Privacy Policy — MyHealth

Version (policy_version): 3.17 Last updated: August 1, 2026 Effective: August 1, 2026. Changes (3.17, 2026-08-08): This version brings one optional addition and no other change to how we handle your data. Up to 3.16 we did not store the trace (waveform) of your watch's electrocardiogram — only the classification and metadata. A new option appears, "Store my ECG trace" (Profile › Privacy), which starts off: while it is off, nothing changes. If you turn it on, we import and store the trace so you can take it to your doctor — and, even when on, the trace is never interpreted by us, never sent to the artificial intelligence, never altered, does not enter family sharing or notifications, and turning it off deletes the traces already imported. We ask for a separate authorisation because the Apple Health permission does not distinguish "see the classification" from "store the trace". No new subprocessor, no new international transfer. The Terms also changed in this version (liability cap, §14.3).

Changes (3.16, 2026-08-01): This version describes what already happened and changes nothing about how we handle your data: no new data, no new purpose, no new subprocessor, no change of legal basis. The Policy gains §12.3, on deleting a specific exam from your health record — the two options the app offers and the difference between them, what goes immediately, what remains on purpose (the appointment you have already attended and the symptom you have already confirmed), how the AI analysis stops resting on the removed exam, and what we keep of the act: a receipt with counts only, never the title or the content. The former §12.3 and following were renumbered.

Changes (3.15, 2026-07-25): This version amends the Terms of Use (§12.1) and changes nothing about how we handle your data. We removed from the contract the monetary amounts quoted "for reference" for the subscription and the add-on packs. Why: MyHealth's price varies by country — the App Store sets its own amount for each market where the app is sold — so a contract quoting a fixed amount, even as a reference, is wrong for most readers and goes stale when the price changes; one of the quoted amounts was in fact below what the App Store charged. The Terms now state what has always applied in practice and still applies: the prices and quotas in force are always those displayed at the time of purchase. The quotas are unchanged (40 pages and 12 interactions per month; 480 and 144 per year; packs of 50/150 pages and 20/50 interactions) — what you are entitled to use is exactly the same. No new data, no new subprocessor, no new transfer. Changes (3.14, 2026-07-25): A stress transparency round — three points: one new, one in your favor, and one honest correction of our earlier text. (A) Your ring's stress index is now shown TO YOU (§3.2 and Sections 4, 6.8 and 8): in the "Today's readiness" card, on the Routine tab, next to your readiness, we show the label Oura itself publishes for the day (restful / normal / stressful), exactly as the brand publishes it and always with the date it refers to — no translation into a scale of ours, no severity color, no severity ordering of ours, and no calculation of ours: MyHealth never computes a "stress index" from your signals. This is not new data: collection already happens under the consent you granted when you connected Oura (revocable), and "stress" has been listed among the daily scores we declare we collect since version 3.9 — what was missing was declaring that we give that data back to you, on screen. Everything that already applied still applies: this index is NEVER sent to the AI (the exclusion is applied in the database query itself, in both the analysis and the chat, and reaches the stress sub-score embedded in Oura's resilience "contributors" — it is not merely an instruction to the model), never enters the PDF Health Report, never becomes a notification and never appears on a dependent's or a minor's profile. Legal basis unchanged, no new purpose: performing the service you signed up for (seeing your own organized data) over sensitive data already consented to (LGPD Art. 7, V and Art. 11, II, "a"; GDPR Art. 6(1)(b) and Art. 9(2)(a)); the change is one of transparency (LGPD Art. 6, VI and Art. 9; GDPR Art. 5(1)(a) and Art. 12–13). No new data, no new subprocessor, no new international transfer. (B) A new control: "What appears in the app" (§3.2 and Sections 4 and 5): in Profile › Privacy & consents you can now turn off the display of sensitive categories, one by one — Ring stress, Menstrual cycle and Mental health — effective on tap and across all your devices. Read carefully what this switch does and what it does NOT do: it hides that content from the app's screens, for you — and that is all. It does not disconnect your ring or Apple Health, does not withdraw consent, does not delete data, does not stop collection and does not change what the AI receives; collection and use are still governed by your consent. We only offer the switch for a category you actually have on that profile; it does not exist on a dependent's profile or in read-only access; and when you hide Menstrual cycle, it also stops being offered in the PDF Report (the PDF goes to third parties — offering to send data you chose not to see would be the opposite of what you asked for). It is extra control for you, with no new legal basis: minimization and privacy by default (LGPD Art. 6, III; GDPR Art. 5(1)(c) and Art. 25(2)). (C) Correction: the daily check-in's "Stress" axis IS sent to the AI analysis — and our text said it was not (§3.2 and Sections 6.1, 6.8 and 9). The "How are you today?" check-in has evolved: where there used to be a single mood answer, there are now four axes that you yourself answer on three levels — energy, mood, stress and (only when the app does not receive sleep from your wearable) sleep. The stress axis is your own self-report and is part of the context sent to the AI, only as a weekly average, under the Clinical processing, AI processing and International transfer consents you already granted, with a hard instruction to the model: a descriptive reading of what you reported, never a diagnosis of anxiety, depression or a "stress disorder", never treated as a clinical instrument, never treatment advice. Our earlier text, written before the check-in gained axes, said that "point-in-time stress… stays out of the AI" and described the check-in as being mood only — a reasonable reader would conclude that no self-reported stress reaches the AI, and one does. We corrected the affected paragraphs to say plainly what goes and what does not: the check-in axis goes (weekly average, three levels); the sensitive Health Diary entries (alcohol and stress/evening context, under their own consent) do not, the ring's stress index does not, and the GAD-7/PHQ-9 questionnaires do not. Legal basis — the same one already operating, now described correctly: specific and prominent consent for sensitive data (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)) + international transfer (LGPD Art. 33; GDPR Art. 44–49); for Washington (USA) residents, the per-purpose consent under MHMDA, reaffirmed over the corrected text. That is why this version asks you to accept again: because the earlier description was incomplete on a special-category point, we ask you to confirm you have read the corrected Policy, so that your consent record points to the right text. This update triggers re-consent (the acceptance screen reappears). Also in this version (Section 13): we now record the install source when you download the app after seeing one of our App Store ads (Apple Search Ads / AdServices) — campaign data, no IDFA, no iOS tracking permission (ATT) and no third party: it is Apple reporting on our own campaign to our own server. It exists so we can tell which ads bring people who actually use the app. Legal basis: legitimate interest (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).

Changes (3.13, 2026-07-25): The come-back invitation may now also be delivered by remote push (Section 12-A). The neutral invitation to return to the app after a stretch without use already existed and keeps the same purpose, the same trigger and the same legal basis: what triggers it is still only the time since you last opened the app — an app-usage signal, never a reading or inference about your health. What changes is only the delivery method: it used to be assembled exclusively on your device (a local notification); now it may also be sent from our server (remote push, APNs). Why: a local notification is only scheduled when the app is opened — so someone who went a long time without opening it, or switched devices, simply never received the invitation. The body stays identical and neutral: no health data, no number, no comparison, no judgment, no urgency and no blame (e.g., "Your data misses you — the portrait is still here, just as you left it."). The cap of one interruptive notice per day, your quiet-hours window, the cancellation as soon as you open the app, and the individual toggle in Profile › Notifications all still apply. Dependent and managed profiles remain excluded. Remote delivery uses the same technical delivery token already described in Section 3.4 — no new data is collected and no new subprocessor is involved. Legal basis unchanged: performing the service/legitimate interest, with easy opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)). This update triggers re-consent (the acceptance screen reappears).

