The morning greeting can include your first name. Some notifications are created by the app on your phone and are not sent through these services: glucose alerts can show your glucose reading, appointment reminders can show the appointment details, and goal reminders can show your progress. Notification text can appear on your lock screen. You can turn notifications off in your phone's settings, and some types in Arxova's Settings.

Arxova Circle sends messages to contacts you choose. Circle messages are sent through Twilio: by text message (SMS) to phone numbers in the United States and Canada, and by WhatsApp to phone numbers in other countries. A message includes your first name and can describe how you are doing. Each message tells your contact that replies show up in your Arxova. Replies are kept for up to 180 days.

At your direction. We share your information when you take a step to share it:

• Share links. You choose what to include and how long the link lasts. Anyone who has the link can open it until it expires or you revoke it.
• Clinics. When you connect with a clinic using a pairing code or invite, the clinic can see the records you allow, and can add its own care records. Access lasts until you or the clinic end it.
• Arxova Circle contacts, as described in Section 8.
• Research, as described in Section 11.
• Wallet passes. If you ask, we add your implant card to Apple Wallet or Google Wallet.

Service providers. Companies that run parts of the Service for us receive the information listed in Section 10, only to provide that service.

Legal requirements. We may disclose information when the law requires it, such as in response to a valid court order or subpoena, or to protect someone's safety.

If Arxova is sold or closes. Section 25 explains what happens.

Affiliates. Arxova has no affiliates that receive your information.

We do not sell your health data. We do not sell it, rent it, or trade it, to advertisers, data brokers, insurers, employers, pharmaceutical companies, or anyone else. We do not use it for targeted advertising, and we do not allow third parties to track you across other websites or apps through Arxova.

These companies receive information from Arxova. For services involving clinic protected health information, we require the appropriate Business Associate Agreements and service configurations before processing that information.

Some services are connected in our code but not in use today: Stripe (payments), Persona (identity verification), MoonPay, and Jupiter. If we start using one, we will update this list.

We require service providers to use your information only to provide their service to Arxova.

Research is optional. Arxova does not sell health data and does not pay participants. Clinics and research institutions pay Arxova for the matching infrastructure; that fee is not payment for your data.

Research matching. If you opt in, Arxova checks your clinical records against study criteria. Wearable data is not used. Matching is automated and happens inside Arxova. Before you agree to a study, researchers see only counts, which are rounded, and broad characteristics, such as top conditions and age bands, of the people waiting. They do not see who you are. Opting out stops matching immediately.

Pre-screening by a clinical site. A clinical site that pre-screens you sees your eligibility result only after you sign a HIPAA authorization for that study. You can revoke it.

Joining a study. After you complete a study’s consent and any required privacy authorization, that study team receives your name, contact details (email, phone, address, and date of birth), and the records relevant to the study so they can enroll you. From then on, the study's consent form and the study team's own policies also apply. Information already delivered to a study team cannot be pulled back by Arxova.

Finding studies. To find studies on ClinicalTrials.gov, we send a condition term, an age, and a coarse location. We do not attach your name or account identifier. The condition, age and coarse location are still health-related search information.

No re-identification. We do not try to re-identify de-identified data, and our researcher terms require researchers not to re-identify it either.

After you withdraw. Your data is removed from research datasets within 30 days.

Community insights. If you opt in, your conditions and symptom types are counted each month, without identifying you in the published counts. Nothing about a condition is shown until at least 50 people with that condition have joined. If you opt out, your counts are removed. Your opt-in or opt-out is recorded on-chain with a random reference.

All Arxova databases are encrypted at rest at the storage layer. In addition, source documents, ARIA conversations, and raw device data are each encrypted individually with AES-256-GCM, using envelope encryption. Daily wearable totals, medication lists, symptoms, cycle data, and daily summaries are protected by storage-layer encryption only, so that features can read them. Information is encrypted in transit.

You decide who can see your records. Sharing, clinic access, and research all require your action, and you can revoke them. Arxova holds the encryption keys for most records so features like ARIA and scores can work; records encrypted with your wallet’s key require that key or an authorized decryption path. The keys Arxova holds are kept in secrets separate from the databases.

Some records are also stored on Arweave, a permanent storage network, through the Irys service. Records are encrypted before upload. Copies on Arweave are permanent and cannot be deleted by anyone, including Arxova. When you delete your account, we remove the encryption keys we hold from active systems. Copies in our database backups expire within 5 days. After those retained key copies expire, encrypted files cannot be opened using Arxova’s retained keys. This does not erase plaintext or keys someone previously obtained, or the public labels described below.

