Consumer Health Data Privacy Policy

"Consumer health data" is personal information that identifies a consumer's past, present, or future physical or mental health status. When you use Finch Health, we collect the following categories, only to the extent you enter, upload, or connect them:

• health conditions, symptoms, and check-in or questionnaire answers;
• bodily measurements and function data, such as weight, body composition, blood pressure, blood glucose, heart rate, body temperature, oxygen saturation, respiratory rate, hydration, sleep, and activity and exercise data;
• medications and treatment or care-plan information;
• health documents and lab results, and the values extracted from them;
• progress photos, and photos, videos, and voice messages sent to your care team;
• appointments and messages with health care providers; and
• inferences we derive from the above, such as your wellness score and Finch AI insights.

We collect and use this data to provide the features you request, to connect you with the providers you choose, to keep your account and data secure, to respond to your requests, and to comply with the law. We do not use it for advertising.

• You, when you enter information, upload documents, or send messages;
• your devices and health platforms, such as Apple Health and Android Health Connect, when you grant permission;
• health care providers and organizations you connect with in Finch Health; and
• our own systems, which generate inferences such as your wellness score and Finch AI insights.

We share the categories listed above only as follows:

• with the health care providers and care teams you choose to connect with, and only what you choose to share;
• with the service providers listed below, which process it for us to run the Service;
• with your employer, as group statistics, if you redeem a company license and consent to it (groups of 5 or more people only, never your individual data); and
• where required by law or valid legal process.

We do not sell consumer health data. No advertising or analytics tag receives it, and we do not use a geofence.

• Supabase, which hosts our database, authentication, and file storage (cloud hosting service provider);
• AI service providers, which process the minimum information needed for Finch AI features;
• Health care providers and care teams you connect with, as you direct;
• Your employer, as group statistics, if you redeem a company license, with your consent and only for groups of 5 or more people; and
• Affiliates: none. No affiliate receives consumer health data.

Our payment, email, website-hosting, rate-limiting, and push-notification providers do not receive your consumer health data. To receive the complete list of third parties and affiliates with whom your data has been shared or sold, with their contact information, use the request process below.

Depending on your state, you have the right to confirm whether we are collecting, sharing, or selling your consumer health data and to access it, including a list of all third parties and affiliates with whom we have shared or sold it and their active email addresses or another way to contact them. You also have the right to withdraw consent you have given us, and to have your consumer health data deleted.

To make a request, email privacy@finch.health or use the export and account-deletion options in the app. We will confirm your identity before acting. We respond within 45 days of receiving your request. That period can be extended by another 45 days when reasonably necessary, and we will tell you if we extend it. When we delete data, we delete it from our active systems. Information we must keep by law, or that is protected health information held for a health care organization under HIPAA, is handled as the law requires. A closure request disables sign-in and can be cancelled for 30 days. After that, account and personal-wellness data that is not part of a medical or regulatory record is removed from active systems, targeted within about 31 days of the request. Copies in backups age out within up to 90 days. Clinical records are kept for ten years from the last clinical activity. Audit, consent, and disclosure-accounting records are kept for seven years.

Appeals. If we decline your request, you may appeal by emailing privacy@finch.health with "Appeal" in the subject line. We respond to an appeal within 45 days with a written explanation of the outcome. If your appeal is denied, you may contact the attorney general of your state.

Questions about this policy: privacy@finch.health. Contact is by email only.