Changes (3.12, 2026-07-19): Personalized notifications with your own data (Section 12-A). By founder directive (sole Controller/DPO, 2026-07-19), MyHealth notifications may now include, in the body, a summary of your own health data — for example, the duration and efficiency of last night's sleep (and deep sleep) and how it compares to your own average; your daily glucose average and time in range (descriptive, never an alarm or clinical threshold); your activity versus your average and milestones reached; the name of a lab marker and how it changed over time; a weekly or monthly summary with real numbers; and the analysis-ready notice (a push about your own record) may name the analysis theme/panel, in your language. Previously the body was kept generic (no health values). This is a change in how data you already share is DISPLAYED to you, on your own device — not a new data category collected, and not new sharing with third parties. Four controls: (a) iOS hides previews on the lock screen until you unlock the device (default "Show Previews: When Unlocked"; you can also choose "Never"), so a glance at a locked phone does not reveal the content; (b) each category has its own toggle in Profile › Notifications — the non-sensitive personalized summaries are on by default and each can be turned off (granular opt-out); (c) they are for you, the adult account holder, on your device only — minor and managed profiles never carry health data in the notice body; (d) the notices stay descriptive and factual — never a diagnosis, a medical judgment or opinion, a cause, an efficacy claim, or urgency. Sensitive domains (mental health, cycle/reproductive, substance, medication adherence) stay off by default and would only ever appear in a notification if you had both opted into that data category (the dedicated consent that enables it — e.g., the Health Diary, Mental health, cycle) and turned on that category's notification toggle; today, mental-health and cycle/reproductive content remain entirely out of any notification, and medication notices never frame a missed or late dose (adherence memory, never surveillance). Legal basis: for the personalized service notices derived from your own data and delivered to your own device, performance of the service you configured, with granular opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)); for the sensitive (special-category) ones, explicit consent (LGPD Art. 11, I; GDPR Art. 9(2)(a); Washington MHMDA). This update triggers re-acceptance (the acceptance screen reappears). Changes (3.11, 2026-07-19): Two Apple Health-related additions, published together — a minor bump, with re-acceptance. (A) Observed medication adherence (§3.2, Sections 4, 6, and 9; requires iOS 26 or later): if you log that you took a medication dose in Apple Health, MyHealth can import only the doses marked as taken into your record, matched to a medication you have already registered in the app (we never create a new medication from Apple Health). Only a factual aggregate goes to the AI — how many days, within a 30-day window, had a dose logged — never a percentage, never a judgment, never a causal claim. There is no surveillance: the app never sends a "missed dose" or "forgotten dose" notification — the absence of a log is never treated as a failure. This import uses the clinical-processing and AI consents you have already granted (it is a new source for a routine medication data point you already share, not a new category); unavailable to minors and managed profiles. (B) Clinical Records (United States only) — honest conditional note (§3.2, Section 8, and Sections 4, 6, and 9): we have built, and will make available once Apple grants the required authorization (an external process, outside our control, that can take weeks), the read-only import of your own structured clinical records from Apple Health (via FHIR) — lab results (matched via the international LOINC standard), immunizations, medications, conditions/diagnoses already recorded by clinicians, procedures, and allergies — directly into your record, with the same protections as any other data of yours. Free-text clinical notes and insurance/coverage records are never imported. Available only for US accounts; until Apple grants the authorization, the feature stays invisible. No new subprocessor and no new international transfer in either addition. This update triggers re-acceptance (the acceptance screen reappears). Changes (3.10, 2026-07-19): Two new optional, special-category areas (mental health and a reproductive complement), each under its own separate consent — a dedicated bump, with re-acceptance. (A) Mental health from Apple Health (§3.2, Sections 4, 6, and 9): if you log your mood (State of Mind) or answer well-being questionnaires (GAD-7 for anxiety, PHQ-9 for depression) in Apple Health, you may bring them into your record only by turning on a dedicated, separate consent ("Mental health from Apple Health," mind_import, off by default, outside "Accept and continue"). We keep only the daily mood average (a −1 to +1 score; we discard the item-by-item emotions and associations) and, for the questionnaires, only the total score and Apple Health's own classification (we discard the question-by-question answers). This data lives in your record, with a home in the Journal and the "Mental health" system — never on the home screen. Only the weekly mood trend (average and number of days) goes to the AI, descriptively, and only if you have also enabled the Health Diary (daily_journal_ai) — a double consent. The GAD-7/PHQ-9 questionnaires and the ring's stress index are NEVER sent to the AI. No mental-health content appears in notifications. Unavailable to minors and managed profiles. When you revoke, we delete everything (mood and questionnaires). Basis: LGPD Art. 7, I + Art. 11, I; GDPR Art. 6(1)(a) + 9(2)(a); Washington MHMDA (per-category consent); requires iOS 18+. (B) Cycle/reproductive complement (§3.2 and Sections 6.10 and 9): the contraceptive (in use) and lactation states can now contextualize the educational reading of your labs (they shift reference ranges, as pregnancy and menopause already did). They follow exactly the same design as pregnancy: they stay only on your device (Keychain, outside iCloud and backups), are never written to any table of ours nor synced, and go to the AI only transiently, at the moment you run the analysis, to calibrate the reading — they are not stored by us and the AI does not record them as a condition. In addition, cycle deviations from Apple Health (infrequent/irregular cycles, persistent intermenstrual bleeding, prolonged periods) appear as descriptive findings within cycle tracking (under the cycle opt-in you already control), always suggesting a conversation with your gynecologist, without alarm. As already applies to the cycle, the AI chat does not receive cycle data, and none of this becomes a notification. The app still does not import the Apple Health "pregnancy test" and does not import sexual activity. Basis: LGPD Art. 7, I + Art. 11, I + Art. 33; GDPR Art. 6(1)(a) + 9(2)(a) + 44–49; Washington MHMDA. No new subprocessor and no new international transfer. This update triggers re-acceptance (the acceptance screen reappears). Changes (3.9, 2026-07-19): A transparency update (a minor bump, with re-acceptance — anyone who already accepted 3.8 simply confirms they have read this update): we enumerate the new Apple Health and wearable data categories we now import, all under the consents you already granted (clinical + AI + international transfer) — no new subprocessor, no new international transfer. (1) New device/Apple Health data (§3.2): a possible sleep-apnea event and high sound-exposure alerts; home spirometry (FVC/FEV₁/peak flow) and inhaler use; the Oura ring's hypnogram and ideal sleep window; symptoms imported from Apple Health; nutrition data (water, caffeine, energy, macro- and micronutrients); gait (asymmetry, support, step length, stair speed); audiogram (it becomes an audiometry exam in your health record, with no file upload); eyeglass/lens prescription (display only); insulin and alcoholic beverages (display only, never sent to the AI); the ring's vascular age, pulse-wave velocity, and temperature deviation; and standing time, stairs climbed, effort, wheelchair pushes, and the activity's intensity/quality. (2) Oura ring annotations (§3.2 and Section 8) — a correction and clarification: the free text (custom name and comment) is discarded at import and never gets stored; we keep only the standardized category code (e.g., "coffee", "alcohol"), which — aggregated by week and never as free text — may be part of the context sent to the AI when you keep the Health Diary (daily_journal) on. (3) Retention (Section 12.1): we detail that the condensation of daily wearable series (weekly summaries after 13 months; monthly after 36 months) covers the continuous activity, sleep, and environment metrics and the daily continuous-glucose-monitor aggregates — but never manually recorded measurements, point clinical measurements (weight, capillary glucose, blood pressure), nor insulin, alcohol, spirometry, and inhaler use. (4) The nightly sleep reminder may cite the ideal window suggested by Oura, always attributed to Oura (the brand's recommendation, never our advice). (5) We now store a pseudonymous identifier of your WHOOP profile (just a number, never a name or email) to receive real-time update/deletion notices (Section 9). Legal bases indicated in each section. This update triggers re-acceptance (the acceptance screen reappears): anyone who already accepted 3.8 simply confirms they have read it — there is no new mandatory affirmative consent (no new special category, no new subprocessor, no new international transfer). Changes (3.8, 2026-07-18): Consolidated round with six changes. (1) Educational, age-based screening reminders (Section 4): we now use your date of birth and sex at birth — data you already provided at sign-up — to show, as an in-app card (never as a notification), educational reminders about health screenings that population guidelines commonly suggest for your age group; they are generated on your device, by fixed age/sex rules — without using your test results, conditions, or any individual risk assessment —, dismissible one by one and can be turned off. (2) Care team in the analysis (Section 6.11): the context we send to the AI when analyzing your record now includes the name and specialty (and, when you provide them, the institution and the reason) of your Care Team professionals — never phone, email, address, or registration number —, as already happened in chat. (3) Continuous glucose monitor (CGM) glucose (§3.2 and Sections 6 and 8): continuous-monitor days imported from Apple Health are stored only as daily aggregates — mean, minimum, maximum, variability (CV), and the percentage of the day within the 70–180 mg/dL range of the industry display standard (AGP) — and the raw continuous readings are never stored by us; spot/capillary measurements continue as normal measurements; only the aggregates enter the AI context. (4) Oura ring annotations (§3.2 and Section 8): we import the annotations you record in the Oura app (type, custom name, and a free-text comment) under the maximum protection of sensitive data — visible only to you, never sent to the AI, and always deleted when you disconnect Oura; they require an additional Oura permission ("tag" scope): older connections need to be reconnected. (5) AI-generated educational library (Section 6.12): the generic educational content shown in the app may be generated by AI (Anthropic) in a population-level way — one text per topic and language, the same for everyone; the generation receives no data of yours, and the choice of what to show happens on your device. (6) Condensation of wearable series (Section 12.1): raw daily wearable metric series may be condensed after 13 months into weekly summaries (minimum/mean/maximum/count) and, after 36 months, into monthly summaries — a minimization policy; manually entered measurements and clinical measurements (weight, glucose, blood pressure) are never condensed. Legal bases indicated in each section. Triggers re-consent for everyone. Changes (3.7, 2026-07-18): New optional feature for adult female account holders — Pregnancy state (§3.2, the Section 4 table, and Sections 6.10 and 9). You declare only your trimester (not pregnant / 1st / 2nd / 3rd / postpartum, with "prefer not to say"); never the date of your last menstrual period (LMP) nor the estimated due date (EDD). The state stays only on your device (Keychain, outside iCloud Keychain and backups), is never written to any table of ours and never synced, expires in about 40 weeks, and is erasable in one tap. It goes to the AI (Anthropic, USA) only transiently, in the request body, when YOU run an analysis or the chat, to calibrate the reading of your labs by the reference ranges specific to pregnancy and lactation — it is not stored by us, and the AI never records it as a condition, alert, or diagnosis. Unavailable to minors and managed profiles. Specific, prominent consent (pregnancy-state-1.0), separate from the clinical consent, covering the international transfer under the DPA/SCC in effect; revocable in Profile › Privacy. Also in this version: the app stopped importing and storing "pregnancy tests" from Apple Health (§3.2 and Section 8) — the mention was removed. Legal basis: LGPD Art. 7, I + Art. 11, I + Art. 33; GDPR Art. 6(1)(a) + 9(2)(a) + 44–49. Triggers re-consent for everyone. Changes (3.6, 2026-07-18): Adjustments to reminders and notices (Section 12-A), with no new data collection: (1) the invitation to come back to the app after a stretch without use (for example, around one and three weeks) now belongs to the neutral service reminders (group 1, pre-enabled) rather than the inference-based group — because what triggers it is only the time since you last opened the app (an app-usage signal, not a reading about your health); the body is neutral, with no health data and no blame, and the reminder remains toggleable in Profile › Notifications. (2) In the Question of the Day (under the "Daily headline", optional), the notice body may become the question itself when it comes from a closed list of everyday, non-sensitive questions (coffee, energy, hydration, a change in routine, how your body responded to yesterday's workout in a generic way) — fixed phrases, the same for everyone, with none of your data, value, or judgment; sensitive questions (alcohol, night context, stress), symptom questions, or ones that would involve medication/appointments or an inference about your data are never shown in full. (3) The analysis-ready notice may state how many exams were organized (a count), never the name or value of any of them; plus new neutral wording in existing reminders. Legal basis for the service items: performing the service/legitimate interest (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)); for the inference-based notices: specific consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)). Triggers re-consent for everyone. Changes (3.5, 2026-07-17): New optional agenda feature (Section 12-A) — and the first feature in the app that uses your location: with "Alert me when it's time to leave" on, on the day of an appointment that has a time and address, the app estimates your travel time (via Apple Maps, on your device) and alerts you "Time to leave" so you arrive on time. Location is requested only when you turn the option on (iOS "While Using the App" permission), used 100% on your device for the calculation, and never stored, never sent to our servers, and never sent to the AI. Opt-in per device, off by default, revocable in the app or in your iPhone Settings; dependent and managed profiles are excluded; the calculation and the alert are 100% on your device. Legal basis: specific, explicit consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)). Triggers re-consent for everyone. Changes (3.4, 2026-07-17): New optional exception to the neutral body of agenda reminders (Section 12-A): the adult account holder may enable, for their own appointments and follow-ups, showing on the lock screen the professional, the time, and a short address they entered themselves (with a map of the destination) — never the specialty, the reason, or a diagnosis. Opt-in per device, off by default, revocable with immediate effect; dependent and managed profiles are excluded; 100% on your device (nothing travels over push). Legal basis: specific, explicit consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)). Triggers re-consent for everyone. Changes (3.1, 2026-07-16): AI-assisted support is now active (to draft and translate replies). For logged-in users, it runs only under a new, dedicated, unbundled consent — "Share my support messages with AI assistance" (support_ai_share) — separate from the general AI Processing consent, off by default, refusable on its own (the paid product works fully without it), together with the existing International transfer consent (intl_transfer); a human reviews every draft/translation before it is sent, the support text is best-effort minimized before sending (not de-identification, not a guarantee of complete removal), and your health record is never sent. For people who write to support without an account, it is consent-first: no message goes to AI until the sender grants two separate consents (to process the message, and to transfer it to Anthropic (Claude), in the United States); otherwise a human replies with no AI. The transfer is covered by our existing DPA + EU SCC with Anthropic — the same terms governing record analysis, extraction, and chat — with no new subprocessor. Triggers in-app re-consent. Changes (3.0, 2026-07-15): New optional exception to the neutral notice body (Section 12-A): with the "Daily headline" on, the adult account holder may include, in notices derived from their own data, a small detail of the data — e.g., minutes left to their activity goal, or that they slept above their usual (no "below" variant exists). Closed list of phrases — never a diagnosis, lab value, judgment, or urgency. Opt-in per device, off by default, revocable with immediate effect; dependents/managed profiles are excluded. Also in this version: new closed-list domain headlines (sleep, activity goal, new lab result, partial week, consistency), an appointment-eve notice with the prep summary ready, and a technical sensor-quiet notice. Legal basis: specific, explicit consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)). Triggers re-consent for everyone.

In short (read this first)

MyHealth is an iPhone app that helps you organize your own health record, with an artificial intelligence (AI) assistant that reads the documents and photos you upload to extract and fill in records (which you confirm before saving) and offers a supportive educational reading. You bring together your lab results, conditions, medications, vaccines, appointments, measurements, and documents in a single place, and the app builds a timeline of your health to prepare you for the conversation with your doctor.

The most important points:

• Who you are is kept separate from your health data. Your name, email, phone, and identification document (such as your tax ID) are stored in an encrypted vault (authenticated field-level encryption — AEAD — deterministic, using the pgsodium library, AES-256) and are decrypted only under your own identity, by a secure function. The clinical tables refer to you only by a code (pseudonym).
• Your data stays in Brazil. The database is hosted in the São Paulo region (sa-east-1).
• The AI receives the clinical content of your health record — without your direct identifiers — and only if you consent. It may include lab results, medications, symptoms, sleep and wearable metrics, your device's events, lifestyle habits you declare (smoking, alcohol, activity, sleep), and menstrual cycle records, plus your sex and age. Name, tax ID, email, and phone are kept encrypted in a separate vault and are not sent to the AI. Your data does not train models. This processing involves an international transfer to the United States (Anthropic). See Sections 6 and 9.
• The account is for people 18 or older. Minors are only included as a profile managed by an adult guardian (Section 11).
• The AI features are paid and consume your usage quota (analyzed pages and AI Chat prompts). There is an initial free courtesy, a subscription that renews the quota each cycle, and add-on packs that do not expire. Purchases are processed by Apple (App Store); a minor's AI use is charged to the guardian. See Section 9 and the Terms.
• You're in charge. You can access, correct, export (in the standard health format FHIR R4 and as PDF), revoke consents, and delete your account whenever you want.
• MyHealth is NOT a doctor and is not a medical device. It does not diagnose and does not prescribe. The readings and the AI assistant's responses are educational — you must always confirm with your doctor. To help you prepare for your appointment, the educational reading may explain the meaning and context of your findings (the mechanism, what clinical practice generally investigates, and what is worth bringing to your specialist), but it remains educational information: it never defines your diagnosis, your management, your work-up, or your treatment — that is your doctor's decision.
• Vaccination reminder (minor profiles). For a dependent minor's profile, the educational reading may, based on the recommended immunization schedule (WHO / your country's reference) and the vaccines you have recorded, informatively flag that a vaccine may be pending. It is only an educational reminder to the guardian: the absence of a record in the app does NOT mean the vaccine was not given (it may have been administered elsewhere), it is not a demand nor an individual immunization recommendation, and it must be confirmed on the vaccination card, with the pediatrician, or at the immunization service.

The full text below details all of this and describes your legal rights.

1. Who we are (the Controller) and the DPO

The party responsible for processing your personal data ("Controller" under the LGPD; "Controller" under the GDPR) is:

BAS AI — BAS ARTIFICIAL INTELLIGENCE LTDA

CNPJ: 64.106.409/0001-70

Website: www.bas-ai.com

Address: Rua Gomes de Carvalho, 911, Vila Olímpia, São Paulo/SP, ZIP 04547-003, Brazil

In this document, "MyHealth", "we", or "the app" refer to this Controller.

Data Protection Officer (DPO)

For any privacy and data protection matter, contact our Officer (LGPD Art. 41 / Data Protection Officer, GDPR Art. 37):

Email: dpo@bas-ai.com

Officer's name: Guilherme Kaschny Bastian

Mailing address: Rua Gomes de Carvalho, 911, Vila Olímpia, São Paulo/SP, ZIP 04547-003, Brazil

We adopt the GDPR standard as our global baseline of protection (the most protective standard, applied to all users), even though the launch does not offer the service in the European Union/EEA or in the United Kingdom.

2. To whom this Policy applies

This Policy applies to everyone who uses the MyHealth app, in any country. The app is global and multi-language (Portuguese, English, and Spanish).

The initial launch focuses on Brazil, but, where the law of your country is more protective, it prevails. We treat the LGPD (Law No. 13.709/2018, Brazil) and the GDPR (Regulation (EU) 2016/679) as our minimum standard of protection everywhere, applied to all users. The app is distributed worldwide, except in the European Union/EEA and the United Kingdom, which are outside the launch.

Users in the United States: US-specific supplementary disclosures — the California Privacy Notice (CCPA/CPRA) and the Washington Consumer Health Data Disclosure (My Health My Data Act) — form part of this Policy as supplementary documents, published at https://www.bas-ai.com/myhealth/legal and prevailing, for residents of those jurisdictions, where they are more specific.

Children and adolescents: self-registration is intended for people 18 or older. Data of minors may only be included by a legal guardian, who manages the dependent's profile (see Section 11).

3. What data we collect

We collect only what is necessary for the app to work (the minimization principle). Below is what we collect and where it is stored.

3.1 Identity data (PII) — encrypted in a vault

The following data identifies you directly and is stored in an identity vault (identity_vault), encrypted field by field with authenticated (AEAD), deterministic encryption (the pgsodium library, AES-256), physically separated from the clinical tables. It is decrypted only by a secure function, under your own identity:

• Name (or display name);
• Email;
• Phone;
• Identification document (for example, the CPF/tax ID).

The clinical tables do not contain this data — they refer to you only by a profile code (pseudonym). In the pseudonymized profile we keep only the clinical-demographic minimum needed to interpret the data correctly (for example, biological sex and date of birth/age, important for lab reference ranges).