Objects written before October 1, 2026 carry public, permanent labels showing a wallet address and the type of record, such as a lab observation, a medication, or a genomics file. Objects written since then do not.

We do not ask for a separate consent before storing encrypted copies on Arweave. It is part of how Arxova stores records.

Arxova writes tamper-evident audit receipts to the Solana blockchain, so there is a record that cannot be quietly changed. A receipt is written when:

• your account is created;
• your medical records are accessed (at most once a day) or you download a copy of your data;
• you share records, someone opens a share link, or you revoke a share;
• data syncs from a device, or records are deleted;
• you log medications or supplements (one receipt a day, without saying which);
• a health alert is generated;
• a clinic or study sends you a reminder, or Arxova asks you to review medications; and
• you grant or revoke access: clinic access, research matching, a study's pre-screening authorization, and community insights.

A receipt is also written when you give or withdraw your AI consent, and when you add or remove an Arxova Circle contact.

Some choices are not recorded on-chain, including connecting or disconnecting a device or app, and your analytics setting.

Health records and health values are not written to Solana. Since October 1, 2026, receipts use a random reference instead of your wallet and a generic event name. A private reference held by Arxova connects a receipt to its account while that reference exists. Receipts written before then were linked to your wallet address and named the type of event (for example, a health alert or a device sync). Those older receipts are public and cannot be removed.

Arxova has no cryptocurrency token.

We protect information with encryption at rest and in transit, access controls, separation of encryption keys from data, logging and monitoring, and vendor agreements. No system is perfectly secure.

• SOC 2 Type 1. Arxova has a SOC 2 Type 1 report covering the Security criteria, as of August 31, 2026, issued by Percilchofe CPA LLC on September 23, 2026. A Type 1 report evaluates the design of controls at one point in time.
• CMS Health Tech Ecosystem. HealthKey Labs, LLC is an approved participant in the "Patient Facing Apps — Conversational AI Assistants" and "Patient Facing Apps — Kill the Clipboard" categories, approved by CMS on October 3, 2026. This participation is not a CMS endorsement or approval of Arxova’s clinical outputs or legal compliance.
• Penetration test. An independent penetration test is underway.
• CARIN Alliance. We are aligning our practices with the CARIN Code of Conduct for consumer-facing health apps.

If a breach affects your information, we will notify you and the authorities as required by the FTC Health Breach Notification Rule, by HIPAA where Arxova acts for a clinic, and by state law.

Arxova is not a HIPAA covered entity. For information imported into the independent consumer Service at your direction, including through Fasten Health, Arxova generally does not act as a HIPAA business associate merely by receiving it. The FTC Act, FTC Health Breach Notification Rule and applicable state law protect that consumer information.

When a clinic uses Arxova's clinic console, Arxova acts as the clinic's business associate, and the clinic's own Notice of Privacy Practices applies to the records the clinic creates. We sign a Business Associate Agreement with each clinic before it uses Arxova. Records a clinic creates in its care workspace belong to the clinic's record. If you revoke the clinic's access or delete your account, those records stay with the clinic and are no longer linked to your Arxova account.

Research pre-screening by a clinical site happens under a HIPAA authorization you sign for each study.

You can use these rights wherever you live. All of them are free.

• Get a copy of your data. Settings, "Download a copy of my data."
• Report a problem with a record. On a document, imaging report, note, lab history, or prescription, use "Report a problem with this record." This opens an email to us naming the record type, date, and source, without the record's contents. We fix errors in how Arxova received, processed, or displayed a record. The original record can only be corrected by the health system that created it, and we will tell you how to ask them. Information you entered yourself, you can change or remove. A correction is not automatically sent to anyone you shared the record with before the correction. Each record shows where it came from.
• Withdraw a consent. The health data consent, AI features, research, and community insights can be withdrawn in Settings. Section 18 lists what each withdrawal stops. Analytics can be turned off in Settings. Connections can be disconnected in the app.
• Delete your account. In Settings, or by email (Section 19).
• Contact us or complain. Settings has our privacy contact and a complaint path (Section 27).

For any request you cannot complete in the app, email privacy@arxova.health. If you write to us from outside the app, we verify that the request comes from the account holder, for example by confirming the email on your account or asking you to sign a message with your wallet. We respond within 45 days of receiving your request, or within a shorter period if required by law. If the law permits an extension, we notify you during the initial response period and explain why. We complete deletion requests sent by email within 30 days (Section 19). We will not treat you differently for using your rights, though some features cannot work without the data they need.

How. In Settings, "Delete account." Deletion starts immediately and runs automatically, with retries until it finishes. You can also email privacy@arxova.health; we complete deletion requests sent by email within 30 days.

