Privacy Policy

This Privacy Policy describes how Idra Health Inc. ("Idra Health," "we," "us," or "our") collects, uses, and shares personal data ("data") in connection with the Idra mobile application ("Idra"), the website at idrahealth.com, and related services (together, the "Services").

Our Consumer Health Data Privacy Policy describes how we collect, use, and share consumer health data.

Your use of our Services is also governed by our Terms of Service.

1. What data we may collect

We may collect the following data when you use our Services:

• Data you provide — such as your name, age, gender, and email address; your chats with Idra and data you log, including health and wellness information; your preferences and consents; and your communications with us.
• Data we derive — such as chat responses, recommendations, and insights based on the data you provide.
• Data collected through our Services — such as your device information, account status, usage data, performance data, and diagnostic data.
• Data from other sources — such as your email address provided by a sign-in service you choose to use, and your subscription status from the app store.

2. How we may use your data

We may use your data to:

• Provide our Services — such as delivering coaching tailored to you.
• Manage your account — such as creating and authenticating your account.
• Communicate with you — such as responding to your communications, requesting feedback from you, and, with your consent, marketing our products and services to you.
• Support your safety — such as identifying potential crisis signs and displaying crisis resources when appropriate.
• Secure and maintain our Services — such as preventing misuse and fraud, monitoring, and troubleshooting.
• Improve our Services — such as analyzing usage trends, reviewing feedback you send us, and using aggregated or de-identified data.
• Improve Idra with your chats and logs, if you have opted in — such as evaluating Idra's responses and training or fine-tuning artificial intelligence models used for Idra. This setting is off by default and can be changed at any time in the app's privacy settings. If you opt in, we use your past and future chats and logs after removing direct identifiers, such as your name and email address. If you opt out, we delete the chats and logs previously used for this purpose and stop using new ones.
• Comply with law — such as meeting legal obligations and protecting our rights, property, and safety, and those of others.

We may also use your data for other purposes with your consent.

We do not read your chats or logs unless you opt in to improve Idra, the law requires it, or we need to investigate misuse of our Services.

When we use de-identified data, we maintain it in de-identified form and do not attempt to re-identify it, except as permitted by law.

3. How we may share your data

We may share your data with:

• Service providers — that process data on our behalf, such as for data storage, artificial intelligence, communications, notifications, and error monitoring services. We require our service providers to protect your data consistent with this Privacy Policy. Our artificial intelligence providers are not permitted to use your data to train their own models.
• Platform providers — such as app store and operating system providers, when you use features they supply, such as sign-in, speech recognition, notifications, or purchases. Their use of your data is governed by their own privacy policies.
• Legal authorities — when required by law, court order, or governmental authority, or to protect the rights, property, or safety of Idra Health, our users, or others.
• Successors — in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

We may also share your data with others at your request or with your consent.

Our Services may link to third-party websites and services, such as crisis resources, that we do not control. Their privacy practices are governed by their own policies.

We do not sell or rent your data, use or share it for targeted advertising, or track you across third-party websites and apps. Because we do not track you, our Services do not respond to "Do Not Track" signals that some browsers send.

4. Where we may process your data

Your data may be processed and stored in the United States or other countries where our service providers operate, which may have different data protection laws than where you live. We take appropriate steps to protect your data when it is transferred.

5. How we protect your data

We use reasonable administrative, technical, and organizational safeguards, including encryption in transit and at rest, to protect your data from unauthorized access, use, disclosure, alteration, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

6. How long we may keep your data

We retain your data for as long as necessary to fulfill the purposes for which it was collected as described in this Privacy Policy, or as required by law. We may periodically review and remove inactive or outdated data.

7. Your data rights

You have the right to:

• Access a copy of your data.
• Correct inaccurate or incomplete data.
• Delete your account and data, subject to certain legal exceptions. You can request deletion in the app's privacy settings. When you do, we delete your account and associated data, including chats and logs used to improve Idra, except where we are required to retain it by law. Residual copies, such as those in backups or held by service providers, are removed within 30 days. This deletion does not extend to communications or bug reports you have sent us, waitlist requests you have made, or to aggregated or de-identified data that can no longer be linked to you.
• Withdraw consent where processing is based on your consent, via the app's settings or the "unsubscribe" link in marketing communications.
• Appeal our decision on any of these requests.

To exercise any of these rights or appeal a decision, please contact us at privacy@idrahealth.com. We will verify your request using data associated with your account and respond in accordance with applicable law. You may use an authorized agent to submit a request. If we deny your appeal, you may contact your state's Attorney General. We will not treat you in a discriminatory way for choosing to exercise these rights.

8. Children's privacy

Our Services are intended for users who are at least 18 years old. We do not knowingly collect data from individuals under 18. If you are a parent or guardian and believe a minor has provided us with data, please contact us at privacy@idrahealth.com. If we learn that we have collected data from someone under 18, we will delete it as soon as possible.

9. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or legal requirements. When we make changes, we will post the updated policy with a new "Updated" date; the latest version is always available at https://idrahealth.com/privacy. Where required by law, we will notify you of material changes and obtain your consent before they apply to data we have already collected.

10. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at privacy@idrahealth.com.