3.2 Health / sensitive data (PHI)

This is sensitive personal data (health) and receives maximum protection. We collect, as you record or import it:

• Lab results and laboratory markers (values, units, reference ranges, dates);
• Conditions and body systems ("head to toe" line);
• Medications (item, dose, indication, period, prescriber, active/inactive status);
• Allergies and intolerances (substance, category, reaction, severity);
• Vaccines;
• Appointments / encounters;
• Vital signs and bioimpedance — weight, body fat percentage, lean mass, circumferences, blood glucose, blood pressure, heart rate, saturation, temperature;
• Continuous glucose monitor (CGM) glucose — daily aggregates only. If you import glucose from Apple Health, the app distinguishes, day by day, the spot measurement (for example, a capillary reading or one you typed in — stored as a normal measurement, with date and time) from a continuous monitor (CGM) day, which produces hundreds of readings: on days identified as continuous-monitor days, we store only five daily aggregates — mean, minimum, maximum, variability (CV), and the percentage of the day within the 70–180 mg/dL range (the range of the industry display standard, the AGP report) — and the raw continuous readings are never stored by us (they are summarized in memory, on your own device, at import time). These aggregates are a factual display of an industry standard — they are not an individual target and not a judgment about your glucose control (see the Medical Notice);
• Symptoms and complaints;
• Physical activity;
• Documents and reports (PDFs, photos, and text files — lab results, prescriptions, reports, records you submit);
• Family history of health;
• Care team (professionals, area, institution, reason, optional professional contact and address);
• Card / emergency information (blood type, allergies, emergency contact);
• Notes, questions, and messages that you write in the app (including the chat with the AI assistant and the messages you send to our support through the app), to the extent they contain health data.
• Device events — events that your device records: ECG classification (sinus rhythm / atrial fibrillation / inconclusive) with the average heart rate, irregular rhythm and high or low heart rate notifications, atrial fibrillation burden, fall detection, and — when your device offers them — possible-hypertension notifications, low-cardio-fitness notifications, possible sleep-apnea events, and high sound-exposure alerts (environment and headphones). We store the event's classification and metadata. Regulated device events (apnea, sound exposure) are shown exactly as the device classifies them, never reinterpreted by us. The electrocardiogram trace (the waveform) has its own rule — see just below.

Electrocardiogram trace (waveform) — optional, only if you turn it on

Up to version 3.16 of this Policy, we did not store your ECG trace: only the classification and the metadata. That changes in this version, and it changes only for those who turn the feature on.

If — and only if — you turn on "Store my ECG trace" (Profile › Privacy), we begin importing from Apple Health, alongside the classification, the trace of the exam: the sequence of voltage measurements your watch recorded. The option starts off; while it is off, nothing changes.

Why we offer it. The trace is what your doctor reads. The classification says "sinus rhythm" or "atrial fibrillation"; the trace is the exam. Storing it lets you take it to your appointment, including an older trace, without depending on still having the same device.

What we do NOT do with it:

• We do not interpret it. No rule, threshold or label of ours. We do not measure intervals, do not detect beats, do not classify rhythm, do not say whether it is normal. The classification shown beside it is Apple's, attributed to Apple.
• We do not send it to the artificial intelligence. Never — not in the analysis, not in the chat, not summarised or excerpted. The trace is stored outside the tables that feed the AI, so that no path exists by which it could reach it.
• We do not alter it. No filtering, no smoothing, no resampling that changes the waveform.
• It does not leave Brazil (São Paulo, sa-east-1), it does not enter family sharing, notifications, the lock screen, the app's search or our team's internal console, and it is never stored in the profile of a dependent minor.

For how long. As long as your account exists and you want it — an older exam matters because it allows comparison. The control is yours and it is granular: on the event's record you can delete only the trace and keep the entry (classification, heart rate and date). Turning the option off deletes the traces already imported. When you disconnect Apple Health, the traces are deleted by default. The trace is never summarised or condensed over time.

Why we ask for a separate authorisation. Because the permission you already gave Apple Health does not distinguish "see the classification" from "store the trace" — it is a single authorisation, and it is Apple's, not ours. Data like this does not enter your health record riding on an authorisation given for something else. Turning it off does not disconnect Apple Health.

• Your wearable's annotations (category code only). — if you connect an Oura ring, we import the annotations you record yourself in the Oura app (for example: coffee, alcohol, symptom, medication, travel). The free text of those annotations — the custom name and the comment you may have written, which could mention, for example, mental health or substance use — is discarded at the moment of import and never gets stored by us (it does not touch your health record, our records, or our logs). We keep only the standardized category code of the annotation (the "type": coffee, alcohol, etc.), which stays visible only to you (it does not appear in family sharing) and is deleted when you disconnect the wearable. This standardized code — aggregated by week and never as free text — may be part of the context sent to the AI when, and only when, you keep the Health Diary (daily_journal) on; without that consent, it is not sent to the AI. Importing the annotations requires an additional Oura permission ("tag" scope): older connections need to be reconnected.
• More Apple Health and wearable data you choose to import — when available on your device and you import it: detailed activity (standing time, stairs climbed, physical effort, movement intensity and, for wheelchair users, pushes and distance — read as activity, never as a condition); average sound exposure from the environment and headphones (in decibels); detailed sleep (phase profile/hypnogram and the ideal sleep window suggested by Oura); respiratory function (home spirometry — FVC, FEV₁, and peak flow — and the number of inhaler uses); nutrition data (water, caffeine, energy, and macro/micronutrients, when you use a counting app that writes to Apple Health); gait (asymmetry, double support, step length, and speed going up/down stairs); audiogram (an Apple Health hearing test becomes an audiometry exam in your health record, with no file upload); eyeglass/lens prescription (display only, outside the AI); insulin (daily totals) and alcoholic beverages (daily count), kept display only and never sent to the AI; and the Oura ring's estimates of vascular age, pulse-wave velocity, and temperature deviation. All are health data with the same maximum protection and, except for the items marked "display only", are part of the AI context under your consent — always in a descriptive/educational way, never as a diagnosis, target, or treatment.
• Observed medication adherence (Apple Health, iOS 26 or later). If your device is on iOS 26 or later and you log in Apple Health that you took a medication dose, MyHealth can import only the doses marked as taken, matched to a medication you have already registered in the app (we never create a new medication from this import). This is adherence memory for you, never surveillance: the absence of a log is never treated as a "missed dose", and the app never sends a missed-dose notification. When you authorize AI Processing (Section 6), the AI receives only the factual aggregate — how many days, within a 30-day window, had a dose logged — never a percentage, never a judgment, never a causal claim with another data point of yours. Unavailable on minors' and managed profiles (manual entry by a guardian remains allowed).
• Clinical Records — United States only (conditional note). We have built, and will make available only once Apple grants the required authorization (an external Apple approval process, outside our control, that can take weeks) and only for US accounts, the read-only import of your own structured clinical records from Apple Health, received in the international FHIR standard from your healthcare providers: lab results (matched to our catalog via the LOINC code), immunizations, medications, conditions/diagnoses already recorded by a clinician, procedures, and allergies — each integrated into the corresponding section of your record, with the same protections as any other data of yours. We never import free-text clinical notes or insurance/coverage data. Until Apple grants that authorization, this feature remains invisible and inactive in the app.
• Menstrual cycle and reproductive health — menstrual flow, intermenstrual bleeding, ovulation tests, and cervical mucus quality, when you record or import them. Under the same cycle opt-in (the Apple Health read permission), the app may also import the descriptive cycle-pattern findings that Apple Health itself classifies — infrequent cycles, irregular cycles, persistent intermenstrual bleeding, and prolonged menstrual periods —, kept only as the presence of the finding, verbatim (no grade and no interpretation of our own). These findings are part of the analysis context in a descriptive way ("persistent irregularities are worth discussing with your gynecologist", without alarming) and never go to the chat. Correlated signals, such as basal body temperature, may be imported as vital signs. If you are female and 40 years old or older, the app may, optionally, ask your phase in relation to menopause (still menstruating, in transition, or already in menopause — with the option not to answer); this information is self-declared by you, not imported from Apple Health, and helps the AI better interpret your hormones (for example, FSH, LH, and estradiol). We do not import sexual activity records. This is sensitive data with the same maximum protection as the rest of the health data.
• Pregnancy state (optional, only on your device). If you are an adult female account holder (your own profile, 18 or older, sex assigned female at birth), the app may, optionally, ask your pregnancy stage — only the trimester (not pregnant / 1st / 2nd / 3rd trimester / postpartum), with the option "prefer not to say" (which erases the entry). For this feature we collect only that trimester enum — never the date of your last menstrual period (LMP) nor the estimated due date (EDD), never a date. This state is kept only on your device, in the iOS Keychain (WhenUnlockedThisDeviceOnly protection, which keeps it out of iCloud Keychain and backups), per profile: it is never written to any table of ours (Supabase), never added to your lifestyle habits (lifestyle_facts), and never synced; it expires on its own in about 40 weeks and is erasable at any time, in one tap (turning the feature off erases the data from the Keychain), in Profile › Privacy. Only when you run an analysis (or the chat) with the feature on is this state sent at that moment, in the request body, in memory, to our AI provider (Anthropic, United States — Sections 6 and 9), solely to calibrate the reading of your labs by the reference ranges specific to pregnancy and lactation, and it is not stored by us (Anthropic keeps the request for its own contractual limit, as a rule ~30 days — Section 6.2). Automatic/proactive analyses and large-record analyses do not receive this state — it accompanies only the analysis you trigger. The AI never writes "pregnant", "expecting", or "breastfeeding" as a condition, alert, problem-list item, or diagnosis in your health record (model instruction + deterministic server-side output filtering, with a regression test). Unavailable on minors' and managed profiles (blocked in the app and on the server). It depends on your specific, prominent consent (pregnancy-state-1.0), separate from the general clinical consent, which covers the international transfer to Anthropic/USA under the DPA/SCC in effect and is revocable in Profile › Privacy. This is not medical advice — your obstetrician follows your pregnancy. This feature uses only the trimester you declare and does not derive from any menstruation records you may import from Apple Health (handled in the item above).
• Contraceptive state (optional, only on your device). If you are an adult female account holder (your own profile, 18 or older, sex assigned female at birth), the app may, optionally, ask whether you use a contraceptive method and which type (hormonal or non-hormonal), with the option "prefer not to say" (which erases the entry). Just like the pregnancy state, this state follows exactly the same design: it is kept only on your device, in the iOS Keychain (WhenUnlockedThisDeviceOnly protection, which keeps it out of iCloud Keychain and backups), per profile — it is never written to any table of ours (Supabase), never added to your lifestyle habits (lifestyle_facts), and never synced; it expires on its own (in about 24 months) and is erasable at any time, in one tap (turning the feature off erases the data from the Keychain), in Profile › Privacy. Only when you run an analysis (or the chat) with the feature on is this state sent at that moment, in the request body, in memory, to our AI provider (Anthropic, United States — Sections 6 and 9), solely to calibrate the reading of your labs by the reference ranges specific to contraceptive use (for example, the effect of hormones on some markers), and it is not stored by us (Anthropic keeps the request for its own contractual limit, as a rule ~30 days — Section 6.2). Automatic/proactive analyses and large-record analyses do not receive this state — it accompanies only the analysis you trigger. The AI never writes your contraceptive use as a condition, alert, problem-list item, or diagnosis in your health record. Unavailable on minors' and managed profiles (blocked in the app and on the server). It depends on your specific, prominent consent (contraceptive-state-1.0), separate from the general clinical consent and from the pregnancy state, which covers the international transfer to Anthropic/USA under the DPA/SCC in effect and is revocable in Profile › Privacy. The lactation / postpartum state is handled by the "postpartum" stage of the pregnancy state (item above), under the same on-device design. This is not medical advice — your doctor follows your reproductive health.
• Lifestyle habits you provide — data you declare, optionally, in the app's cards: smoking (and cigarettes-per-week range), alcohol consumption (and drinks-per-week range), physical activity level, your perception of your sleep, and your dietary pattern (no restriction, vegetarian, or vegan — with the option not to answer). When you authorize AI Processing (Section 6), these habits are part of the context sent to the AI, along with the year you provided them — so the educational reading can weigh whether a habit declared long ago still reflects your routine (the dietary pattern contextualizes, for example, the reading of B12 and iron, always descriptively, never as a diet or supplement recommendation).

Daily records of sensitive habits (special category). Beyond what you submit, the app may ask, occasionally and optionally, about habits that devices do not measure: a day's alcohol drinks (substance-use data) and what shaped a shorter night — including the options "Stress" (mental-health data) and "Alcohol". Because they involve a substance and a mental state, we treat these records as sensitive / special-category personal data. This is different from the weekly range of smoking/alcohol you declare at registration (the "Lifestyle habits you provide" item, above), which is part of the AI context when you authorize it: here we mean the daily, point-in-time records, which stay on your device and in your health record and are not sent to the AI.

We only collect them after YOUR specific and prominent consent (the daily_journal purpose, which you turn on in Profile › Privacy & consents), separate from accepting the Terms and from the general clinical consent. It is OFF by default — nothing is recorded until you turn it on —, it is blocked on the server until the consent exists, and it is UNAVAILABLE on minors' profiles and managed profiles (blocked in the app and on the server). Declining it does not reduce any other feature of the app.

Well-being check-in distinction (energy, mood, stress and sleep). The "How are you today?" check-in is handled separately, as health data under the general clinical consent (it does not fall into the sensitive-habit category above). It has four axes that you yourself answer, each on three levels (1 = worse · 2 = average · 3 = better): energy, mood, stress and — only when the app does not receive sleep from your wearable — sleep. Like the rest of the health record, these axes may be part of the context sent to the AI under that same clinical consent (together with AI Processing and International Transfer), only as a weekly average per axis — never a single day's answer, never free text. This includes the stress axis, and we want to be explicit: it is your own self-report, of low granularity (three levels), aggregated by week, sent so that the educational reading can cross how you feel with your sleep, your activity and your lab results — always descriptive. The AI is instructed hard: never diagnose anxiety, depression or a "stress disorder", never treat this axis as a clinical instrument, never advise treatment. What does NOT go to the AI, and still does not: entries in the sensitive Health Diary (alcohol doses and stress/evening context, under the separate consent described above) — dated sensitive self-observation entries, more stigmatizing, which is why they have their own consent; your ring's stress index (Oura); and the GAD-7/PHQ-9 questionnaires from Apple Health. The distinction in one line: the check-in axis is an answer of yours, on three levels, that the analysis reads as the week's average; the sensitive Diary is a daily record of substance use and evening context that stays between you and your health record.

