1. How We Collect Information

We may collect information about you by various means, including: – Directly from you, both online (e.g., our Services) and offline (e.g., phone call); – From your healthcare provider; – From other third-party sources and social media platforms that you may use to engage with us, as well as from partners or third parties we work with; and – By combining information from different sources, including online and offline data.

2. Types of Personal Information We Collect

When you use our Services, we may collect the following types of information:

• Account profile and health information: We collect personal information that you (or your healthcare provider) provide to us when you use our Services, including your name, email address, gender, date of birth, height, weight, health conditions, and other such information;
• Business account and usage information: If you maintain a business account with us (such as healthcare providers), we maintain business contact information and authorized user profiles, payment information, usage data regarding our Services, and other such information;
• Survey information in response to questions we may send you, including for feedback and research purposes;
• Communications between you and us, such as via email, web form, mail, phone, or other channels;
• Online User Activity described in the next section;
• Food scanner image data: When you use the food scanner feature, we collect images you submit for meal logging. These images are processed using machine learning to estimate nutritional content. You may choose not to use this feature without affecting your access to other Services. Information regarding retention of food scanner images is described in the Data Retention section of this Policy.
• Coaching session recordings and transcripts: Health coaching sessions conducted via video conference or telephone may be recorded and transcribed. You will be notified verbally at the start of each session and given the opportunity to decline recording before it begins. Your continued participation following such notice constitutes your consent to recording where permitted by applicable law. Audio, video, and transcript data are stored in our data warehouse and in the Zoom cloud environment under a Business Associate Agreement with Zoom Video Communications, Inc. Recordings and transcripts are used to support care coordination, quality assurance, and service delivery. Information regarding retention of recordings and transcripts is described in the Data Retention section of this Policy.
• IVR voice data: When you use our interactive voice response system to schedule or manage appointments, we collect audio recordings of your interactions with that system. Voice recordings are processed using AI-assisted technology. Information regarding retention of IVR recordings is described in the Data Retention section of this Policy.

As noted above, any of your personal information and health-related information that we collect or process through our Services on behalf of your healthcare provider has special protections under HIPAA and is subject to that provider’s HIPAA Notice of Privacy Practices and our business associate agreement with them.

If you provide us with information regarding another individual (including a minor), you represent that you have that any necessary authorizations and consents to give us their information and to permit us to use their information in accordance with this Policy.

3. Online User Activity, Cookies and Information Collected by Other Automated Means

Cookies are a commonly-used web technology that allow websites or apps to store and retrieve certain information on a user’s system, and track users’ online activities. We and our service providers may collect information about your use of our Services by such automated means, including but not limited to cookies, pixels, software development kits (SDKs) and other similar technologies. These tools can help us automatically identify you when you return to our Services. Cookies help us review traffic patterns, improve our Services, and determine what Services are popular.

When you use the Services, the information we may collect by automated means includes, for example:

• Usage Details about your interaction with our Services (such as the date and time of use, pages visited, features used);
• Device Information including the IP address and other details of a device that you use to connect with our Services (such as device type, model and operating system information); and
• Location information where you choose to provide the website or app with access to information about your device’s location.

If a user does not want information collected through the use of cookies on our website, most browsers allow the visitor to reject cookies, but if you choose to decline cookies, you may not be able to fully experience the interactive features our Services provide. Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, we do not respond to web browser-based DNT signals at this time. We restrict the third party collection, use and disclosure of Online User Activity that constitutes PHI, consistent with applicable laws.

4. Artificial Intelligence and Automated Processing

Minerra Health uses artificial intelligence and machine learning technologies as part of its delivery of the Services. This section describes how those technologies operate, what data they process, and your rights with respect to them.

AI-Powered Features. The Services currently include the following AI-powered features:

• MIRA: MIRA is a generative AI-powered health coaching assistant that responds to patient questions and supports your health management experience. When you interact with MIRA, your conversation content is transmitted to large language models hosted on Amazon Web Services, Inc.’s Amazon Bedrock platform, a third-party processing environment operating under a Business Associate Agreement and data processing agreement that prohibit use of your data to train the provider’s models and that impose contractual limits on the retention of your data. Specific models may change from time to time as our technology evolves. Conversation history may be retained by Minerra Health to provide contextual continuity across sessions, as further described in the Data Retention section of this Policy.
• Food Scanner: The food scanner feature allows you to photograph meals for automated nutritional analysis. Images you submit are processed by Minerra Health’s machine learning pipeline to estimate nutritional content. Retained in accordance with the Data Retention section of this Policy.
• Interactive Voice Response (IVR) Appointment Booking: Our interactive voice response system uses voice capture and AI-assisted processing to support appointment scheduling and management. Voice data is processed and retained as described in the Data Retention section of this Policy.
• Personalization: The Services use information you provide, including health risk assessment responses, wearable device data, lab results, and engagement history, to generate personalized recommendations, coaching insights, and content. This processing is automated and may influence the coaching information and supports you receive through the Services.

