Medical Disclaimer — MyHealth

Version (policy_version): 2.10 Last updated: July 19, 2026 Effective: as of July 19, 2026. Applies to: MyHealth, an iOS personal health-record app with an educational reading powered by artificial intelligence. Controller / Developer: BAS AI — BAS ARTIFICIAL INTELLIGENCE LTDA, CNPJ 64.106.409/0001-70 — www.bas-ai.com. Privacy contact / Data Protection Officer (DPO): Guilherme Bastian — dpo@bas-ai.com.

Please read this disclaimer carefully before using MyHealth. By using the app, you confirm that you have understood and agree to the limits described here.

1. What MyHealth is

MyHealth is a tool for you to organize, store, and understand your health information in one place. With it you can record and review exams and markers, conditions and body systems, medications (including the daily intake log), allergies, vaccines, appointments, vital signs and body composition (weight, body fat, blood glucose, blood pressure, heart rate), symptoms, complaints, physical activity, a daily wellness check-in, documents and reports, family history, and your care team. If you connect a wearable source (Apple Health/Apple Watch, Oura, or WHOOP), sleep, continuous metrics (resting heart rate, HRV, steps, energy), provider scores, and device events are also included.

MyHealth also offers an educational reading generated by artificial intelligence (AI) about the information you yourself enter, with the goal of helping you better understand your data and prepare to talk with healthcare professionals.

Beyond that personalized reading, MyHealth also displays general educational content about common markers, conditions and measures (for example, "what ferritin is" or "what elevated blood pressure is"). This content is population-level and the same for every user — it is not personalized to your case, not a diagnosis, and not an interpretation of your individual result. It is prepared with AI support from general topics (the name of the marker/condition/measure), without using any of your data, and is available regardless of whether you have authorized AI processing of your data — unlike the personalized reading described above, which only occurs with your consent (Section 5).

2. What MyHealth is NOT (important limits)

• MyHealth is not a medical device and must not be used as one. It has no health registration as health software (Software as a Medical Device — SaMD) before the regulatory authorities, among which, by way of example, ANVISA (Brazil), the FDA (United States), and the European medical-devices framework (MDR — Medical Device Regulation). The list of these authorities is merely illustrative of the frameworks that could be applicable and does not amount to a categorical claim of exemption in any specific jurisdiction: the regulatory classification depends on the intended use and on local law. MyHealth is intended to organize and provide an educational reading of data you yourself enter, and not to diagnose, treat, cure, mitigate, or prevent diseases.
• MyHealth does not make diagnoses, does not prescribe medications, exams, or treatments, and does not replace a consultation, evaluation, exam, or follow-up by a qualified healthcare professional.
• The AI educational reading is educational and informational. It may contain inaccuracies, be incomplete, or not apply to your specific case. It is not a clinical decision.
• The data and alerts coming from wearables are not a diagnosis: scores (such as Oura readiness or WHOOP recovery) are calculations by the manufacturer itself, displayed as the manufacturer reports them; device events (such as ECG classification, irregular-rhythm notification, or fall detection) are notifications from your device, which must be confirmed with a physician.
• The app's content does not create a doctor-patient relationship between you and BAS AI or any professional.

3. Always confirm with your physician

The information and analyses in MyHealth are meant to support your care, never to replace it. Before starting, stopping, or changing any medication, treatment, diet, exercise, or health practice — and before making any decision based on what you saw in the app — talk with your physician or another qualified healthcare professional. The professional knows your complete history and is the one who can assess your case.

MyHealth may educationally highlight exams or markers that might be worth re-discussing with your physician — for example, a result that came out of the reference range and has not yet been repeated. This highlight is only a reminder for the conversation with the professional: MyHealth does NOT determine when to redo an exam nor define follow-up intervals — when, whether, and how often to repeat an exam is a clinical decision, always your physician's, who knows your case in full.