What changed in this description (3.14). Up to version 3.13 this paragraph said that "point-in-time stress" stayed out of the AI and described the check-in as being mood only — text written before the check-in gained its own axes. A reasonable reader would conclude that no self-reported stress reached the AI, and the check-in axis did, as a weekly average. The text above is the correct description; the correction is one of the reasons for the re-acceptance in version 3.14.

Other non-sensitive daily contexts. Occasionally and optionally, the app may also ask about lifestyle and wellness contexts that devices don't measure — for example coffee/caffeine, energy levels, hydration, how your workout felt (light/normal/hard), and routine changes during the week (e.g., travel, a new workout, changes in diet or sleep). Like the mood check-in, these are health data under the general clinical consent and are stored in your health record. When you authorize AI Processing and International Transfer (Sections 6 and 9), these contexts are included in the context sent to our AI provider (Anthropic, USA — Section 9) only in weekly aggregated form, as day counts — for example, "low hydration on 3 days of the week" or "3+ coffees on 2 days"; for routine changes, only the category you reported that week (e.g., "travel") — never the individual daily entry, never free text, limited to recent weeks. The sole purpose is to correlate, in an educational and descriptive way, your habits with your sleep, activity, and exam data — never diagnosis or treatment. Entries in the sensitive health diary (alcohol and stress/evening context) are not included: they remain outside the context sent to the AI and under their own separate consent, and any future AI use of them would require new explicit consent.

Your ring's stress index: you see it, the AI does not. If you connect an Oura ring, the daily scores we import (Section 8) include the day's stress index. We show it to you in the "Today's readiness" card, on the Routine tab, in the most conservative way possible: we display the label Oura itself publishes for that day (for example, restful, normal or stressful), exactly as the brand publishes it, always with the date it refers to — no translation into a scale of ours, no severity color, no severity ordering, and no calculation of ours: MyHealth never computes a "stress index" from your physiological signals. This index is never sent to our AI provider — not in the analysis, not in the chat, and not inside Oura's resilience sub-scores (the exclusion is applied in the database query itself, not merely as an instruction to the model) —, never enters the PDF Health Report you hand to third parties, never becomes a notification and never appears on a dependent's or a minor's profile. Collection of this index happens under the consent you granted when you connected Oura, revocable at any time (Section 8).

"What appears in the app" — hiding from the screen is different from withdrawing consent. In Profile › Privacy & consents there is a card called "What appears in the app", with one switch per sensitive category you actually have on that profile: Ring stress (your ring's index), Menstrual cycle and Mental health. Turning one off hides that content from the app's screens — and that is all —, with immediate effect and across all your devices (the choice travels with you, not with the device). To leave no doubt: hiding does not disconnect your ring or Apple Health, does not withdraw any consent, does not delete any data, does not stop collection and does not change what our AI provider receives. Collection and use are governed by your consent — the two controls sit on the same screen on purpose, but they are different controls with different effects: if what you want is to stop collection or use, use consent withdrawal (Section 5) or disconnect the source (Section 8). When you hide Menstrual cycle, it also stops being offered in the PDF Health Report — the PDF goes to third parties, and offering to send data you chose not to see would be the opposite of what you asked for. This control does not exist on a dependent's profile or in read-only access. The Ring stress switch hides the line with the ring's index; the "Stress" axis of the check-in (which is your self-report, not the ring's reading) and Oura's Resilience index remain visible — which is why the label names the ring.

When this data refers to a minor in your care, the same protections apply (see Section 11).

3.3 Locality and language (optional, in clear text)

Optionally, to adapt the experience and prepare future features (such as recommending professionals by city), we may store country, state/province, city, and the preferred language. We do not collect a full address, latitude/longitude, or precise location. These locality fields are kept in clear text because the "city" granularity is not, in itself, sensitive data, and they are protected by the same access rules as your account. When you authorize AI Processing (Section 6), your profile's country is part of the context sent to the AI, only to regionalize, in an educational way, emergency guidance and vaccination-calendar guidance (state/province and city are not sent to the AI).

3.4 Account, session, and security data

• Account and authentication: technical account identifiers and session tokens, to keep you securely signed in; two-factor authentication (MFA/2FA via TOTP), when enabled by you.
• Account number (account_ref): a short pseudonymous identifier of 8 random, non-sequential digits, generated by us (not collected from you), shown in your Profile and used by support to locate your account — including when you use "Hide My Email" in Sign in with Apple. It is erased upon account deletion.
• Notifications (push): when you turn on notifications, we store a technical token that your device generates, used only to deliver the app's notices (e.g., when your analysis is ready). It is a delivery identifier — it is not used for tracking, does not train AI, and is not shared with third parties (it only travels through Apple's push service). You control this in the iOS notification permission and in the Notifications button inside the app, and the notice's content is generic, with no health data. One type of notice — "Something new in your data" (optional, off by default) — is triggered when your data (e.g., sleep, resting heart rate, variability) records a new finding; even so, the content stays generic and with no health data whatsoever (the data never travels in the push, and never suggests abnormality or urgency), at most one per day, and never for minors' profiles.
• Access and audit logs (access_log): metadata about who accessed what and when (action, table, origin, source IP address) — metadata only, never the clinical content. We keep the access IP address for security, auditing, and fraud prevention (and, in Brazil, to meet the retention floor of the Internet Civil Framework, Law 12.965/2014, Art. 15). **We also log the technical identifier of your browser/app (user-agent) on synchronous accesses (exam upload, AI chat, and access ping), for the same purpose and the same period. The recent access IP also forms part of the minimum forensic index** that survives account deletion (see 12.2).
• Consent records (consent_events): which purpose you authorized, the legal basis, the Policy version, and the moment — in an immutable way (see Section 5).
• AI usage and billing: we record metadata of the use of the AI features (function, model, number of tokens) and your usage-quota balance and consumption (pages and prompts) and add-on packs, to operate billing and prevent abuse. These records do not contain the analyzed health content.

3.5 De-identified usage data

We collect minimal stability and diagnostics data (telemetry) — crashes, errors, performance — in a de-identified way and without any health content, to keep the app safe and working (see Section 13). This is internal processing: we do not use analytics SDKs or third-party tracking. As a self-limited minimization measure, we retain this telemetry for up to about 12 months (see Sections 12 and 13).

3.6 What we DO NOT collect / DO NOT do

• We do not sell your data.
• We do not run targeted advertising based on your health, nor do we use third-party trackers that see your health data.
• We do not collect precise location, phone contacts, or microphone. The camera and gallery are accessed only at the exact moment you decide to upload a document (just-in-time permission).

4. Purposes and legal bases

Every processing activity has a legal basis. Because we process sensitive health data, we are especially rigorous: each sensitive purpose is recorded in our consent record with the corresponding legal basis and Policy version.

Legal basis of the clinical core — clarification. The primary basis for processing your health record is your specific and prominent consent (LGPD Art. 11, II, "a" / GDPR Art. 9(2)(a)), consistent with the "sovereign health record" positioning: you authorize, and you may revoke. We reserve a subsidiary basis only for what consent does not cover — information security, data integrity, compliance with a legal obligation, and the very operation of account deletion —, supported by LGPD Art. 7, II and Art. 10 and by GDPR Art. 6(1)(c) and (f). We do not adopt the health protection ground (LGPD Art. 11, II, "f" / GDPR Art. 9(2)(h)): under the GDPR, Art. 9(3) conditions this ground on the presence, in the flow, of a health professional bound by a duty of confidentiality, and there is no doctor in the loop of MyHealth.

Educational, age-based screening reminders. We use your date of birth and sex at birth — data you already provided in your profile — to show, inside the app, educational reminders about health screenings that international population guidelines commonly suggest for your age group (for example, mammography or periodic blood pressure checks). These reminders are generated on your own device by fixed age/sex rules; we do not use your test results, conditions, or any individual risk assessment to generate them, and they are not delivered as notifications. They are educational content, not medical advice — any decision about testing is always yours and your doctor's. Legal basis: performance of the contract (delivery of the app's educational feature) and, for the use of the already-collected health datum (sex at birth), your consent to clinical processing (LGPD art. 7(V) and art. 11(I); GDPR art. 6(1)(b) and art. 9(2)(a)). You can dismiss each reminder or turn this reminder surface off at any time in your preferences — with no impact on the rest of the app.

5. Consent and how to revoke it

When you authorize a sensitive purpose, that consent is:

• Freely given — the app works in its essentials even if you do not authorize the AI;
• Informed — we explain the purpose on the spot, in plain language;
• Specific and prominent — each sensitive purpose has its own request (not a generic "accept all"), as the LGPD requires for health data;
• Revocable at any time — you can withdraw an authorization in the settings, without losing access to what you have already organized.

Our system only executes an operation if the corresponding consent is active. For example: if you do not authorize "AI Processing", the app does not send anything to the AI — this check happens automatically, on the server (the has_active_consent function), on every operation.

How the record works: each authorization or revocation is recorded as an immutable event in our consent record (consent_events), with the purpose, the legal basis, the language, and the Policy version in effect. Revoking does not erase the consent history — it records a new event that halts future processing of that purpose.

Revocation does not make unlawful processing already lawfully carried out, but it halts the future use of that purpose. You do not lose access to the health record you had already organized.

Sensitive health journal. The daily sensitive collection (alcohol, stress/what shaped the night) has its own consent (daily_journal), off by default: nothing is recorded until you turn it on, and the server blocks writes of these items without the consent active. You may withdraw at any time, just as easily, in Profile › Privacy & consents. When you withdraw: (1) we immediately stop collecting new records; and (2) we delete the alcohol/stress records already collected in those categories.

Hiding ≠ withdrawing. On the same screen as the consents there is a card called "What appears in the app" (§3.2), which hides from the screens the ring's stress, the menstrual cycle or mental health. It is a display preference: it does not withdraw consent, does not stop collection, does not delete data and does not change what the AI receives. To stop the processing, use the withdrawal described in this Section; to cut off the source, disconnect the wearable or remove the permission in Apple Health (Section 8). The two controls sit side by side on purpose — and the screen says, in those words, what each one does.

6. How Artificial Intelligence (AI) processes your data

AI is a central piece of MyHealth (assistant and extraction of data from documents), so we explain it with full transparency. Our AI provider is Anthropic, which acts as a subprocessor.

6.1 The AI receives the clinical content of your health record, without your direct identifiers

• The content sent to the AI is the user's own and is processed only upon your consent (ai_processing).
• The clinical content we send to the AI, without sending your direct identifiers (name, tax ID, email, phone) — replaced by sex, age, and your year of birth (without day/month) and, when available, by your country (only to regionalize, in an educational way, emergency guidance and vaccination-calendar guidance — never the city or precise location) — and without your emergency contacts — may include: lab markers and trends, measurements and bioimpedance, medications, vaccines, allergies, symptoms, appointments and notes, family history, physical activity, sleep data and wearable scores, device events (ECG classification, irregular rhythm, fall, possible hypertension signs, low cardio fitness), menstrual cycle and reproductive data (including the menopause phase, when you provide it), lifestyle habits you provide (smoking and years of use, alcohol, activity, and sleep), the non-sensitive daily contexts in weekly aggregated form (coffee/caffeine, energy levels, hydration, and workout perception, as day counts, and the week's routine-change category — never the individual daily entry, never free text; see §3.2), the blood type and the observations from your emergency card, and the document itself (photo/PDF) when you request AI extraction — before sending, the app attempts to cover (redact), directly on your device, your name, tax ID, email, and phone number printed on the document, and you can cover areas manually; the original file remains intact in your health record and the version sent to the AI is the redacted one, when generated. This automatic redaction is best-effort: it may fail on low-quality photos or handwriting and is not a guarantee of complete removal. We do not send the contacts from your emergency card (name, phone, relationship). Free-text notes written by you or by professionals may, occasionally, contain names — which is why we recommend not entering identifying data in text fields. In the chat with the assistant, the context may additionally include the conversation history itself and the location and the professional recorded in your appointments — items that do not enter the longitudinal analysis of the health record.
• Web search exists only in the assistant chat, for general clinical knowledge. We instruct the model to use only generic clinical terms, without including your values, dates, age, names, or identifiers. This protection is applied by instructing the model and not by an infallible technical filter; the search is run by Anthropic's infrastructure. The health-record analysis and document-extraction functions do not perform web search.

6.2 We DO NOT use your data to train AI

• Under Anthropic's commercial terms, your data (inputs and outputs) is not used to train or improve models and is retained for a limited period and then deleted (as a rule, within 30 days), except for retention required by law or to prevent abuse. This relationship is supported by a DPA + SCC (Modules 2/3, UK IDTA, Swiss addendum) in effect through Anthropic's Commercial Terms.

6.3 Technical safeguards

• Traffic with the AI uses an encrypted (TLS) connection.
• We apply safeguards against prompt injection and minimization of the content sent.
• The AI does not make automated decisions about you within the meaning of GDPR Art. 22 / LGPD Art. 20: it organizes and describes, it does not decide, diagnose, or prescribe. You review and confirm the information, and the readings come marked as content to confirm with your doctor.
• The AI does not detect, monitor, or diagnose the risk of suicide, self-harm, or psychiatric crisis, and does not alert anyone on your behalf. If you are in crisis, seek immediate help (in Brazil, CVV 188, 24h, free; outside Brazil, the national prevention line). See Section 3.5 of the Terms of Use.

6.4 Open standards and vocabularies (LOINC® / UCUM)

So that the same test coming from different laboratories (with different names, abbreviations, and languages) is recognized as a single parameter and produces a coherent timeline, MyHealth normalizes markers using the open vocabulary LOINC® (Logical Observation Identifiers Names and Codes) and standardizes units of measure based on UCUM. These standards are licensed reference content embedded in the app — they work like a dictionary and receive none of your personal data (Regenstrief Institute is not a sub-processor and nothing from your record is sent to it).