What is deleted automatically:

• your account data in Arxova’s active databases, including imported records, shares, ARIA history and settings, subject to the specific retained records listed below;
• the encryption keys we hold in active systems for your Arweave copies; backup copies of those keys expire within 5 days;
• your Privy sign-in account;
• your billing records at RevenueCat and Stripe, if any exist; and
• Arxova's access to your Strava, Garmin (through ROOK), Oura, WHOOP, Polar, and Withings accounts.

What our team deletes by hand: your analytics profile at PostHog, and any records at Persona or Twilio.

What we cannot reach: Fasten Health and Sensor Bio do not offer a way for us to delete data or end the connection. Where available, revoke Arxova in the connected health system’s patient portal or your Sensor Bio account. If you cannot find that option, contact the provider or privacy@arxova.health for help. We do not send account-deletion notices to Anthropic, Fasten Health or Sensor Bio. Information previously sent to Anthropic is subject to its retention terms under our agreement, including our Business Associate Agreement. These describe current technical limits; they do not waive your deletion rights or excuse notices and cooperation required by applicable law. Email us if a provider-held copy needs attention.

What is kept:

• records a clinic created in its care workspace stay with the clinic, no longer linked to your account;
• consent records and security logs are kept without your identity;
• database backups containing your data expire within 5 days;
• encrypted copies on Arweave remain permanently; access depends on whether any usable key or plaintext copy remains;
• public labels on Arweave objects and Solana receipts written before October 1, 2026 remain; and
• We retain a one-way hashed reference derived from your account’s wallet address, together with the time and reason your sign-in sessions were ended, to keep sign-in tokens issued before deletion invalid. The original wallet address is not retained in this session-revocation record. This restricted security reference is not used for research, advertising, or analytics.

Inactive accounts. We do not delete accounts for inactivity. An account and its data stay until you delete it.

Arxova uses automated processing to calculate scores, generate alerts, prepare ARIA's insights, and match you to research studies. Research matching is automated eligibility screening: it decides which studies are shown to you and whether you appear in a study's counts. A study team decides whether you can enroll. Arxova does not use automated processing to make decisions about credit, insurance, employment, housing, or your access to health care. You can stop research matching at any time by opting out, and you can turn off AI features in Settings.

• A share link works for anyone who has it until it expires or you revoke it. Send it only to people you mean to.
• Once a clinic, a study team, or a link viewer has seen or saved your information, revoking access stops future access but cannot recall what they already have.
• Some notifications created on your phone, such as glucose alerts and appointment reminders, can show health details on your lock screen.
• Circle messages go to your contacts' phones, where other people may see them.
• Genetic information is shared in part with your biological relatives. Uploading or sharing genetic data, or family history, can reveal information about them.
• Information shared with a clinic is also governed by the clinic's own privacy practices, and information given to a study team by the study's consent form.

Your consent covers your information, not anyone else's. When you add a Circle contact, you give us their phone number; please add only people who expect to hear from you. Each message tells them that replies will show up in your Arxova. If a contact wants to stop receiving messages, they can reply STOP or contact us at privacy@arxova.health.

Arxova is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you tell us on the consent screen that you are under 18, we stop collecting health data for that account. If you believe a child is using Arxova, contact privacy@arxova.health and we will delete the account.

If Arxova is sold, merges with another company, or transfers its business, any company that receives your information must keep the commitments in this policy for that information. We will tell you in the app before your information is transferred, and you may download your data and delete your account before the transfer.

We will post any change here with a new effective date. When a change is material, the updated app tells you and asks you to accept the updated terms before you continue. Declining signs you out. Older app versions do not enforce this screen, and our servers currently do not block access solely because updated terms have not been accepted. While that screen is shown, you can accept, sign out, or open the Delete Account page to request deletion by email. For other requests, such as a copy of your data, email privacy@arxova.health.

HealthKey Labs, LLC's Founder and Chief Executive Officer is responsible for this policy and for Arxova's privacy program. You can reach the Founder and Chief Executive Officer at privacy@arxova.health.

Everyone at Arxova with access to personal data completes privacy and security training, and we review our privacy and security practices at least once a year.

To make a privacy complaint, use "Make a privacy complaint" in Settings, or email privacy@arxova.health with the subject "Privacy complaint." We will review it and respond. If you are not satisfied with our response, you can contact the U.S. Federal Trade Commission or your state attorney general.

HealthKey Labs, LLC d/b/a Arxova
382 NE 191st St PMB #924568
Miami, FL 33179
United States

Privacy email: privacy@arxova.health
Website: https://arxova.health
Privacy Policy: https://arxova.health/privacy-policy
Consumer Health Data Policy: https://arxova.health/consumer-health-data-policy