When the app shows general educational content because a marker or measure is above or below the reference range (or in a magnitude band such as "borderline," "moderate," or "marked"), that is only a filter to pick, from the educational library, a general text that is relevant to your case — never a classification, a severity grading, or a clinical judgment of your result. The text shown is the same for anyone in that band and does not assess your specific value; interpreting your individual result is your physician's job.

The daily continuous glucose monitor (CGM) aggregates the app displays (mean, minimum, maximum, variability, and the percentage of the day within the 70–180 mg/dL range of the industry display standard, the AGP report) follow the same logic: they are a factual display, computed the same way for everyone — they are not an individual target, not a judgment about your glucose control, and not a goal set for you. Glucose target ranges are individual, and your physician is the one who sets them.

New device and Apple Health data (2026-07-19). Sleep-apnea events, sound-exposure notices, at-home spirometry (FVC/FEV₁/peak flow), inhaler use, audiogram, and the ring's estimates (vascular age, pulse-wave velocity, temperature deviation) are shown in a descriptive and factual way — exactly as the device or the exam reports them — and the AI treats them as education, never as a diagnosis, staging, or clinical guidance: it never stages a degree of hearing loss, never computes an apnea index (AHI), never defines peak-flow zones or adjusts inhaler use, and never asserts arterial stiffness or vascular risk. Imported insulin and alcoholic drinks are display only (they never go to the AI). Your physician is the one who interprets and manages.

MyHealth's notifications and reminders (doses, appointments, refill/low-stock for an item in your routine, and — when you choose to display them — the medication name or the vaccine detail) are logistical notices and factual echoes of what you yourself recorded — never a clinical judgment. The app does not claim that running out of an item is a health risk, does not recommend starting, boosting, or changing a dose or vaccine, does not compute an individual due date from your condition, and does not signal urgency. A refill reminder is inventory arithmetic (how much stock you recorded × your dose schedule), not care guidance. Any decision to start, keep, refill, postpone, or stop a medication or a vaccine is clinical and yours, together with your physician. Since version 2.9, some notifications may also carry, in the body, a summary of your own data (for example, your sleep, your glucose average and time in range, your activity, or a marker's evolution), and the analysis-ready notice may name the analysis theme — always a descriptive, factual reading of what your own records show, never a diagnosis, a medical judgment or opinion, a cause, an efficacy claim, or urgency; the time in range and glucose aggregates remain a factual display of an industry standard (never an individual target — your physician sets that), and medication notices never frame a missed or late dose.

• Age/sex-based screening reminders are educational and population-level. They only reflect what international guidelines commonly suggest for broad age groups — never an assessment of your case, your results, or your individual risk. They may not apply to you (personal or family history, tests done outside the app, and other circumstances change what is appropriate). The decision to undergo any screening, and when, rests exclusively with you and your doctor.

3.1 Special populations (heightened caution)

Some situations call for extra care, because the AI educational reading is generic and does not account for clinical particularities that only a professional can assess. In these cases, the guidance to always confirm with your physician applies with even greater force:

• Pregnancy and breastfeeding: reference values, medications, and recommendations change during pregnancy and lactation. When you tell us your pregnancy state (the trimester only — see Section 5 and its dedicated Annex), it serves only as educational context for the AI to calibrate the reading of the reference ranges typical of pregnancy and lactation. This is not prenatal care, not obstetric triage, and not clinical guidance: MyHealth does not start, adjust, or stop medications or doses, does not make or suggest any reproductive decision, and does not follow your pregnancy. Prenatal care and every decision are your physician's or obstetrician's. Do not make any decision about medications, exams, or habits based on the app without speaking with your physician or obstetrician.
• Children and adolescents: when the data belongs to a child or adolescent, it exists only as a minor's profile managed by an adult guardian (see Section 9). The AI reading is not calibrated for pediatrics, and reference ranges vary widely with age and development — every interpretation must go through a pediatrician or qualified professional.
• Older adults: the interpretation of exams and the tolerance to medications and recommendations may differ in older adults; keep close professional follow-up.
• Chronic conditions and polypharmacy (use of multiple medications): in chronic conditions or with many continuously-used medications, there is a greater risk of interactions and of out-of-context readings. Do not adjust treatments on your own based on the app.