This product includes content from LOINC® (loinc.org). LOINC is copyright © 1995–2024, Regenstrief Institute, Inc. and the LOINC Committee, and is available at no cost under the LOINC license (loinc.org/license). LOINC® is a registered trademark of Regenstrief Institute, Inc.

6.5 Organizing medications and supplements (derived data, AI-assisted)

To organize your record, the AI may produce, from the medications and supplements you log, a derived organizational datum: the decomposed active ingredients (a compounded formula is split into its label ingredients) and a general category; the canonical vaccine, the disease prevented, and the dose in the series (consolidating the same vaccine under different names); and the normalized allergen and its class. This datum is generated from what you already provided (we collect nothing new from you) and serves to relate, for example, an active ingredient to the corresponding marker in your lab test. It is educational and AI-assisted — you can review and correct it, and it is not a clinical classification, a prescription, or interaction checking (see the Medical Notice, item 5.2). AI processing details follow Sections 6.1–6.3.

6.6 Document awaiting available quota/usage

When billing is active and you do not have enough available quota or usage at the moment of upload, a document already redacted (after the on-device redaction described in 6.1) may be stored, without analysis, until subscription quota or an add-on pack becomes available — and is then analyzed automatically. The document waits in your own health record, under the same security and access protections as your account; nothing is sent to the AI while the AI Processing consent (ai_processing) is not active and there is no available usage.

6.7 AI-assisted support

When you contact our support and an agent uses AI assistance to draft or translate the reply, the text of your support conversation — which may contain health data you write — may be sent to our AI provider (Anthropic (Claude), United States) only to prepare a draft reply or translate it, which a human agent always reviews before it is sent. The support AI never receives your health record (prontuário) — only the text of your support message.

For logged-in users (in-app support, Profile › Support). This happens only when you grant a new, dedicated consent — "Share my support messages with AI assistance" (support_ai_share), which is separate from, and additional to, the general AI Processing consent (ai_processing): it has its own request, is off by default, and can be refused or withdrawn on its own without affecting anything else — the paid product works fully if you decline. AI-assisted support runs only while both this consent and your International transfer (intl_transfer) consent are active; if either is off, an agent replies without any AI. Before your support text is sent, the app makes a best-effort attempt to minimize identifiers in it — this is not de-identification and not a guarantee of complete removal, so please still avoid including unnecessary data (name, ID document, contacts) in your support messages.

For people who write to support without a MyHealth account (external senders). We do not send your message to AI without your own consent. When you email support, you first receive an email asking for two separate consents: (1) to process your message to prepare a reply, and (2) to transfer it to Anthropic (Claude), in the United States — with a link to our Consumer Health Data Privacy Policy. Only after you grant both does the AI draft or translate a reply for your ticket, which a human reviews before it is sent. If you do not consent, a human replies to you with no AI involved.

Safeguards. The transfer to Anthropic (United States) is covered by our existing Data Processing Agreement and EU Standard Contractual Clauses (SCC) with Anthropic — the same terms that govern record analysis, document extraction, and chat, and that apply to all data we submit to Anthropic's API. Contractual non-training applies. Retention follows Anthropic's own contractual limit (as a rule about 30 days, subject to legal or abuse-prevention exceptions) — this is Anthropic's limit, not a deletion date we guarantee. This adds no new subprocessor: Anthropic is already listed in Section 9.

6.8 Stress and the AI: what goes and what doesn't

The Sensitive Health Journal is NOT sent to the artificial intelligence. Your alcohol and stress/what-shaped-the-night records (the Diary's own consent) stay on your device and in your health record and are not part of the context sent to our AI provider (Anthropic, United States). Any future use of these records by the AI would require a separate, explicit consent ("include my daily records in the AI analysis"), which does not exist in this version. This differs from the non-sensitive daily contexts (coffee/caffeine, energy levels, hydration, workout perception, and routine changes), which are part of the AI context only in weekly aggregated form — day counts and the routine-change category — as described in §3.2.

Your ring's stress index is also NOT sent to the AI. Oura's stress score is excluded in the database query itself, in both the health-record analysis and the chat (a single exclusion list serves both surfaces), and the exclusion also reaches the stress sub-score embedded in Oura's resilience "contributors" — the barrier does not depend on the AI obeying an instruction. It also does not enter the PDF Health Report (§3.2). The same applies to Apple Health's GAD-7/PHQ-9 questionnaires.

What IS sent: the well-being check-in's "stress" axis, as a weekly average. The "How are you today?" check-in — which you answer on three levels, across the energy, mood, stress and (only without wearable sleep) sleep axes — is part of the analysis context under the Clinical processing, AI processing and International transfer consents, only as a weekly average per axis, so that the educational reading can cross how you feel with your sleep, your activity and your lab results. It goes descriptive, with a hard instruction to the model: never a diagnosis of anxiety, depression or a "stress disorder", never a clinical instrument, never treatment advice. Up to version 3.13 this section did not say this — it said only that "point-in-time stress" stayed out of the AI, text that predates the check-in's axes. This is the correct description, and it is one of the reasons for the re-acceptance in version 3.14.

6.9 Progress reports and follow-up decisions

When you record the evolution of a tracked item as your own report (Terms, Section 9.7), we store in your health record the report text, the decision (keep or close follow-up), the date, and the version of the text you confirmed, in an immutable trail (correcting = a new entry). These reports become part of the context sent to the AI explicitly marked as a patient report — the AI is instructed to treat them as a report ("you reported that…"), never as a documented clinical fact, and it is technically prevented (server-side validation, not just an instruction) from closing or superseding an item based on a report without your express decision. All of this operates under the already-active Clinical Processing, AI Processing, and International Transfer consents; the copy sent to the AI follows the same identifier-redaction pipeline as the rest of your record.

Minimization: to record a report, professionals' names are optional — the report works equally well without identifying who made the assessment; we recommend including only what is necessary.

Export and deletion: reports and decisions are part of your health record — they are included in the export and erased upon account deletion, through the same dual-track process of Section 12.

Minors: on minors' profiles, entries are made by the legal guardian, in representation, and the entry identifies the guardian who made it; relevant closures are communicated to the other guardians linked to the profile.

6.10 Pregnancy and contraceptive state (transient, never recorded by the AI)

When you keep the pregnancy state on (§3.2) and trigger an analysis or the chat, the trimester you declared is attached to the body of that request, in memory, only so the AI can calibrate the reading of your labs by the reference ranges specific to pregnancy and lactation. It is not persisted by us in any table, and the AI is instructed — with deterministic server-side output filtering as a backstop (with a regression test) — to never record "pregnant", "expecting", or "breastfeeding" as a condition, alert, problem-list item, summary, or diagnosis in your health record. Automatic/proactive analyses and the large-record (batch) path do not receive this state — it accompanies only the analysis you start. The transfer to Anthropic (United States) is governed by the DPA/SCC already in effect (Section 9), under the pregnancy-state-1.0 consent (which covers the international transfer), and Anthropic retains the request for its own contractual limit (as a rule ~30 days — Section 6.2); we do not store this state.

The contraceptive state (§3.2), when you keep it on, follows the same transient design: it stays only on your device (Keychain, expires in ~24 months) and is attached to the request body, in memory, only when you trigger an analysis or the chat, under the contraceptive-state-1.0 consent (which covers the international transfer). It is not persisted by us in any table, does not go to automatic/proactive analyses nor to the large-record path, and the AI is instructed to never write it as a condition, alert, or diagnosis in your health record. The lactation / postpartum state is the "postpartum" stage of the pregnancy state, under the same treatment above.

6.11 Care team in the analysis context

If you add professionals to your Care Team (for example, the doctor who already follows you), those professionals' name and specialty — and, when you provide them, the institution and the reason for the follow-up — become part of the context we send to the AI when it analyzes your health record, so that the educational guidance can point to the professional you already registered (for example, "worth taking this to your cardiologist already on file") instead of a generic suggestion. We never send the professional's contact details (phone, email, or address) or registration number to the AI; those fields stay only in your record. This is the same handling that already happens when you chat with the AI. The legal basis and international transfer are the same as for the rest of the AI processing described in this section.

6.12 AI-generated educational library (generic, population-level content)

Beyond the personalized reading, the app shows a library of educational content about markers, measurements, and conditions (for example, "what ferritin is" or "what a value above the range usually means"). This content may be generated by AI — by the same provider (Anthropic) and with the same provenance as Sections 6.1–6.3 — but in a generic, population-level way: each text is produced once per topic and language and is the same for every user of that topic. The generation receives no data of yours: the AI receives only the abstract coordinate of the topic (the marker/measurement/condition name from our catalog and generic direction, range, and population-group categories) — never your value, your result, your dates, or any identifier. Personalization happens only in the selection: the app uses your data, on your device, solely to choose which generic texts from the library are relevant to show you. The content itself is not an individual analysis of your case — it is population-level educational material, available regardless of the AI Processing consent (which governs the personalized reading), and subject to the same non-diagnosis rule as the rest of the app (see the Medical Notice).

7. Family sharing (opt-in, read-only, revocable)

MyHealth lets you share your health record with a family member, in a controlled way:

• It is opt-in: nothing is shared unless you initiate and authorize it (family_sharing).
• Access is read-only and to the entire health record (all or nothing — it is not possible to share only parts): the family member can view, but cannot edit or delete.
• The link is created by a single-use invitation code, which expires in 7 days if not used.
• You can revoke the link at any time, ending the access.

The family member must also be a user of the app. This sharing is between you and the person you choose — it is not sharing with third parties or for commercial purposes.

7.1 Item-by-item sharing of hereditary conditions

In addition to the read-only link above, you may choose, item by item, to offer health conditions tracked in your record (for example, a diagnosis and its year of onset) to linked family members, so they can add them to their own family history. How it works:

• Double authorization: the item is only offered if you enable it, and it is only incorporated if your family member expressly accepts it, item by item (never in bulk).
• Minimization locked in code: only the condition, the period (year of onset), and the status are transmitted — never exams, documents, values, medications, free text, attachments, or routine. The database rejects any content beyond these fields.
• Permanence notice: at the moment you enable each item, we show the named item, who can receive it, and the notice that, if you deactivate it later, what a family member has already accepted remains in their record. We log your consent (who, when, and the version of the text displayed).
• Permanence rule (ex nunc revocation): revocation takes effect from that moment on and does not affect incorporations already accepted by your family members, which become health data of their respective subjects (family history) — as if they had noted it from memory. Deactivation immediately removes the offer for all linked family members, in one tap, free of charge and with no justification required.
• Deletion by the recipient: the family member may delete the incorporated item at any time, and it is included in the family member's own data export and erasure.
• De-identification upon the source's erasure: if the source requests erasure of their data or deletes their account, we remove from the family member's record every reference to the source's identity and account, keeping only the degree of kinship, condition, and period (LGPD art. 18, VI; GDPR art. 17).
• Minors: minors' profiles do not participate as a source by their own decision; the management of minors' data follows the legal-guardian mechanism.

Legal basis: processing based on your specific, highlighted consent (LGPD art. 11, II, "a"; GDPR art. 9(2)(a)) and, where applicable, upon a valid authorization under the My Health My Data Act (Washington/USA). The incorporated item is treated as sensitive data of the recipient themselves throughout the pipeline (including AI, export, and erasure), under the recipient's own active consents.

7.2 Manager authorized by you (delegation by an adult)

Upon your specific, highlighted consent (LGPD art. 7, I and art. 11, I; GDPR art. 9(2)(a); for Washington/USA residents, the separate consent required by the MHMDA), an adult you designate (the "Manager") may access and record data in your health record. How this processing works:

• Consent on your device, with reinforced identity: the authorization can only be granted by you, on your device, after reinforced identity confirmation; we log who consented, when, and the version of the text displayed.
• Legal basis: your consent, revocable at any time with immediate effect, in one tap, free of charge and without justification; the Manager only learns that the link changed, never the reason. Revocation immediately ends the management powers; the read-only link remains until you also remove it (both options are shown side by side in the app).
• Strictly personal acts technically blocked: the Manager cannot change your consents, delete your account, create/change/remove sharing or links, change your credentials, make purchases on your behalf, or bulk-export your record — the block on consents, account deletion, links, and credentials is enforced server-side (database access rules); the block on purchases and bulk export is enforced technically in the app.
• Audit trail: we keep an immutable authorship record of everything the Manager creates or edits in your record and show it to you, plus an in-app summary of their activity, which the Manager cannot turn off. These records are retained for the same period as the health record.
• Ownership: what the Manager records is your data and remains in your record after revocation, under your consents and rights (access, export, erasure).
• Minors: minors' profiles cannot appoint a Manager; the management of minors' data follows exclusively the legal-guardian mechanism.

8. Apple Health (HealthKit)

MyHealth lets you import measurements from Apple Health (HealthKit) — weight, height, body composition, blood glucose, blood pressure, heart rate, saturation, and temperature, plus day-to-day metrics when your device offers them, such as sleep breathing disturbances, time in daylight, and mindfulness sessions — and, when you authorize them in the iOS permissions, also menstrual cycle and reproductive health data (menstrual flow, intermenstrual bleeding, ovulation tests, cervical mucus quality) into your health record. We do not import sexual activity records.

Continuous glucose monitor (CGM) glucose — daily aggregates only. When importing glucose from Apple Health, days with a continuous glucose monitor (hundreds of readings) are summarized on your own device and stored only as daily aggregates — mean, minimum, maximum, variability (CV), and the percentage of the day within the 70–180 mg/dL range of the industry display standard (AGP); the raw continuous readings are never stored by us. Spot measurements (capillary/manual) continue to be stored as normal measurements, with date and time (see §3.2).

Cycle patterns (its own opt-in, off by default). If you turn it on in Profile › Privacy, the app can show your logged cycle days alongside your charts (sleep, heart) and observe local, descriptive patterns (for example, how your sleep behaves on logged menstruation days). It is a composition, on your device, of data you already see: none of it becomes a notification, nothing is sent to the AI beyond what you already authorized, and the app never calculates or predicts fertility/ovulation. Unavailable on dependents' profiles; revocable at any time (the pattern simply stops being shown).

