Privacy Policy

This policy applies to the Finch Health websites (including finch.health) and the Finch Health patient and provider apps (together, the "Service"). The Service is offered in the United States. The company that operates it is Finch Health LLC ("Finch Health," "we," or "us"). Contact is by email only, at privacy@finch.health.

Some information we handle is protected health information ("PHI") under HIPAA when a healthcare provider or organization uses Finch Health for its patients. How that works is explained in Health information and HIPAA. Where this policy and a written agreement with your healthcare organization differ for PHI, the agreement controls.

Depending on the features you use, we collect:

• Account information: name, email address, role (patient, provider, or organization user), sign-in credentials managed by our authentication service, and profile details you add.
• Health and wellness entries: measurements, goals, check-ins and questionnaires, medications you record, and progress photos you choose to add.
• Connected-device data: if you grant permission, data read from Apple Health or Android Health Connect, such as steps, heart rate, blood pressure, blood glucose, weight, body composition, body temperature, oxygen saturation, respiratory rate, hydration, sleep, and exercise and activity data. You choose the categories in your device's permission screen and can revoke them there at any time.
• Documents: health documents you or your provider upload, such as lab reports, and the results we extract from them.
• Messages and appointments: messages, photos, short videos, and voice messages you send to your care team, and your appointment details. The camera and microphone are used only when you choose to send media.
• Payment metadata: for paid plans, payments are handled by Stripe. We store your plan, subscription status, and Stripe identifiers. We do not store your card number.
• Device and usage information: device type, app version, push-notification tokens, session records for security, the time the app spends in the foreground, and a small set of first-party product-usage events that carry no health values (for example, that a lab-results screen was opened).
• Contact requests and leads: your name, email address, and role if you join a waitlist or contact form, and the messages you send to support.

If you use Face ID or fingerprint unlock, your device performs the check. We do not receive your biometric data.

We use information to:

• create and secure your account and authenticate you;
• deliver the features you request, such as your wellness score, device sync, messaging, appointments, and documents;
• connect you with the providers you choose and let them see what you share with them;
• operate billing and subscriptions;
• send service messages and notifications;
• prevent fraud and abuse, keep audit records, and respond to support requests;
• understand, at an aggregate level, whether features work; and
• meet legal obligations.

We do not use health information collected through the apps for advertising, and we do not use data read from Apple Health or Health Connect for advertising or sell it.

Finch AI features, such as wellness insights, document analysis, and provider decision support, process the minimum information needed for the request. That processing is done by our AI service providers.

Finch AI is an informational support tool. It is not emergency care and does not replace a qualified clinician. Its output can be incomplete or wrong and should be reviewed with a professional before you act on it.

We share information only as described here.

• Service providers that process data for us under contract and only for the Service: Supabase (hosting, database, authentication, and file storage), Vercel (website hosting), Stripe (payments), AI service providers (Finch AI), Upstash (abuse and rate limiting), Brevo (marketing email and lead lists), and Expo, Apple, and Google (push notification delivery, which carries generic text without health details).
• Providers and care teams you connect with. When you accept a connection, that provider can see the information you choose to share. You can end a connection in the app, which stops live access.
• Your employer, as group statistics, if you redeem a company license. When you redeem a license from your employer or another organization, and only with the consent you give at that step, the organization sees whether your license is in use (active in the last 30 days) and group statistics for groups of 5 or more people. It never receives your individual health information or your patients' data. You can stop sharing with that organization at any time in your account settings; your license stays active.
• Legal and safety. We may disclose information when required by law or valid legal process, to protect someone's safety, or to defend our rights, limited to what is necessary.
• Business changes. If Finch Health is involved in a merger, acquisition, or sale of assets, information may transfer subject to this policy's protections and applicable law.

Push notifications carry generic text and, at most, a minimal opaque reference used to open the right screen. Names, health values, document contents, and message text are not sent to the push-notification services or written to our operational logs.

HIPAA applies to Finch Health only in some situations, and this notice does not claim that every feature or customer relationship is subject to HIPAA.

• Our role. When a healthcare provider or organization that is a HIPAA covered entity uses Finch Health for its patients, Finch Health acts as its business associate. PHI is then handled under our business associate agreement and that organization's instructions.
• Permitted handling. We use and disclose PHI to provide the requested services, to support treatment and operations authorized by the covered entity, to secure the platform, to meet legal duties, and to investigate incidents. We do not use PHI for unrelated advertising or sell it.
• Safeguards. We use administrative, technical, and physical safeguards appropriate to the Service, including role-based access, encryption, audit and access records, workforce controls, and vendor review.
• Your rights. Rights to access, amend, restrict, or receive an accounting of disclosures of PHI generally need to be exercised through the covered entity responsible for your care. We support them as the entity directs. Contact privacy@finch.health if you are unsure who to ask.
• Health information outside HIPAA. If you use the patient app on your own, without a healthcare organization, the information you enter is generally not PHI. It is still protected by this policy, by the state consumer health privacy laws described in the Consumer Health Data Privacy Policy, and by the breach rules described under Security.
• Questions and complaints. Contact privacy@finch.health. You may also contact the healthcare organization responsible for your care, or file a complaint with the US Department of Health and Human Services Office for Civil Rights. We do not retaliate against anyone for a good-faith privacy complaint.