3.2 Daily log of sensitive habits (alcohol and stress)

The daily alcohol and stress logs are your own self-observations, treated in a descriptive and educational way. MyHealth does not conclude alcohol dependence, mood disorder, anxiety, or depression, does not measure clinical severity, and does not predict progression. If your alcohol consumption, your stress level, or your sleep worry you, seek a healthcare professional. (Crisis channel: CVV 188; findahelpline.com.)

4. In case of emergency

MyHealth does not handle emergencies and does not monitor you in real time. If you or another person shows warning signs — such as chest pain, shortness of breath, fainting, heavy bleeding, signs of a stroke, thoughts of self-harm, or any serious situation — seek medical care immediately or call your local emergency service (in Brazil, SAMU 192 or Fire Department 193; outside Brazil, use your country's local emergency number). Do not use the app for this.

If you are in emotional distress or having thoughts of self-harm or suicide, talk to someone now. In Brazil, the CVV — Centro de Valorização da Vida can be reached at 188 (free call, 24 hours a day, every day) and also by chat and email at cvv.org.br. In other countries, you can find a local support line in the international directory findahelpline.com. Emergency numbers and support lines vary by country — in a situation of immediate risk, always call your local emergency service.

5. About artificial intelligence (AI)

The educational reading, the extraction of information from exams, and the assistant chat use an AI model provided by Anthropic (Claude), which acts as a subprocessor under Anthropic's commercial terms, with a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) in force (Section 5.1). This processing involves an international transfer of your data to the United States (Anthropic's infrastructure) — see Section 5.1. You should understand that:

• The AI processes only the content you provide and only if you authorize this purpose (optional consent, which can be revoked at any time). (The general educational content described in Section 1 is the only exception that does not depend on this consent — precisely because it uses none of your data: it is prepared from general topics, is the same for everyone, and sends none of your information to the AI.)
• To help you understand and prepare for your appointment, the educational reading may explain the meaning and context of your findings — the mechanism, what clinical practice generally investigates, the relationship between several findings (an integrated reading), and the trajectory over time of the data you logged — and may consolidate, in an organized way, diagnoses ALREADY CONFIRMED in your own documents (for example, recording a history of an already-diagnosed serious condition for you to follow up with a specialist). This is organization and education, not a new diagnosis: it does not conclude that you have (or do not have) an undocumented disease, does not make a prognosis (it does not predict the future course of your case), does not compute an individual risk score, and does not start, adjust, or stop medications, tests, or treatments. Diagnosis, prognosis, and therapeutic decisions are acts that belong exclusively to a qualified health professional who knows your case.
• In the health-record analysis, we send the clinical content identifiable only by sex and age (and, when available, by your country — only to regionalize, in an educational way, emergency/vaccination-calendar guidance; never the city or precise location) — without your direct identifiers (name, taxpayer ID, email, and phone, which are kept encrypted in a separate vault and are not sent to the AI). This content may include, in summary, the entire health record and clinical profile you organize in the app: exam markers and trends, measurements and body composition, medications, vaccines, allergies, symptoms, appointments and your notes, documents and reports (title, type, date, and the summary of the findings), family history, your care team (the professionals' name and specialty and, if provided, institution and reason — never their contact details or registration number), physical activity, sleep data and wearable scores (in aggregated summaries, never raw continuous series; for continuous glucose monitoring, only the daily aggregates), events from your device (ECG classification, irregular rhythm, fall), menstrual cycle and reproductive data (including the menopause phase, when you report it), lifestyle habits you report (smoking and years of use, alcohol, activity, and sleep), and the blood type and notes from your emergency card. The menopause phase is self-declared by you, not imported from Apple Health (HealthKit). We do not send the contacts from your emergency card (name, phone, relationship).
• When you tell us your pregnancy state (the trimester only — none/1st/2nd/3rd trimester or postpartum), it is sent to the AI only at the moment YOU trigger a health-record analysis or a chat message, in the request body, to calibrate the reading of the reference ranges specific to pregnancy and lactation — and it is not stored by us: it stays only on your device, encrypted in the iOS Keychain (outside iCloud and backups), per profile, never on our servers and never synced, and it expires on its own in about 40 weeks; you can delete it in one tap. For this feature we collect only the trimester — never the last menstrual period (LMP) or the estimated due date (EDD). Automatic/proactive analyses and the large-record (batch) path do not receive this state. The AI is instructed to never record "pregnant," "expecting," or "breastfeeding" as a condition, alert, diagnosis, or summary, and a deterministic server-side check removes those terms from the output (with a regression test). The feature is exclusive to the adult owner (own profile, 18+); it is unavailable to minors and to managed profiles, blocked in the app and on the server. The transfer to Anthropic (United States) is supported by your specific pregnancy-state consent (purpose pregnancy_status, version pregnancy-state-1.0), separate from the clinical acceptance, which covers the international transfer under SCCs/DPA in force; Anthropic retains it for a limited period (as a rule, within 30 days). We have stopped reading and storing the "pregnancy test" from Apple Health (HealthKit).
• In the chat with the assistant, the context sent may additionally include the conversation history itself and the location and the professional recorded in your appointments — items that do not enter the longitudinal health-record analysis described above.
• In the extraction of a document, before sending, the app performs an automatic redaction on your device: it attempts to cover (redact) your name, taxpayer ID, email, and phone number printed on the report — and you can cover areas manually. The original file remains intact in your health record; the version sent to the AI is the redacted one, when generated. This redaction is best-effort: it may fail on low-quality photos or handwriting, and identifiers written differently from your registration may remain in the document. Free-text notes may contain names — for this reason we recommend not entering identifying data in text fields.
• As for ECG events, we always store the classification (sinus rhythm / atrial fibrillation / inconclusive) and the event metadata. The trace (waveform) is stored only if you turn on the specific option "Store my ECG trace" (Profile › Privacy, off by default). Even when on: the trace is never sent to the AI, never interpreted by us (no rule, threshold or label of ours — we do not measure intervals and do not classify beats) and never modified. It is stored and displayed exactly as your device recorded it, so that you can take it to your doctor — whose role it is to interpret it, because reading an electrocardiogram is a medical act. The authoritative record remains the one on your device/Health app, whose PDF you can share directly.
• Your data is not used to train AI models. Anthropic retains the data for a limited period and then deletes it (as a rule, within 30 days), except for retention required by law or for abuse prevention.
• The AI may make mistakes: it may generate information that is incorrect, outdated, or that appears confident but is not. Treat the result as a starting point for a conversation with your physician, not as definitive truth.
• Web search exists only in the assistant chat, for general clinical knowledge. We instruct the model to use only generic clinical terms, without your values, dates, age, names, or identifiers. This protection is enforced by instruction to the model, not by an infallible technical filter, and the search is performed by Anthropic's infrastructure. The health-record analysis and document-extraction functions do not perform web searches.
• If you have a connected wearable and the AI authorized, the analysis may consider aggregated summaries of your wearable data (sleep, resting heart rate, HRV, steps, energy, and brand-identified scores) — never the device's raw continuous series.

5.1 International data transfer for AI processing

AI processing is performed by Anthropic, with infrastructure in the United States. When you authorize the AI, the content sent is subject to an international transfer of sensitive personal data outside Brazil and the European Economic Area (EEA).

• This transfer occurs only with your specific consent (purpose intl_transfer, tied to AI Processing), revocable at any time. Without your consent, none of your data is transferred to Anthropic and the AI functions remain unavailable.
• The transfer is supported by Standard Contractual Clauses (SCCs) and a Data Processing Agreement (DPA) in force with Anthropic, in addition to the commitment, under Anthropic's commercial terms, that your content is not used to train models and is retained for a limited period (as a rule, within 30 days).
• The storage of your health record remains on infrastructure in Brazil (Supabase, region sa-east-1, in São Paulo); the transfer to the United States occurs only at the moment of processing by the AI.