Medication adherence (iOS 26 or later). See the summary in §3.2 — the app can import, from Apple Health, medication doses marked as taken, matched to a medication you have already registered; it is adherence memory for you, never surveillance, and never generates a missed- or forgotten-dose notification.

Clinical Records (United States only, conditional availability). See the summary in §3.2 — the read-only import of your structured clinical records (lab results, immunizations, medications, conditions, procedures, and allergies) via FHIR depends on an authorization only Apple can grant and is available only for US accounts; until that authorization exists, the feature stays invisible and inactive in the app.

• The import is optional and happens only with your explicit authorization, granted in the iOS permissions. Access is read-only — MyHealth does not write data to Apple Health.
• Data coming from Apple Health is used exclusively to enrich your own health record within the app.
• In compliance with Apple App Store Guideline 5.1.3, Apple Health data is NEVER used for marketing/advertising, is NEVER shared with third parties for advertising purposes or data mining, and is NEVER used to train AI models.

Connecting smart bands and rings (Oura and WHOOP)

In addition to Apple Health, you may, optionally and revocably, connect third-party wearables, with specific consent per provider (wearable_sync_oura, wearable_sync_whoop):

• Oura Ring: sleep and sleep stages, daily scores (sleep, readiness, activity, stress, resilience), temperature deviation, steps, calories, distance, sedentary time, SpO2, sleep breathing disturbance index, VO2max, cardiovascular age, workouts and meditation sessions, and the annotations you record in the Oura app (enhanced tags): the free text (custom name, comment) is discarded on import — we do not store it; we keep only the standardized category code, which — aggregated by week, never as free text — may enter the AI context when you keep the Health Diary (daily_journal) active, is visible only to you, and is deleted on disconnect (see Section 3.2). For annotations, Oura requires an additional permission ("tag" scope): connections made before this version will only start syncing them after you reconnect Oura. The stress and resilience scores are categorical (a label for the day, not a number): we show you the label published by Oura, with the date it refers to, in the "Today's readiness" card on Routine — no calculation, no severity color and no ordering of ours —, and stress can be hidden from the screen in Profile › Privacy & consents ("What appears in the app", §3.2), without that disconnecting Oura or interrupting the sync. The stress score is never sent to the AI and never enters the PDF (Section 6.8).
• WHOOP: recovery score, resting heart rate, heart rate variability (HRV), SpO2, skin temperature, strain, sleep, and workouts.

The authorization uses OAuth: the access tokens are encrypted (AES-256-GCM) on our server and are not accessible by the app. Oura operates in Finland (European Economic Area) and WHOOP in the United States; connecting these services involves an inbound international transfer, under the safeguards in Section 9.1. Oura and WHOOP act as data sources (independent controllers of their own platforms), not as our subprocessors, and do not receive data from your health record.

When you disconnect a wearable:

• WHOOP: to comply with the WHOOP API's terms of use and as a matter of the privacy standard we adopt, we request the revocation of access at WHOOP and permanently delete all data originating from WHOOP already synced (sleep, scores, measurements, activities, and events). We recommend exporting beforehand if you want to keep a copy.
• Oura / Apple Health: we revoke access and delete the encrypted tokens we hold. Data already synced remains in your health record, unless you request its deletion. Exception: Oura free-text annotations are always deleted when you disconnect, even if you choose to keep the other already-synced data.

Data imported from wearables and from Apple Health is always recorded in your own health record (account holder) and never in a dependent's profile, even if you are viewing a minor's profile.

9. Subprocessors and international transfers

We do not sell your data. To operate the service, we use a minimal set of vendors ("subprocessors"/"processors"), each under a data processing agreement (DPA) in effect, confidentiality, and security, processing data only under our instructions. The three subprocessors below have DPAs/SCCs in effect: Supabase (signed 2026-06-18), Anthropic (via Commercial Terms, 2026-06-17), and Resend (via EU-US DPF + SCC, 2026-06-17).

Oura and WHOOP do not appear in this table: they are data sources that you connect (Section 8), acting as independent controllers of their own platforms, and not as our subprocessors. Apple acts as an independent controller for distribution, HealthKit, push, and payments. The DPAs and Standard Contractual Clauses (SCC) of our three subprocessors (Supabase, Anthropic, and Resend) are in effect, as indicated in the "Safeguards" column. We maintain a public subprocessors page kept up to date at https://www.bas-ai.com/myhealth/legal/subprocessadores. We will give notice before adding a relevant new subprocessor.

9.1 International transfers

Your health record is stored in Brazil (São Paulo) — that is the rule. Transfers outside Brazil occur in a limited way and with your authorization (intl_transfer): in AI processing (Anthropic, United States — Section 6), in which we send the clinical content without your direct identifiers (in document extraction, the file itself — after a best-effort on-device automatic redaction that attempts to cover name, tax ID, email, and phone; identifiers not located may remain in the file); in the connection of wearables (Oura, in Finland/EEA; WHOOP, in the United States — Section 8); and in distribution by Apple (United States). When there is an international transfer, we adopt the required safeguards:

• LGPD (Art. 33): transfer based on specific consent and/or on adequate contractual guarantees (standard clauses), as regulated by the ANPD.
• GDPR (Art. 44–49): Standard Contractual Clauses (SCC) and/or other adequate guarantees for transfers outside the EEA, with a transfer impact assessment where applicable.

We may also disclose data when required by law (court order or competent authority), always limited to what is strictly necessary and, where legally permitted, notifying you.

10. Information security

The confidentiality of your health data is our number one control. The main measures:

• Separation between identity and clinical data: who you are (name, email, phone, document) stays in an encrypted vault (identity_vault) with authenticated (AEAD), deterministic field-level encryption (pgsodium, AES-256), separated from the clinical tables, which refer to you only by a code.
• Controlled decryption: PII is decrypted only by a secure function, under your own identity, with an audit record.
• Encryption at rest and in transit: encrypted database and storage; communications over TLS.
• Row-level access control (RLS) per verb: the database ensures that only you (or an authorized guardian/family member) access your data — and the read and write permissions are separated.
• Two-factor authentication (MFA/2FA via TOTP): available to strengthen access to your account.
• Versioned consents and an immutable audit record (access metadata only, never the clinical content).
• AI safeguards: removal of the direct identifiers (name, tax ID, email, phone) from the context sent, non-sending of the emergency card's contacts, content minimization, and protection against prompt injection.

We seek alignment with the best international practices for health information security. No system is 100% immune; that is why we maintain incident response plans (see Section 14).

11. Data of children and adolescents (minors)

The protection of children and adolescents follows the Statute of the Child and Adolescent (Law 8.069/1990), Law 15.211/2025 (Digital ECA), Art. 14 of the LGPD, and Art. 8 of the GDPR (EEA).

• Self-registration is intended for people 18 or older (or the country's age of civil majority, if higher).
• The minor has no account or email of their own: they exist only as a managed profile within an adult guardian's account (the managed_by field), who declares this condition.
• The profile may have more than one guardian: the primary guardian invites another adult by an invitation code with an expiration date. Each invitee receives a role: guardian (views and edits) or companion (read-only). Every authorization is verified on the server, on each operation.
• The consent relating to the minor is recorded identifying which adult granted it, observing the best interest of the child and adolescent (LGPD Art. 14).
• Paid AI features require the guardian role and are charged to the primary guardian (the profile's paying holder), regardless of which guardian triggered them; the usage record remains linked to the minor's profile for audit purposes.
• We apply the same maximum protection to this data (identity vault, RLS, AI non-training). We do not target advertising to minors. Wearable data never follows a minor's profile.
• The guardian may, at any time, export the dependent's data and, as the primary guardian, permanently delete the dependent's profile and all associated data (exams, documents, and records) — this deletion is permanent.

We adopt, in any country, a single 18-year-old threshold for a self-owned account. This requirement refers to account ownership and is not to be confused with the GDPR's age of autonomous digital consent (Art. 8, between 13 and 16 years old depending on the country). Below 18, data processing only occurs through a profile managed by an adult guardian.

Users in the United States (COPPA): MyHealth does not offer accounts to minors and does not collect data directly from children. Any minor's data is entered and controlled by a responsible adult, who exercises verifiable parental consent.

Sensitive journal unavailable to minors. The daily sensitive collection (alcohol, stress) is not performed on minors' profiles or on profiles managed by a guardian — blocked on the client and on the server. It is a feature exclusive to adult account holders (18+). Under no circumstances do we collect alcohol/stress records from minors.

12. Retention and disposal

We adopt the minimization principle: we keep each category of data only for as long as needed for its purpose or required by law. Because MyHealth is distributed worldwide, we apply the most protective standard among the applicable laws: by default, deletion erases your identity and health record, and retention is the exception, triggered only when a concrete law requires it or to enable fraud prevention and response to authorities. The only exception that survives deletion for every account is a minimum forensic index — search identifiers as irreversible codes (HMAC) + recent IPs, with no health data —, described in 12.2.

12.1 Retention periods

How identity is protected when retained: when there is a transaction and tax law requires retention, we keep the name and email encrypted (the same protection as the identity vault), in an isolated table, accessible only by the internal service (RLS, no user access), and we delete it automatically at the end of the period. We do not keep your email in readable text.

Retention of the sensitive journal. While the consent is active and the account exists, the Sensitive Health Journal records (alcohol, stress/what shaped the night) remain in your health record. When you withdraw the consent, they are deleted; when you delete the account, they follow the dual-track deletion (Section 12). There is no tax retention of this data.

12.2 Permanent account deletion (right to erasure — LGPD Art. 18, VI / GDPR Art. 17 / local equivalents)

Deletion is available directly in the app, under Profile › Privacy › Delete my account (an Apple requirement). Upon confirmation, we execute the permanent cascade removal — an immediate operation — of all of your clinical health record (lab results, conditions, medications, vaccines, documents, measurements, history, appointments, conversations with the AI, wearable data) and of the files in storage, we revoke the wearable connections, and we close your access account.

Managed dependents and guardianship migration. Deleting your account also erases the data and files of the dependents you manage (minor profiles in your care). Before completing, if a minor has another guardian already linked, the app offers to migrate that minor's guardianship to the existing co-guardian — so the minor's profile survives with them, instead of being erased. If you choose not to migrate, the dependent's profile is removed together with your account. In any case, we never retain the minor's name or email for tax reasons (see below).

The backups may, for a short period, still contain data already deleted: they are overwritten in our processor's normal cycle (Supabase, around 14 days — well within the 6 months), and the data processing agreements (DPAs) with Supabase and Anthropic govern the disposal of any residual copies. (We do not claim "key destruction" or instant backup purging.)

The deletion of your identity depends on whether or not you made a purchase:

• If you never made any purchase (subscription or packs): we also erase your name and your email (in readable text) upon deletion, and we do not create any fiscal identity record. Only the minimum forensic index described below survives (search identifiers as irreversible HMAC codes + recent IPs, with no health data), retained for fraud prevention and response to authorities — never your readable name or email.
• If you made at least one purchase: the tax/accounting law of your country requires us to keep the transaction record for a period (in Brazil, 5 years). For that, we keep a minimum accounting record and, where it is indispensable to link it to you, your encrypted name and email — isolated, accessible only upon a judicial request or that of a competent authority, and deleted automatically at the end of the legal period.

Deletion receipt (accountability — LGPD Art. 6, X): we can confirm the completion of the deletion upon request to the DPO. The deletion is not total — the minimum records below remain, by legal requirement.

Minimum forensic index that survives deletion (all accounts). At the moment of deletion, and for any account — including minors' profiles and deletions you perform yourself —, we keep a minimized forensic index, in an isolated, shielded table (no user access and no access by ordinary operations staff), containing at most: (a) irreversible codes (HMAC) of your search identifiers — email, Sign in with Apple identifier, phone, and national ID — which do not allow recovering the original value and serve only to confirm an exact match when an identifier is presented to us; (b) the IP addresses of your recent accesses; and (c) the pseudonymous account identifier (account_ref) and minimal retention metadata (creation/deletion dates, jurisdiction, and period). This index contains no health data, no readable name or email, and no content from your health record. It is pseudonymized data — it remains personal data (LGPD Art. 12 and 13), retained on the basis of Art. 16, I; we do not invoke anonymization (Art. 16, IV). Purpose: fraud prevention and response to a request from a competent authority — for example, answering "which accounts were associated with this email, Apple ID, or IP" — within the period. Legal basis: compliance with a legal obligation and exercise of rights (LGPD Art. 16, I — legal obligation to comply with an order/authority — as the primary basis for survival, Art. 7 VI — defense in proceedings — and Art. 7 IX — fraud prevention, secondary use under an LIA; GDPR Art. 6(1)(f) and Art. 17(3)(e)). Period: the applicable limitation period for exercising/defending rights and responding to authorities — set by default, as a proportionate measure, to the same duration as the fiscal retention period (5 years Brazil/US/others; 6 years United Kingdom/Canada; 10 years European Union) —, with automatic purging at the end. Access: restricted, "break-glass" type, reserved for BAS AI's top responsible person (owner), always with a mandatory reason and an immutable (tamper-evident) record of each lookup; the key that generates the HMAC codes is kept in a vault (Vault), encrypted by a root key managed outside the database, and never exposed. Accounts deleted before this version took effect do not have this index.

What always remains after deletion, for any user:

• A minimum deletion record, without any personal data and with your identity replaced by an irreversible code (which does not allow re-identifying you), only to prove that the deletion occurred.
• The minimum forensic index (described above): search identifiers as irreversible codes (HMAC) + recent IPs, with no health data, retained for the applicable limitation period (set to the same duration as the fiscal retention period) for fraud prevention and response to authorities, under audited break-glass access.
• Access logs for the 6-month retention period (12.1), provided only upon a judicial request or that of a competent authority.
• Consent records de-linked from your profile (we replace the identifier with a pseudonymous code, separated by a key that is not kept in the database), kept only as proof of lawfulness for the limitation period. We treat this as pseudonymized data, not as irreversibly anonymous data.
• Optional — research: if, and only if, you authorize it at the moment of deletion, we keep your markers in a pseudonymized way — without a name, without a profile identifier (profile_id), without free text, and without an exact date, keeping only sex, age range, and the year, in random cohorts. We treat this as pseudonymized data, and not as irreversibly anonymous data: re-identification is unlikely, but we do not declare it impossible. You may decline and still delete the account.