Ongoing risk stratification. The Services use automated processing to evaluate health-related information about you on an ongoing basis, including assessment responses, biometric and laboratory data, medication and engagement information, and, where available, claims data, in order to estimate your health risk level and to determine or adjust the care pathway and supports offered to you. This processing operates continually as new information becomes available. Where it indicates that a change to your assigned care pathway may be warranted, that change is subject to review and approval by an appropriately trained clinical or care-management professional before implementation, and is not made solely by automated means. You may contact us using the information in the Contact Us section of this Policy to request information about, or human review of, any pathway determination that affects you.

Machine Learning Training. Minerra Health does not use identifiable personal information or Protected Health Information to train artificial intelligence or machine learning models without appropriate authorization or another lawful basis permitted under applicable law. Minerra Health may use information that has been de-identified in accordance with HIPAA or other applicable legal standards for quality improvement, analytics, research, product development, and operational purposes.

AI Limitations. AI-powered features, including MIRA, are not monitored for emergency situations and should not be used to communicate urgent or emergent medical concerns. If you believe you are experiencing a medical emergency, call 911 or seek immediate medical attention. AI-generated outputs within the Services are intended to support, not replace, professional clinical judgment. Outputs from MIRA and other AI-powered features may be inaccurate, incomplete, or not applicable to your individual circumstances. You should not rely solely on AI-generated content when making decisions about your health or treatment. Clinical care delivered through the Services is provided by independent licensed healthcare providers, whose professional judgment supersedes any AI-generated content or recommendation.

5. How We Use Your Information

We use the information we collect about you or that you provide to us for purposes allowed by applicable laws, including to:

• Provide, maintain, and improve our Services, including to establish and maintain any account or user ID that is created for your use of our Services, and to process transactions or interactions, and for personalizing your experience and providing tailored content;
• Respond to your requests, questions and comments and provide customer support through email, phone and other available communications channels, and to otherwise communicate with you, including sending you updates and providing information about our Services;
• Provide you with information, products, or services that your healthcare provider, health plan, or you request from us, or other administrative notices;
• Operate, evaluate, and improve our Services, including to diagnose and improve our technology and user engagement;
• Comply with and enforce as needed applicable legal requirements, industry standards, our policies and our contractual rights;
• Monitor performance, protect the security and integrity of our Services, and support health care operations and otherwise use such information as permitted under HIPAA, as applicable; and
• For any other purpose specified at the point of collection or as described in your express authorization.

We may use and disclose non-personal, non-individual statistics or demographic information in aggregate form without restriction.

6. How We Share Information

We will not share your personal information with third parties without your consent, except in the following circumstances:

• As you direct us, such as with healthcare providers and health plans, care managers or care coordinators, and for other purposes that you specify;
• We may share information with our related subsidiaries and affiliates, subject to the terms of this Policy;
• We may share your information as permitted by law, including, for example, with third-party service providers that provide and support a technology, business, or other professional function for us (examples include IT services, maintenance and hosting of our Services, and other vendors). We only provide such vendors with information so they can perform their required functions on our behalf;
• We may disclose your information about you (i) if required by law or legal process such as a court order, (ii) when we believe disclosure is necessary to protect the rights, property, or safety of ourselves or others, or (iii) in connection with an investigation of suspected or actual fraudulent or illegal activity;
• We may transfer the information we maintain in connection with contemplated or completed merger, acquisition, sale or other transfer of some or all business assets, provided that we will make reasonable efforts to direct the recipient to use your personal information in a manner that is consistent with this Policy;
• Recording and transcription services: We share coaching session audio, video, and transcript data with Zoom Video Communications, Inc. (“Zoom”), which provides video conferencing and transcription services on our behalf. Zoom processes this data under a Business Associate Agreement and in accordance with applicable HIPAA requirements. Zoom is contractually prohibited from using your data for purposes other than delivering these services to us;
• Clinical service partners: When you are connected through the Services to telehealth consultations, prescribing encounters, or other clinical services, your information may be shared with independent licensed healthcare providers and the clinical service organizations through which they practice, so that those providers can deliver the clinical services you have requested. These providers receive only the information necessary to provide those services. Clinical providers exercise independent medical judgment and are solely responsible for clinical decisions, diagnoses, prescriptions, and treatment recommendations. They maintain their own HIPAA-compliant privacy practices, and your use of their services may be governed by their own notices of privacy practices and informed consent forms; and
• Artificial intelligence sub-processors: AI-powered features within the Services are supported by third-party technology providers. Conversations submitted to the MIRA feature are processed by large language models hosted on Amazon Web Services, Inc.’s Amazon Bedrock platform, which acts as a sub-processor under a Business Associate Agreement and data processing agreement with Minerra Health. This provider is subject to contractual limits on the retention of your data and is contractually prohibited from using your data to train its own AI models or for any purpose beyond delivering the Services to you. Minerra Health may engage additional or replacement AI technology providers that are subject to contractual privacy, security, and data-use restrictions substantially similar to those described in this Policy.

Where appropriate, we will limit sharing of your information in accordance with the choices you have provided us and applicable law.

We may disclose aggregated and/or deidentified information that does not identify an individual.

7. Your Privacy Choices

We offer you certain choices about what information we collect from you, how we use and disclose the information, and how we communicate with you.

• Cookies: Web browsers may offer users the ability to disable receiving certain types of cookies; however, if cookies are disabled, some features or functionality of our websites and mobile apps may not function correctly.
• Text messages: Some Services may allow you to enroll in our service-related text message program. If you affirmatively consent to receive text messages from us and enroll in such a program, you will receive updates via text unless you opt-out of the text message program. These messages may be unencrypted. Message frequency may vary based on the Services. If at any time you would like to stop receiving text message notifications, please text “STOP” in reply to our message, we will send you a reply message to confirm that you have been unsubscribed and you will no longer receive messages from us. If you want to join again, just sign up as you did the first time and we will start sending messages to you again. If at any time you forget what keywords are supported, just text “HELP” back to us and we will respond with instructions on how to use our service as well as how to unsubscribe.
• Marketing emails: We will not use your PHI for marketing except as permitted by HIPAA, such as with your written authorization. If you wish to opt out of receiving any marketing emails or other such communications from us, please notify us as provided below. You may choose not to receive marketing emails from us by clicking on the unsubscribe link in the marketing emails you receive from us.
• Patient records: You are entitled under HIPAA to exercise certain rights regarding your PHI, such as access to patient records. Certain information will be available to you when you log in to the Services and access your account, but for more information, please see your applicable HIPAA Notice Of Privacy Practices and/or contact your healthcare provider.
• Account: If at any time you wish to delete your account, along with its associated data, you can log into the Minerra Health app and request its removal. Please note we may retain any data to the extent required by law.

8. State-Specific Notices

Certain states provide rights to individuals and households regarding the collection and use of personal information by businesses subject to applicable state law. This section summarizes your rights in states where Minerra Health’s Services are available. These rights do not apply to your Protected Health Information, which is governed by HIPAA and your applicable HIPAA Notice of Privacy Practices.

California. California residents have rights under the California Consumer Privacy Act and its amendments, including the right to request that we: (i) provide a copy of the personal information we maintain about you; (ii) correct or delete personal information we maintain about you, subject to certain exceptions; or (iii) not sell or share personal information about you to a third party, excluding qualified service providers. We do not use sensitive personal information except for the reasons described in this Policy. Except for the ongoing risk stratification described in the Artificial Intelligence and Automated Processing section of this Policy, we do not engage in individual profiling based on personal information within the scope of California law.

Colorado, Connecticut, Virginia, Texas, and Oregon. Residents of Colorado, Connecticut, Virginia, Texas, and Oregon have rights under their respective state privacy laws with respect to personal information that Minerra Health processes about them. Depending on your state of residence, these rights may include the right to: (i) access the personal information we hold about you; (ii) correct inaccurate personal information; (iii) request deletion of your personal information, subject to applicable exceptions; (iv) obtain a portable copy of your personal information in a machine-readable format; (v) opt out of the processing of your personal information for purposes of targeted advertising or certain profiling; and (vi) appeal a decision we make in response to a privacy rights request. To submit a request or initiate an appeal, contact us using the information provided in the Contact Us section of this Policy. We will respond to verified requests as required by applicable law and will not discriminate against you for exercising these rights.