Legal basis for the transfer: LGPD Art. 33, IX (specific and prominent consent) and Art. 9, II; GDPR Arts. 44-46 and Art. 49(1)(a) (explicit consent), with the transparency of Art. 13(1)(f).

5.2 Organizing medications, supplements, vaccines, and allergies (AI-assisted, educational)

To better organize your record, the AI may break down the medications and supplements you log into their active ingredients (a compounded formula, for example, is split into the ingredients listed on its label) and assign a general category (medication, vitamin/mineral, botanical, protein/amino acid, probiotic, compounded formula, etc.). Likewise, it may identify your vaccines (recognizing the same vaccine under different names, the disease it prevents, and the dose in the series) and normalize your allergens (for instance, recognizing the active substance or class of a substance). This helps relate, for instance, the magnesium in a formula to the magnesium in your blood test, or understand your vaccination history. You should understand that:

• This organization is AI-assisted and educational — a support for talking with your doctor or pharmacist, not a diagnosis, a prescription, or a definitive clinical classification. The AI may misread a name; review and correct it when needed.
• MyHealth extracts only what is written on the label/prescription and does not invent ingredients from a product's brand name.
• MyHealth does NOT perform drug-interaction checking, does not cross-check allergies against medications, and does not assess the risk of combining medications. If the analysis notes that an active ingredient appears in more than one item, that is merely an observation for you to check interactions and total dose with your doctor or pharmacist — never a statement that an interaction, contraindication, or problem exists (or does not).
• Regarding vaccines: the AI may comment, educationally, on the vaccination schedule (for example, that certain vaccines are usually boosted periodically), based on general public-health recommendations — never as an individual order ("get it now"). Always confirm your schedule with your doctor or immunization service.

5.3 AI assistance in the support channel

In the app's support channel (Profile › Support), a human agent may use AI assistance to draft the reply, which is reviewed by a person before it is sent. This assistance does not access your health record, does not make a diagnosis or give medical guidance, and does not replace your physician. The text used to compose the reply is your own support conversation: it may contain whatever you write — so avoid including unnecessary data (identifiers or clinical details that are not needed to resolve your request). The body of your support conversation is only sent to Anthropic (United States) if you have active consents for AI Processing and for the international transfer (Sections 5 and 5.1); without those consents, the AI assistance is not applied to your support. The support channel is not an emergency channel or a channel for clinical decisions — in a risk situation, follow the guidance in Section 4 (in Brazil, CVV 188; in other countries, findahelpline.com; and always your local emergency service).

6. You are responsible for the data you enter

The quality of the organization and of the educational reading depends on what you record. Incorrect, incomplete, or outdated information may lead to equally inaccurate readings. Keep your data correct and up to date, and always bring the original documents (exams, reports, prescriptions) to the healthcare professional.

When you submit exams for analysis, before saving you confirm, in a mandatory step, that you have reviewed the items the AI extracted. This check is your responsibility: the AI may misread names, values, or dates, and the data is only written to your record after your confirmation. Review and correct any information before confirming.

7. Family sharing

Sharing with family members is optional, read-only, and revocable, activated by a mutual code with expiration. The same caveats in this disclaimer apply to anyone who views the shared data: viewing does not replace a medical evaluation.

8. No clinical warranties

BAS AI makes its best efforts to keep the app useful and safe, but, to the maximum extent permitted by the law of the user's country, preserving the rights that local law does not allow to be limited, MyHealth is provided "as is," without any warranty that the analyses are accurate, complete, or suitable for a specific clinical purpose. No information in the app should be interpreted as medical advice.

When the app shows different data side by side — for example, a lab result and your activity in the same period — it merely gathers and displays your own data along the same timeline, descriptively. Seeing two things together does not assert that one explains, causes, or influences the other: association is not causation. Interpretation is up to you and your doctor.