Dependent profiles (minors): when deleting a minor's profile, we never retain the minor's name or email for tax reasons — the tax obligation, if any, belongs to the paying guardian, not to the minor's profile. For the minor, erasure of the identity is the rule; only the minimum deletion record by irreversible code and the minimum forensic index (search identifiers as irreversible HMAC codes + recent IPs, with no health data of the minor) remain, retained for a reduced period, proportionate to the fraud-prevention purpose (never the fiscal period, which does not apply to a minor who does not transact), subject to a proportionality assessment and to the best interests of the child, under the same audited break-glass access — and subject to DPO sign-off.

Users in jurisdictions with a reinforced right to deletion (e.g., Washington — My Health My Data Act): we treat the request as deletion of consumer health data — we erase the identity and all consumer health data (without invoking the tax period against anyone who did not transact), and the disposal of residual copies at the processors occurs within 6 months, in accordance with the respective data processing agreements (DPAs). The minimum forensic index above is not consumer health data: it holds only account identifiers as irreversible codes (HMAC) and IPs, for fraud prevention and response to authorities — a distinct purpose and category from the health data, which is erased.

12.3 Deleting an exam from your health record (right to erasure, item by item)

In addition to deleting the entire account (12.2), you can remove a specific exam at any time, on the document's own screen. The app offers two options, and the difference matters:

• "Delete only the document (keep data)" — the file and the exam record go, but the data that reading recorded (markers, measurements, medications, vaccines, professionals) remain in your health record and merely stop referencing the removed file. Useful when the data is correct and you simply no longer want to keep the file.
• "Delete test and the extracted data" — what that exam recorded goes as well. Two things remain on purpose, because they stopped being a reading of the file and became a fact of yours: the appointment you have already attended and the symptom you have already confirmed.

Under either option, the readings our AI had written from that exam are deleted, and the follow-ups that were born from it are closed — the follow-up entry remains, recorded as closed and with the reason, so that your history does not lose the thread.

What happens to the file and to the record. The exam record is deleted from the database immediately and in a single operation — the entry ceases to exist; it is not a "hidden" flag. The file is removed from storage: the app removes it immediately and, if that removal fails for any reason, the server repeats it on its own, in sweeps every 15 minutes, until it is done. The file name does not survive either: it is replaced by an irreversible code, because the name is chosen by you and can, on its own, reveal the finding. (There is a distinct case: a document the app could not prepare may be deleted in a way that is reversible for a period — when that is the case, the screen itself says so in those words. The deletion described here, performed on the exam's screen, is permanent.)

The analysis of your health record stops resting on the removed exam. The next analysis is redone without the memory of the previous one: it rebuilds the conclusions from what the remaining record supports — otherwise, a finding from the deleted exam could be restated indefinitely. This rebuild is prioritized: removing an exam counts as a relevant change and enters the next sweep, which happens every few minutes; in exceptional situations (for example, when your plan's daily processing limit has already been reached) it may be postponed by a few hours. We record the moment the redone analysis is published.

Two honest caveats about that interval. First: until the new analysis is ready, the text of the previous analysis remains displayed, and it may still mention the removed exam — the file and the record, however, were gone from the very first moment. Second: if the rebuild returns no conclusions, we prefer to keep the previous reading rather than empty your health record; in that case it may reflect the removed exam until a later analysis replaces it. Earlier conversations with the assistant also remain in your conversation history until you delete them.

What remains, and why. We keep the act, never the content: the record that a removal occurred, when, who requested it, and which of the two options was chosen, with a receipt that keeps counts only — how many markers, medications, vaccines, measurements, professionals, appointments, and follow-ups were affected. We do not keep the title, the date, or any content of the removed exam, for the obvious reason that a title is already health data. This is what lets us explain the effect of the removal to you without retaining what you told us to delete (accountability — LGPD Art. 6, X; GDPR Art. 5(2)). If the exam was still being processed when you removed it, the working data from that preparation is discarded automatically within 24 hours — 30 days when the processing had ended in error, so that the failure can be investigated. The access logs — date/time, action and, when available, the IP address — never keep the exam's content and follow the period in Section 12.1.

Backups: the same conditions as Section 12.2 apply — the copies are overwritten in the processor's normal cycle and the data processing agreements govern the disposal of residual copies.

12.4 Death of the data subject

The LGPD and the GDPR protect living persons and, as a rule, do not reach the deceased (ANPD, Technical Note No. 3/2023; GDPR, Recital 27). Even so, a deceased person's health record involves personality rights that survive death (Civil Code, Art. 12, sole paragraph) and matters of succession.

• The heir does not inherit access to the content of the health record. The Superior Court of Justice (REsp 2.124.424/SP) treated health records as a non-transferable existential asset — tied to the person's intimacy, and not to their estate.
• For this reason, we do not carry out total deletion at the request of third parties (the access logs for 6 months and the tax records for 5 years still remain — 12.1), nor do we hand over the clinical content to heirs as if it were an inheritance.
• Requests related to the death of a data subject (for example, to cease processing, or measures provided for in Art. 12, sole paragraph, of the Civil Code by someone with standing) must be directed to our DPO (Section 1), upon proof of the death and of the standing of the requester. We assess each request in light of the applicable law.

12-A. Notifications and reminders (opt-in)

MyHealth may send reminders on your iPhone — about medication, a wellbeing check-in, a weekly check-in (optional, once a week — a neutral, fixed-text invitation to log what the app can't see on its own, such as activity, symptoms, or energy; it never carries health data or inference; you can turn it off whenever you like), your schedule (appointments/tests/follow-ups/vaccines), an invitation to come back to the app after a stretch without use, and a few server-side notices (when an analysis is ready, when one of your exams is updated, when a follow-up appointment is approaching, when support replies to your message, and — optional, off by default — when your data — e.g., sleep, resting heart rate — brings something new). Since version 3.12, these notices may also carry, in the body, a summary of your own health data (for example, last night's sleep and how it compares to your average, your glucose average and time in range, your activity and milestones, a lab marker's evolution, or a weekly/monthly summary) — always descriptive, on your own device, and disable-able category by category (see "Personalized summaries of your data"). Key points:

• Local notifications vs. remote push. Many notifications are LOCAL, scheduled on your own device (medication, wellbeing check-in, weekly check-in, and schedule reminders) — for those we use no push server. Others are delivered by remote push (Apple's APNs) because the event happens on the server, in six cases: (a) an analysis is ready; (b) one of your exams was updated (a marker that was out of range received a new result); (c) a follow-up appointment is coming up; (d) support replied to your message; and (e) your data (e.g., sleep, resting heart rate) recorded something new (optional, off by default — "Something new in your data"; the body never suggests abnormality or urgency); and (f) you have gone a while without opening the app and we send the neutral come-back invitation (the same wording described later in this Section; the trigger is time without opening, a usage signal, never a reading about your health) — a generic, fixed-text notice, with no PHI ("Support replied to you — tap to read"; "There's something new in your data — tap to see"), which you can turn off in Profile › Notifications. For remote push we store a technical delivery token from your device (see Section 3.4). Since version 3.12, the analysis-ready notice may name the analysis theme or panel that became ready (the health area organized), in your language; the other server notices (exam updated, follow-up appointment, support reply, "Something new in your data") remain generic, fixed text ("One of your exams was updated", "You have a follow-up appointment") — with no lab value, marker, or doctor name. Summaries with your own numbers (sleep, glucose, activity, a marker's evolution, the weekly/monthly summary) are local notifications, assembled on your own device (see "Personalized summaries of your data"). The token is a delivery identifier — it is not tracking, does not train AI, and is not shared with third parties beyond Apple's push service. To avoid bothering you, we cap this at one interruptive notice per day and respect your quiet-hours window; each category can be turned off separately in Profile › Notifications.
• Nothing fires without your iOS permission. No notice — of any type — is delivered until you allow notifications at the iPhone system prompt. That iOS authorization is the master key: you grant it once, affirmatively, and can revoke it at any time in iOS Settings.
• How each type comes configured (two groups). After you allow notifications on iOS, the neutral SERVICE reminders — medication/dose reminder, wellbeing check-in, weekly check-in, and the schedule eve (plus the stock-refill and suggested-follow-up sub-reminders), plus the invitation to come back after a stretch without using the app — come pre-enabled, so the service you set up (the medications and appointments you entered) is useful from the start; each one can be turned off individually, at any time, in Profile › Notifications. These reminders have a fixed-text, neutral body, with no health data, and the decision to deliver them rests on performing the service you asked for and our legitimate interest in a health-tracking app you chose to use, always with easy, granular opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)); the underlying health data (your medications, your schedule, your in-notice replies) remains processed under your clinical consent already given (LGPD Art. 11, I; GDPR Art. 9(2)(a)). Since version 3.12, the personalized summaries of your own non-sensitive data — sleep, glucose, activity, a lab marker's evolution, and the weekly/monthly summaries, plus the "Daily headline" — are treated as service reminders: they come on by default and can be turned off individually in Profile › Notifications (granular opt-out), under performance of the service you configured and our legitimate interest (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)); the underlying health data remains processed under your clinical consent already given (LGPD Art. 11, I; GDPR Art. 9(2)(a)). The sensitive domains (special category) — mental health, cycle/reproductive, substance (alcohol), and medication adherence — remain off by default and would only appear in a notification if you had both opted into that data category (the dedicated consent that enables it — e.g., the Health Diary, Mental health, cycle) and turned on that category's notification toggle (LGPD Art. 11, I; GDPR Art. 9(2)(a); Washington MHMDA); today, mental-health and cycle/reproductive content remain entirely out of any notification, and medication never frames a missed or late dose. The lock-screen detail exceptions you enable manually (medication name, vaccine detail, appointment detail, "time to leave") remain off by default, each under specific, prominent consent (LGPD Art. 7, I and Art. 11, I; GDPR Art. 6(1)(a) and Art. 9(2)(a)), as described in the items below. You can turn everything off at any time (in the app or in iOS Settings). On days you have doses to take, the medication reminder may also appear as a Live Activity on the lock screen and in the Dynamic Island, showing the day's progress (how many doses you've already taken), the next moment (breakfast, lunch…), and a "Took it" button to mark them without opening the app — always neutral (only the moment, the count, and the time, never the item's name or dose), on your own adult profile and this device only, and toggleable in Profile › Notifications.
• Lock-screen content (what may and may never appear). Since version 3.12, a notification may carry, in the body, a summary of your own data — for example, your sleep duration/efficiency and how it compares to your average, your glucose average and time in range, your activity versus your average, the name of a lab marker and how it changed, or a weekly/monthly summary with real numbers (see "Personalized summaries of your data"). Even so, the notification never carries a diagnosis, a disease name, a medical judgment or opinion, a cause, an efficacy claim, or urgency, nor the AI summary; and the medication, vaccine, appointment, and location details appear only if you turn on the specific options described below. All other clinical content stays inside the app only. The analysis-ready notice may state how many exams were organized (a count — for example, "3 exams") and name the analysis theme/panel, but never a marker's value. The Question of the Day may carry the question itself in the body when it comes from a closed list of everyday, non-sensitive questions (coffee, energy, hydration, a change in routine, and how your body responded to your workout — the last one in a generic form): these are fixed phrases, the same for everyone. Summaries and questions from sensitive domains (alcohol/substance, night context, stress/mental health, cycle/reproductive, medication adherence) and symptom ones appear only if you have opted into that category (see the sensitive-domains item above); otherwise, and on days when the question accompanies a complaint, the notice keeps its neutral text. Remember the lock screen can be seen by others and read aloud by Siri — that's why iOS lets you hide previews (Settings › Notifications › Show Previews: When Unlocked, or Never).
• Medication name on the lock screen (optional, off by default, per device). By default, medication reminders are neutral and never show the item's name or dose. You can choose to display the name and dosage in notifications ON THIS device — for example, "Losartan 50 mg · breakfast". This is your explicit choice: it is off by default, applies only to YOUR OWN medications, is set separately on each of your devices (turning it on on one iPhone does not turn it on on another), and can be turned off at any time, effective immediately — when off, already-scheduled reminders return to neutral. The text shows only what you entered — name, dose, and the moment/label — and NEVER the purpose, the drug class, the condition treated, interactions, or any clinical or urgency judgment. Because this displays HEALTH DATA on a surface others can see, that Siri can read aloud, and that can be mirrored to your other devices (Apple Watch, CarPlay, speakers, notification history), it relies on its own separate, highlighted consent, distinct from the clinical consent, and is not part of "Accept and continue". You'll find it in Profile › Notifications and can additionally hide previews in Settings › Notifications › Show Previews: When Unlocked. Legal basis: specific, explicit consent (LGPD Art. 11, I; GDPR Art. 9(2)(a)). Reminders from DEPENDENT (minor) profiles and from MANAGED profiles NEVER show the name or dosage on the lock screen, even when this option is on — for them the notice stays generic ("Reminder for a dependent").
• Vaccine detail in the reminder (optional, off by default — your own adult profile only). In Profile › Notifications you may enable "Show the vaccine detail in the reminder" so that your vaccine reminders — and only those — show the vaccine name and dose on the lock screen (e.g., "Tomorrow: Influenza · annual dose"). Even when on, the reminder stays an echo of your own record (the name and dose you saved): it is never a booster recommendation, an individual due-date calculation ("overdue", "due in X"), or an urgency alert, and it never shows the doctor, the location, or the reason. No other notice changes — exams, analyses, medication, and appointments stay neutral. Because a vaccine name is health data (special category / sensitive data) and can reveal a sensitive context, and because the lock screen can be seen by others and read aloud by Siri, this option is off by default, relies on your specific, prominent consent, separate from accepting the Terms (legal basis: GDPR Art. 6(1)(a) and Art. 9(2)(a); LGPD Art. 7 I and Art. 11 I), and can be turned off at any time, effective immediately; iOS still lets you hide previews. Minor and managed profiles are excluded: a dependent's vaccine reminder always stays generic ("Reminder for a dependent") and never exposes the vaccine name or the minor's name — in the child's best interest (LGPD Art. 14; GDPR Art. 8).
• Appointment detail in the reminder (optional, off by default — your own adult profile only). In Profile › Notifications you may enable "Appointment details in reminders" so that your appointment and follow-up reminders — and only those — show, on the lock screen, the professional, the time, and a short address that you entered yourself (for example, "Appointment with Dr. Silva · 2:30 PM · Av. Paulista, 1000"), together with a map of the destination (a static image of the address, generated without using your location). Even when on, the notice stays a factual echo of your own record: it never shows the specialty, the reason for the visit, or any diagnosis or clinical judgment, and it assembles the phrase only from the parts you filled in. No other notice changes — exams, analyses, medication, and vaccines stay neutral. Because this exposes health data on a surface others can see and that Siri can read aloud, this option is off by default, is set separately on each device (local preference, not synced), relies on your specific, prominent consent, separate from accepting the Terms (legal basis: LGPD Art. 7 I and Art. 11 I; GDPR Art. 6(1)(a) and Art. 9(2)(a)), and can be turned off at any time, effective immediately — already-scheduled reminders return to neutral; iOS still lets you hide previews. Minor and managed profiles are excluded: a dependent's agenda reminder always stays generic and never exposes the professional, the location, or any of that person's data (LGPD Art. 14; GDPR Art. 8). It is all 100% on your device — the professional, the time, and the address never travel over remote push. With this option on, on the day of the appointment that same detail may also appear as a Live Activity on the lock screen and in the Dynamic Island, with a countdown to the time — under the same consent and the same limits; without this option, no Live Activity is created.
• "Time to leave" alert (optional, off by default — your own adult profile only; uses your location). In Profile › Notifications you may enable "Alert me when it's time to leave" so that, on the day of an appointment or follow-up of yours that has a time and address, the app estimates your travel time to the place and sends, on your own device (a LOCAL notification, no sending server), a "time to leave" alert — for example, "Time to leave · Appointment at 2:30 PM" and "Leave by ~1:50 PM to arrive at 2:30 PM (current traffic)". To compute the route, this is the only app feature that uses your location: we request the iOS permission ("While Using the App") only when you turn this option on, and the location is used 100% on your device (via Apple Maps), solely to estimate travel time. Your location is never stored (neither on the device nor on our servers), never sent to us, and never sent to the AI — it exists only in memory, at the moment of the calculation. Because the alert shows the appointment time on the lock screen — which others can see and Siri can read aloud — the option is off by default, is set separately on each device, relies on your specific, prominent consent and on the iOS location permission (legal basis: LGPD Art. 7 I and Art. 11 I; GDPR Art. 6(1)(a) and Art. 9(2)(a)), and can be turned off at any time here in the app or revoked in iPhone Settings › MyHealth › Location, effective immediately. Minor and managed profiles are excluded (LGPD Art. 14; GDPR Art. 8). None of this travels over remote push — the calculation and the alert are 100% on your device.
• Personalized summaries of your data (on by default, disable-able; your own adult profile only). MyHealth may send, on your own device, notifications that carry in the body a summary of your own health data, so you can follow what you recorded without opening the app — for example: last night's sleep (duration, efficiency, deep sleep) and how it compares to your own average; your daily glucose average and time in range (a descriptive reading, never an alarm or a clinical threshold); your activity versus your average and milestones you reached; the name of a lab marker and how it changed over time; and a weekly or monthly summary with your real numbers. These non-sensitive summaries are on by default and each category can be turned off individually in Profile › Notifications (granular opt-out). Four safeguards: (a) iOS hides previews on the lock screen until you unlock the device (default "Show Previews: When Unlocked"; you can also choose "Never" in Settings › Notifications), so a glance at a locked phone does not reveal the content; (b) each category has its own toggle and is disable-able at any time, effective immediately; (c) they are for you, the adult account holder, on your device only — minor and managed profiles never carry health data in the notice body; (d) the text is descriptive and factual — never a diagnosis, a medical judgment or opinion, a cause, an efficacy claim, or urgency. Sensitive domains (special category) — mental health (mood, questionnaires, stress), menstrual/reproductive, substance (alcohol), and medication adherence — stay off by default and would only generate a notification if you had already opted into that data category (the dedicated consent that enables it, such as the Health Diary, Mental health from Apple Health, or cycle tracking) and turned on that category's notification toggle; today, mental-health and cycle/reproductive content remain entirely out of any notification, and medication notices never frame a missed or late dose (they are adherence memory, never surveillance). Legal basis: for the personalized service notices derived from your own data and delivered to your own device, performance of the service you configured, with granular opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)); for the sensitive (special-category) ones, explicit consent (LGPD Art. 11, I; GDPR Art. 9(2)(a); Washington MHMDA).
• Reply right from the notification. You can answer certain reminders in the notification itself (e.g., "Took all" / "So-so"). Those answers are health data (medication adherence, wellbeing) stored in your record with the same protection as your other health data; none of it appears on the lock screen.
• Minors and managed profiles: when the reminder is for a dependent's profile or for another person you manage, the notice on your device is always generic ("Reminder for a dependent") and never exposes that person's name, dosage, or any health data. The options to show a medication name or a vaccine detail on the lock screen apply only to your own records and never to those of dependents or managed profiles — this applies to vaccine reminders as well, which never display a dependent's vaccine name.
• Refill / low-stock reminder (a service reminder, alongside medication). If you record the quantity on hand of an item in your routine (a medication or supplement), the app can tell you, on your own device (a LOCAL notification, with no sending server), that an item in your routine is running low — so you can restock whenever you like. This is inventory logistics, computed on your device from data you already recorded (the quantity) and your dose schedule: we collect nothing new and it is not a clinical recommendation — it does not claim that running out is risky, suggests no abnormality, and does not tell you to restock urgently. The body is neutral, fixed text ("An item in your routine is running low. Tap to see which and plan the refill"): it never includes the item name, dose, quantity, or "days remaining" — the detail (which item, how much is left) stays inside the app only. It follows the same configuration as medication notifications (pre-enabled once you receive them, disable-able in Profile › Notifications) and fires only while those are active, with the same cap of one interruptive notice per day and the same quiet-hours window. Legal basis: performance of the service / legitimate interest for a neutral logistics reminder, with easy opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)); the underlying data under clinical consent (Art. 9(2)(a)), like the other medication reminders. On dependent profiles the minors rule applies: the notice on the guardian's device is generic ("Reminder for a dependent") and never reveals the minor's name, which item, or that it is a medication/supplement.
• Suggested follow-up reminder (a service reminder, alongside the schedule). When your health record holds a suggested follow-up from a professional (a follow-up date that you — or the reading of one of your documents — saved) and you have not yet scheduled the corresponding appointment, the app can send, on your own device (a LOCAL notification, with no sending server), a single notice that a suggested follow-up is coming up — so you can schedule it whenever you like. This is calendar organization, computed on your device from a date you already recorded: we collect nothing new and it is not a clinical recommendation — it asserts no urgency and suggests no abnormality. The body is neutral, fixed text ("A follow-up suggested at an appointment is coming up. See the details and secure your time in the app."): it never includes the doctor, the reason, the specialty, the date, or the fact that you have not scheduled it; the detail (which follow-up, when) stays inside the app only. It follows the same configuration as your calendar notifications (pre-enabled once you receive them, disable-able in Profile › Notifications), respects the cap of one interruptive notice per day and your quiet-hours window, and disappears as soon as you schedule the appointment. Dependent and managed profiles are excluded (it applies to your own profile only). Legal basis: performance of the service / legitimate interest for a neutral schedule reminder, with easy opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)).
• Invitation to come back after a stretch without using the app (a service reminder). If you go a while without opening the app (for example, around one and three weeks), it can send a neutral invitation to come back whenever you like — on your own device (a LOCAL notification) or, when the local notice cannot be scheduled (for example, you went a long time without opening the app or switched devices), by remote push from our server, with the same neutral wording (for example, "Your data misses you — the portrait is still here, just as you left it." or "Nothing is lost: your history is saved and ready to pick up where you left off."; and, for someone who hasn't added anything yet to their record, an invitation to take the first step, such as "Your record is ready to begin — upload your first test whenever you like."). What triggers this reminder is only the time since you last opened the app — an app-usage signal (engagement metadata), not a reading or inference about your health: the notice never carries health data, a number, a comparison, a judgment, or blame, and the timer resets every time you open the app. It comes with the other service reminders (pre-enabled once you allow notifications; disable-able in Profile › Notifications, alongside the local reminders). Dependent and managed profiles are excluded (it applies to your own profile only). Legal basis: performance of the service / legitimate interest for a neutral come-back invitation, with easy opt-out (LGPD Art. 7, V and IX; GDPR Art. 6(1)(b) and (f)).
• Recheck and update reminders are educational and universal. Some reminders flag that it may be time to repeat a routine test, update a record (e.g., weight), or check a follow-up/device. They are based only on generic reference intervals (e.g., routine tests are usually repeated periodically) and on the dates of your own records — we collect nothing new, and the app does not compute an individual interval from your result. They are not an individual clinical recommendation: the right interval should be confirmed with your doctor.

13. Cookies, telemetry, and tracking

• Install source (Apple Search Ads / AdServices) — no IDFA and no cross-app tracking. When you download the app after seeing one of our App Store ads, Apple makes a temporary code available to the app for about 24 hours, which our server exchanges with Apple itself for campaign data: which campaign, ad group, keyword, country, and whether it was a new download or a redownload. We store this linked to your account so we can tell which ads bring people who actually use the app — and stop spending on the ones that don't. What does NOT happen: we do not use the IDFA, we do not ask for the iOS tracking permission (ATT), we do not combine this with data from other apps or websites, we do not share it with data brokers, and there is no third party involved — it is Apple reporting on our own campaign to our own server. Apple does not give us your name, email, or a device identifier. If the download did not come from an ad, the record simply says so ("organic"). Legal basis: legitimate interest in measuring the effectiveness of our own advertising, with no advertising profile (LGPD Art. 7, IX; GDPR Art. 6(1)(f)). The record is deleted along with your account and is included in your data export.

MyHealth is a native iPhone app (not a website), so it does not use browsing cookies in the traditional sense.

• De-identified technical telemetry: we collect minimal stability and diagnostics data (crashes, errors, performance), without health content, to keep the app safe and working. This is internal processing: we do not embed any analytics SDK or any third-party tracker. As a self-limited minimization measure, we keep this telemetry for up to about 12 months (see Section 12).
• No third-party trackers with access to health data and no sale of data. We do not track across apps/sites for advertising purposes.
• App Store privacy labels: our App Store declarations reflect what is described here.

Today we do not use any third-party analytics or tracking tool; if that changes, we will update this Policy and the subprocessors page before activation, with a new notice — also reviewing the App Store privacy labels and the need (or not) for App Tracking Transparency (ATT).

14. Security incidents and notification

We maintain incident response plans. In the event of a security incident that may create relevant risk to you:

• LGPD (Art. 48): we will communicate to the National Data Protection Authority (ANPD) and to you, within a reasonable period, indicating the nature of the incident, the data affected, the measures adopted, and the recommendations for you to protect yourself.
• GDPR (Art. 33–34): we will notify the competent supervisory authority, as a rule within 72 hours, and we will communicate to you when there is a high risk to your rights and freedoms.

15. Your rights

You are the owner of your data and have rights guaranteed by the LGPD (Art. 18) and the GDPR (Chapter III):

How to exercise: many rights are exercised directly in the app (review, export, delete, revoke consent). For the others, or if something does not work, write to our DPO (Section 1). We respond within the legal period (as a rule, up to 15 days for confirmation of existence or access, under the LGPD; up to 30 days under the GDPR, extendable where the law permits).

Complaints: if you believe we process your data improperly, you can complain to the competent authority — in Brazil, the ANPD (https://www.gov.br/anpd); in Europe, the data protection authority of your country. We ask, however, that you talk to our DPO first — we want to resolve it directly with you.

16. MyHealth is NOT a medical service

• MyHealth is a tool for organizing and educating about your own health, which prepares you for the appointment with health professionals and offers a supportive educational reading by AI.
• It does NOT diagnose, does NOT prescribe treatment, and does NOT replace the assessment of a doctor or qualified health professional.
• The readings and the AI assistant's responses serve to bring questions and information to your doctor — you must always confirm with your doctor before any decision.
• MyHealth is not a medical device (it is not "SaMD") and must not be used as one.
• In an emergency, seek medical care immediately — do not use the app for that.

17. Changes to this Policy and versioning

We may update this Policy to reflect changes in the app, in vendors, or in the law. The Policy has a version (policy_version):

• The app collects your acceptance at registration, tied to the version in effect;
• We update the version and the date at the top when there is a change;
• We notify you in the app and/or by email; and, when the change requires it, we will ask for a NEW acceptance — the app requires a new acceptance when the version changes — recording it immutably in our consent record.

The version history is published at https://www.bas-ai.com/myhealth/legal/versoes; each accepted version remains archived.

18. Contact us

Questions, requests, or complaints about your data:

• Officer/DPO: dpo@bas-ai.com
• In-app support: Profile › Support — the channel for usage questions, technical issues, and requests about your account.
• Account number: you can find it under Profile; give it to support so we can locate your account faster (including if you use "Hide My Email" in Sign in with Apple).
• Controller: BAS ARTIFICIAL INTELLIGENCE LTDA — CNPJ 64.106.409/0001-70 — www.bas-ai.com — Rua Gomes de Carvalho, 911, Vila Olímpia, São Paulo/SP, ZIP 04547-003, Brazil
• Subprocessors page: https://www.bas-ai.com/myhealth/legal/subprocessadores

MyHealth — your health record, sovereign and private. This Policy was drafted in Portuguese as the basis for translation into the app's other languages (at least PT/EN/ES). In case of divergence between versions, the Portuguese prevails.