Washington and Nevada. Washington’s My Health My Data Act and Nevada Senate Bill 370 provide additional protections for consumer health data. To the extent these laws apply to data we collect about you, you may have the right to access your consumer health data, to withdraw consent to its collection or sharing, and to request its deletion, and we will not sell such data without your valid authorization. To exercise any right that applies to you, contact us using the information provided in the Contact Us section of this Policy.

It can be unlawful to discriminate against an individual for exercising rights under applicable state privacy law. You can submit requests to us via the contact information provided below, and we will endeavor to fulfill any obligations that are legally required. Please note that your PHI is not subject to state consumer privacy laws and is instead governed by HIPAA, as detailed in your applicable HIPAA Notice Of Privacy Practices.

9. Links to Other Websites and Third-Party Content

Our Services may contain links to other websites or apps. Please be aware that we are not responsible for the content or privacy practices of such other websites or apps, and we encourage you to be aware when you leave our Services and to read the privacy statements of any other website or app that collects personal information.

10. How We Protect Information

We implement reasonable administrative, technical and physical security measures designed to protect your personal information from unauthorized access, use, or disclosure. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee the absolute security of your information. We will make any legally required disclosures in the event of any compromise of personal information. To the extent the law allows us to provide such notification via e-mail or conspicuous posting on the Services, you agree to accept notice in that form.

11. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, to provide the Services, to comply with applicable legal, regulatory, contractual, clinical, and operational requirements, and as otherwise directed by your healthcare provider where applicable.

The following minimum retention periods apply to certain categories of data collected through AI-powered and session-based features:

• Food scanner images: Food scanner images are retained for no less than seven (7) years following the date of capture, where required by applicable legal, contractual, clinical, or operational requirements. Following expiration of the applicable retention period, such images may be deleted or de-identified in accordance with applicable law and Minerra Health’s data governance practices.
• Coaching session recordings and transcripts: Audio recordings, video recordings, and transcripts generated during health coaching sessions are retained for no less than seven (7) years where required by applicable legal, contractual, clinical, or operational requirements. Data stored by third-party service providers, including Zoom Video Communications, Inc., is governed by the applicable contractual agreements and Business Associate Agreements in place with such providers.
• IVR voice recordings: Voice recordings captured through the interactive voice response system are retained for no less than seven (7) years where required by applicable legal, contractual, clinical, or operational requirements.

Minerra Health may retain information for longer periods where required by law, litigation hold requirements, regulatory obligations, contractual commitments, fraud prevention, security purposes, or other legitimate business needs.

The recording and transcription practices described in this Policy apply prospectively from the effective date of this Policy. For coaching sessions recorded before that date, the notice and consent practices in effect at the time of the recording will govern.

12. Healthcare Providers

If you (on behalf of yourself or your organization) are a healthcare provider under a contractual relationship with us to use these Services in connection with your practice, we may collect your business contact information and other data regarding your use of our Services for analytics, marketing or promotional activities, to the extent permitted by law and our contractual relationship. This may include advertising products or services that may be of interest to you. In addition to communicating with you regarding your and your patients’ use of the Services, we may from time to time contact you to provide announcements, alerts, surveys, or other marketing or general communications. In order to improve our Services, we may be notified when you open an email from us or click on a link therein.

13. Children’s Privacy

Our Services are not intended for users under the age of 13 and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information as soon as possible.

14. International Data Transfers and Use

Our Services are controlled and operated by us from the United States, and are not intended to subject us to the laws or jurisdiction of any other country or jurisdiction. Any information you provide through use of the Services may be stored and processed, transferred between and accessed from the United States and other countries which may not guarantee the same level of protection of personal information as the one in which you reside. However, we will handle your personal information in accordance with this Policy regardless of where your personal information is stored or accessed.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Your continued use of our Services after the posting of the revised Privacy Policy constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions, concerns or comments about this Privacy Policy, our privacy practices, or if you would like us to update information or preferences you provided to us, please contact us by mail to Minerra Health Inc., 2625 Middlefield Road, Number 470, Palo Alto, CA 94306 or via email to info@minerrahealth.ai.