9. Minimum age and minors

Self-registration is for persons 18 years or older (or the age of majority of the country, if higher). The protection of children and adolescents observes the Statute of the Child and Adolescent (Law 8.069/1990), Law 15.211/2025 (Digital ECA), Art. 14 of the LGPD, and Art. 8 of the GDPR (EEA).

• The minor does not have their own account or email: they exist only as a managed profile within the account of an adult guardian, who manages the profile and is responsible for the person's care.
• The profile may have more than one guardian: the primary guardian invites another adult via an invitation code with an expiration date. Each invitee receives a role — guardian (views and edits) or companion (read-only). Every authorization is verified on the server, on each operation.
• The consent relating to the minor is recorded identifying which adult granted it.
• Paid AI features require the guardian role and are charged to the guardian (see Section 10); the usage record remains linked to the minor's profile for auditing.
• Wearable data never follows a minor's profile.

In any country, we adopt the single threshold of 18 years for one's own account. This requirement refers to account ownership and must not be confused with the GDPR's age of autonomous digital consent (Art. 8, between 13 and 16 years depending on the country). Below 18, data processing only occurs through a profile managed by an adult guardian.

Users in the United States (COPPA): MyHealth does not offer accounts to minors nor collect data directly from children. Any minor's data is entered and controlled by a responsible adult, who exercises verifiable parental consent.

10. Subscriptions, service quotas, add-on packs, and payments

The AI functions in MyHealth are paid and consume pages from your quota (as a rule, 1 page of quota per page of an analyzed document). There is a subscription (a periodic quota of pages and prompts) and the purchase of add-on packs of pages/prompts; new users receive an initial courtesy allowance (pages and prompts), granted only once.

• All purchases are processed by Apple (App Store In-App Purchase), which acts as the merchant of record. BAS AI does not receive or store your card data.
• When an AI function is run on a dependent's (minor's) profile, the pages/prompts are debited from the account of the responsible adult who performs the action; the minor has no quota, pack, or payment method of their own.
• When charging is active and your available quota/usage is not sufficient, a document you have already uploaded may be stored, already redacted, awaiting available quota/usage — and it is analyzed automatically as soon as quota or a pack is available, without you having to re-upload it.
• In Brazil, your right of withdrawal is preserved (Art. 49 of the CDC (Brazilian Consumer Protection Code)), within a period of 7 days. Cancellation and refund follow the App Store rules and the applicable consumer legislation; if in doubt, contact us at dpo@bas-ai.com. If Apple denies the withdrawal request, contact us by email at support@bas-ai.com — we review each case individually, under the CDC (Art. 49) and the applicable consumer-protection rules.
• During the current testing phase (beta), the AI functions are not being charged: usage of pages/prompts is only metered, with no actual debit from your quota. When charging is activated, this will be announced in advance and the debit will apply only from that moment on.

The complete details on pricing, renewal, cancellation, and refund are in the Terms of Use.

11. Your rights and how to contact us

You may, at any time and directly in the app (under Privacy), exercise your rights as a data subject: access, correct, export (FHIR and PDF), revoke consents, and delete your account (permanent, cascading removal of all clinical data and of the identity vault).

Account deletion also removes the files you uploaded and the data of the dependents (minors) you manage. When a minor has another registered guardian, instead of deleting the child's data we offer to migrate guardianship of the profile to that co-guardian, and the minor's profile continues to exist with them. Only records that the law requires us to retain — for example, tax receipts, when a purchase was made — are kept for the applicable legal period.

For questions, requests, or to exercise rights not available in the interface, contact our Data Protection Officer (DPO) at dpo@bas-ai.com. You can also talk to support directly in the app (Profile › Support).

Legal basis: LGPD Arts. 18 and 41; GDPR Arts. 12 to 22.