Some US states, including Washington, Nevada, and Connecticut, regulate "consumer health data" that is not PHI. Our separate Consumer Health Data Privacy Policy explains what we collect, why, who receives it, and how to exercise your rights under those laws.

The Finch Health website uses cookies and similar browser storage that are necessary to keep you signed in, protect your account, and complete checkout. The apps use secure on-device storage for your session.

Our product analytics are first-party and limited by design: a short, fixed list of events with no free text, health values, document names, or search terms. We do not use a third-party analytics or advertising SDK in the patient or provider apps.

The public marketing pages (the home page and blog) can load a tag manager that Finch Health staff manage. Product analytics on the site is allowed. We do not use third-party advertising. No tag manager is loaded on this page or on the legal pages.

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws), you may have the right to:

• know and access the personal information we hold about you, and receive it in a portable format;
• delete personal information, subject to legal exceptions described under Retention below;
• correct inaccurate personal information;
• opt out of the sale of personal information, its sharing for cross-context behavioral advertising, and targeted advertising or profiling;
• limit our use of sensitive personal information (which includes health information) to what is needed to provide the Service;
• appeal a decision on your request; and
• be free from discrimination for exercising these rights.

How to submit a request. Email privacy@finch.health with the right you want to use and the email address on your account. You can also request an export or account deletion from inside the app. We will ask you to confirm your identity, using information we already hold where possible, and we will not ask you to send health records or payment-card numbers by email.

Authorized agents. You may use an authorized agent. We will ask for proof of the agent's authority and may confirm the request with you directly.

Timing and appeals. We respond within the period set by your state's law, generally 45 days, which can be extended once when reasonably necessary, and we tell you if we do. If we decline your request, you can appeal by replying to our decision or emailing privacy@finch.health with "Appeal" in the subject. We answer appeals within the period your state requires. If you are still not satisfied, you may contact your state attorney general.

PHI held for a healthcare organization is governed by HIPAA, and requests for it go through that organization.

You can request an export of your data or close your account from the app. A closure request disables sign-in and starts a 30-day period during which you can cancel the request. After that period, account and personal-wellness data that is not part of a medical or regulatory record is removed from active systems, targeted within about 31 days of the request. Copies in backups age out within the backup window, which is up to 90 days.

Some records are kept after your login is disabled because the law or healthcare standards require it. Our conservative baseline for adult US patient accounts is: clinical records (such as health documents, notes, care plans, appointments, and provider conversations) for ten years from the last clinical activity, and audit, consent, and disclosure-accounting records for seven years. The longest period that applies to a particular record, including a legal hold, controls. Retained records are restricted and are not described as erased. Provider and organization accounts are closed on request through privacy@finch.health.

The account-closure processor for policy RET-US-HIPAA-1.0 is what carries out that deletion. It is fail-closed: it does not delete records unless the policy is explicitly enabled and the configured version matches the deployed version. The software ships with that switch off.

Our safeguards include access controls and row-level data isolation, encryption in transit and at rest (health documents use additional document-level encryption), audit logging, least-privilege operations, and incident-response procedures. No system can guarantee absolute security.

If a breach involves PHI that we handle as a business associate, we notify the affected covered entity as the HIPAA Breach Notification Rule and our agreement require, and that entity notifies you. For health information that is not covered by HIPAA, the FTC Health Breach Notification Rule requires us to notify affected people, and in some cases the FTC and the media, without unreasonable delay and no later than 60 days after discovery. State breach laws may add requirements, and we follow them.

Please report a suspected security issue to security@finch.health.

The minimum age to use the Service is 16. The Service is not directed to anyone under 16, and we do not knowingly collect personal information from them. If you believe someone under 16 has given us information, email privacy@finch.health and we will delete it. The product enforces this minimum age: a date of birth under 16 is rejected.

If you join a waitlist or ask to hear from us, we may send marketing email. Every marketing email includes a working unsubscribe link, and we honor opt-outs promptly, as the CAN-SPAM Act requires. Service emails, such as password resets and billing notices, are not marketing and continue while you have an account.

We may update this policy. When we make a material change, we will update the effective date above and give notice in the app or by email before the change applies to information we already hold, as the law requires.

Privacy questions and rights requests: privacy@finch.health. Contact is by email only.