Privacy Policy

1Information we collect

Information you give us

• Account information, such as your name and email address.
• What you tell the Service, such as your conversations with the assistant, notes, and symptoms, measurements or other values that you record or that the assistant records from your conversations.
• Messages to us, such as support requests and feedback.

If you use dictation, your iPhone transcribes your speech on the device where it can. Where it can’t, iOS may use Apple’s speech recognition service, under Apple’s privacy policy.

Health records you connect

When you connect a healthcare provider, you sign in on your provider’s or our connectivity partner’s secure sign-in page and authorize us to retrieve your records. Evyrix never sees or stores your patient portal password. Some providers require you to verify your identity, for example with a photo ID and a selfie, through our partner’s identity-verification provider. Evyrix doesn’t receive those images.

Depending on the provider, your records can include conditions, medications, allergies, lab and test results, vital signs, immunizations, procedures, visits, clinical notes, and the names of your clinicians and care locations.

Information collected automatically

When you use the Service, we collect limited technical information, such as your device type, operating system, app version, IP address, and logs of errors and requests. We design these logs to exclude the content of your records and conversations.

2Where your information is kept

Evyrix keeps as much as it can on your device. Your health records, conversations, notes and logged values are stored on your iPhone in an encrypted database, protected by a key held in your device’s secure keychain. We don’t keep copies of them, except for the parts sent to the AI assistant to answer your questions or prepare summaries and follow-ups, as described in The AI assistant.

Our servers handle your account, retrieve records from the providers you connect, and send requests to the AI assistant. Health information passes through our servers only as long as needed to do that.

We don’t offer backup yet. Until we do, information stored on your device can’t be recovered if you lose the device or delete the app.

3How we use information

• To provide the Service: retrieving and organizing your records, building your health history, answering your questions, and telling you when something new arrives.
• To keep the Service safe and working: authenticating you, preventing fraud and abuse, and diagnosing problems.
• To improve the Service: using information about how the Service performs, such as error rates and response times. When we evaluate the quality of the assistant’s answers, we use synthetic records, not yours.
• To communicate with you: about your account, security, and changes to the Service or this policy.
• To meet legal obligations and enforce our Terms of Service.

We don’t use your health information for advertising or marketing. We don’t use personal information to train AI models, including large language models, and we don’t use it for profiling that leads to legal or similarly significant decisions about you.

4The AI assistant

To answer a question, the assistant sends an AI model your question, your conversation so far, your health records, and the notes and values you’ve logged. It also uses the model on its own to prepare things for you, like summaries of what’s new and follow-ups your clinicians asked for. We check each response against your records and show the records it’s based on, but these checks can miss errors.

The AI model is run by one of our service providers. Before any real health information is sent to an AI provider, we require that provider, by contract, to use it only to generate responses for you, not to train its models on it, and to keep zero data retention, except where the law requires otherwise.

The assistant can make mistakes. It provides information, not medical advice. See our Terms of Service.

5How we share information

We don’t sell your personal information, and we don’t share it for targeted advertising. We share information only in these situations:

• With service providers that help us run the Service, such as our connectivity partner, cloud hosting, AI model providers, email delivery and push notification delivery. They may use information only to provide services to us, under contracts that limit their use of it to providing those services and require them to protect it.
• When you ask us to, with your authorization, for example if you choose to connect another app or service to your Evyrix record.
• For legal reasons, when we believe in good faith that disclosure is required by law or legal process, or necessary to protect someone’s safety. Where the law allows, we’ll tell you about a request for your information.
• In a business transfer, such as a merger or acquisition. Any successor must honor this policy for the information it receives, and we’ll notify you before your information becomes subject to a different policy.

Tracking

We don’t let third parties collect information about your activity over time or across other sites or apps through the Service. Our website doesn’t use cookies, analytics or advertising trackers. Because we don’t sell your information or use it for targeted advertising, Do Not Track and Global Privacy Control signals have nothing to turn off. Where the law requires, we treat them as a request to opt out.

For consumer health data, we share only as described in our Consumer Health Data Privacy Policy.

6Your choices and rights

• Access. You can see your information in the Service, and ask us for a copy of the information we hold on our servers.
• Correction. You can update your account information at any time. Records from a provider reflect what that provider holds, so corrections to them are made by the provider. We’ll help you find who to contact.
• Disconnection. You can disconnect a provider at any time, and choose whether to keep or delete the records it sent.
• Deletion. You can delete your account, along with your records and conversations, at any time.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time.

Depending on where you live, you may have additional rights under state law. To make a request, use the settings in the app or email privacy@evyrix.com. You can also use an authorized agent. We’ll verify your identity before acting on a request and respond within 45 days. If we need more time, we may extend this once by 45 days and will tell you why.

If we decline a request, you can appeal by replying to our decision, and we’ll respond to your appeal within 45 days. If we deny your appeal, you can contact your state attorney general, for example in Washington at atg.wa.gov or in Connecticut at portal.ct.gov/ag. We won’t treat you differently for exercising your rights.

7How long we keep information

Information on your device stays there until you delete it or delete the app. Information on our servers, such as your account and records passing through on their way to your device, is kept only as long as needed to provide the Service. Error and request logs, which are designed to exclude the content of your records and conversations, are kept for up to 30 days.

When you delete your account, we delete your information from our systems within 30 days, remove it from our server backups within 90 days, and tell our service providers to delete it too, unless the law requires us to keep some of it.

8Security

We protect your information with administrative, technical and physical safeguards, including encryption in transit, encryption of the information stored on your device, and access limited to the people and systems that need it to provide the Service. No system is perfectly secure. If a breach affects your information, we’ll notify you as required by law, including the Federal Trade Commission’s Health Breach Notification Rule.

9HIPAA

Evyrix isn’t a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA), so HIPAA doesn’t apply to your Evyrix account. Other laws do, including the Federal Trade Commission’s Health Breach Notification Rule and state health privacy laws, and we protect your information as described in this policy.

10Consumer health data

Washington, Nevada and some other states have laws that protect consumer health data. Our Consumer Health Data Privacy Policy explains how we collect, use and share it, and how to exercise your rights under those laws.

11Children

The Service is for adults 18 and older. We don’t knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we’ll delete it.

12Where we process information

The Service is offered in the United States, and we store your information in the United States. Our providers may process limited technical information, such as website requests, elsewhere.

13Changes to this policy

We review this policy as the Service develops and update it when our practices change. If we make a material change, we’ll tell you in the app or by email before it takes effect, and we’ll ask for your consent where the law requires it. We won’t apply a material change to information we already hold without your consent. The effective date at the top shows when this policy last changed.

14Contact us

Questions or requests about privacy: privacy@evyrix.com