12. Updates to this disclaimer

We may update this Medical Disclaimer. When that happens, we will update the version and the date above and, when the change requires it, we will ask for a new acceptance within the app.

13. Version history

The full version history is published at https://www.bas-ai.com/myhealth/legal/versoes; each accepted version remains archived.

UI Consent Texts (registration and screens)

These texts are short by design, for direct use in the interface. The purposes already existing in the app (clinical_processing and ai_processing) are kept with the same technical labels; the others are additions for full coverage of granular consent. Each consent is recorded in a versioned way in the immutable ledger (consent_events), with purpose, legal basis, and policy version.

Privacy / consent screen (registration)

Title: Your privacy Subtitle: You control how your health data is used. You can review and revoke whenever you want.

Granular purposes

Note: family sharing (family_sharing), the international transfer (intl_transfer), and the wearable syncs (wearable_sync_apple_health / wearable_sync_oura / wearable_sync_whoop) are also purposes recorded in the ledger, captured at the moment the user enables the feature (not at initial registration) — wearable consents are recorded on the Integrations screen, before any reading or sync, on the dual basis LGPD_Art11+GDPR_Art9. The purpose apple_health_import, provided in a previous version of this document, has been replaced by wearable_sync_apple_health (the name actually recorded by the app).

Acceptance of Terms and Policy (required)

Acceptance checkbox text: "I have read and accept the Terms of Use and the Privacy Policy." (With tappable links to "Terms of Use" and "Privacy Policy.")

Supporting microcopy (below the checkbox): "To create your account, you must accept the Terms of Use and the Privacy Policy. You also authorize the processing of your health data to organize your health record (LGPD Art. 11 / GDPR Art. 9)."

Button state: the "Finish" / "Create account" button remains disabled until the acceptance checkbox is checked.

RE-ACCEPTANCE banner (when the terms change)

Title: We have updated our terms Body: "Our Terms of Use and Privacy Policy have changed (version 2.1). To keep using MyHealth, please read and accept the new version." Primary button: "Read and accept" Secondary button: "See what changed" Legal note: "Your previous acceptance remains on record. This new acceptance will be kept in a versioned way and does not change the optional choices you have already made."

Revocation and control notices (reused on the Privacy/Profile screens)

• Revoke AI: "You have turned off the AI educational reading. Your data is no longer sent to the AI from now on. The analyses already performed remain in your health record."
• Revoke Apple Health: "Syncing with Apple Health has been turned off. We will not read new data from Apple Health until you authorize it again. You can keep or delete what has already been imported."
• Disconnect Oura: "Your Oura ring has been disconnected and access to your Oura account has been revoked. What do you want to do with the data already imported from Oura?" — buttons: "Keep in health record" / "Delete Oura data".
• Disconnect WHOOP: "When you disconnect WHOOP, all data imported from WHOOP will be deleted from MyHealth — this deletion is required by WHOOP and cannot be undone. Your data remains in your WHOOP account." — button: "Disconnect and delete".
• Control reminder: "You can review, export (FHIR and PDF), correct, revoke consents, and delete your account at any time under Privacy."

Annex — Research-consent screen (pseudonymized data)

Text for the screen presented separately from the required purposes, in the Privacy section. The technical purpose is research. It is optional, off by default, and revocable at any time, with no impact whatsoever on the normal use of the app. The consent is recorded in a versioned way in the immutable ledger (consent_events), with purpose, legal basis, and policy version.

Title: Contribute to health research

Subtitle: Optional. You help public-health studies without exposing who you are.

Body: "If you turn on this option, you authorize BAS AI to use a pseudonymized version of your data for the purposes of health research of collective interest. Pseudonymized means that we separate your direct identifiers (name, taxpayer ID, email, phone) — they do not enter the research dataset. What enters is reduced to sex, age range, and year, together with health indicators that are not directly identifying.

This is not the same as irreversible anonymization: because, in our original database, the link between you and your data still exists, the processing remains under the protection of the LGPD and the GDPR, and you can revoke it at any time.

Your research data is never sold, never used for advertising targeted at you, and never used to train AI models."

What we do NOT use for research: your direct identifiers (name, taxpayer ID, email, phone), the contacts from your emergency card, and any raw document (image/PDF) you have uploaded.

Toggle text (off by default): "Allow the use of my pseudonymized data for health research"

Supporting microcopy: "This choice is independent of the others. Turning it on or off does not change anything in how the app works, in the AI reading, or in your usage (pages and prompts)."

Revocation notice (reused on the Privacy screen): "You have turned off the research contribution. Your data no longer feeds new research datasets from now on. Research datasets already generated may not allow your retroactive removal, precisely because they are already pseudonymized and unlinked from you."

Legal basis: LGPD Art. 11, II "a" (consent — sensitive data) and GDPR Art. 9(2)(a) (explicit consent).

Annex — Sensitive health journal consent screen (alcohol and stress)

Text for the screen presented separately from the required purposes, in the Privacy section (Profile › Privacy & consents). The technical purpose is daily_journal. It is optional, off by default, and revocable at any time, and it is unavailable on minors' profiles. Declining it does not reduce any other function of the app. The consent is recorded in a versioned way in the immutable ledger (consent_events), with purpose, legal basis, and policy version.

Title: Sensitive health journal (optional)

Body: "You can log alcohol and stress day to day to see your own patterns. These are sensitive health data (substance use and mental health), so we ask for your authorization separately from the rest. They stay on your device and in your health record and are not sent to the AI. It is off by default: nothing is recorded until you turn it on, and you can revoke and delete whenever you want. Unavailable on minors' profiles."

Toggle text (off by default): "Allow the daily logging of alcohol and stress"

Legal basis: LGPD Art. 7, I and Art. 11, I (specific consent — sensitive data) and GDPR Art. 9(2)(a) (explicit consent).

Annex — Pregnancy-state consent screen (trimester)

Text for the screen presented separately from the clinical acceptance ("Accept and continue") and from the other purposes, in the Privacy section (Profile › Privacy & consents). The technical purpose is pregnancy_status (version pregnancy-state-1.0). It is optional, off by default, and revocable at any time, and it is exclusive to the adult owner (own profile, sex at birth female, 18+) — unavailable to minors and to managed profiles, blocked in the app and on the server. Declining it does not reduce any other function of the app. The consent is recorded in a versioned way in the immutable ledger (consent_events), with purpose, legal basis, and policy version.

Title: Pregnancy state (optional)

Body: "If you are pregnant or breastfeeding, you can report only the trimester (1st, 2nd, or 3rd trimester, or postpartum) so the AI educational reading can calibrate the reference ranges of your exams for pregnancy and lactation. We collect only the trimester — never the last menstrual period or the estimated due date.

This state stays only on your device, encrypted in the iOS Keychain (outside iCloud and backups), never on our servers and never synced. It expires on its own in about 40 weeks, and you can delete it in one tap.

It is sent to the AI (Anthropic, in the United States) only at the moment you run an analysis or use the chat, to calibrate that reading, and it is not stored by us (Anthropic retains it for a limited period — as a rule, within 30 days — under SCCs/DPA in force). By turning it on, you also authorize this international transfer.

The AI never records "pregnant," "expecting," or "breastfeeding" as a diagnosis, condition, alert, or in your health record — it is only context for reading the ranges. This is not medical advice, prenatal care, or obstetric triage: your obstetrician is the one who decides."

Toggle text (off by default): "Share my trimester to calibrate the AI reading"

Decline option: "Prefer not to say" — nothing is stored; if you had already reported it, the state is deleted from the device.

Revocation notice (reused on the Privacy screen): "You have turned off the pregnancy state. The trimester has been deleted from your device and is no longer sent to the AI from now on."

Legal basis: LGPD Art. 11, I (specific consent — sensitive data) and Art. 33, IX (international transfer); GDPR Art. 9(2)(a) and Art. 49(1)(a) (explicit consent).