NeuraVate Consumer Health Data Privacy Policy

1.1. This policy applies to the consumer health data of:

• Washington residents, and consumers whose consumer health data is collected in Washington, under the My Health My Data Act (MHMD, RCW 19.373) — our strictest baseline, applied as the operating standard for this policy;
• Nevada residents under SB 370 (NRS 603A consumer health data provisions);
• California residents, as a supplement to our Privacy Policy for CCPA/CPRA purposes (section 9, including sensitive personal information); and
• residents of other US states with comparable health-privacy laws, to whom we extend the same treatment.

1.2. Why these laws apply to us. Our consumer service is offered directly to you, not through a hospital or insurer. We are not a HIPAA covered entity and not a business associate (see our HIPAA Posture Statement, hipaa-notice-posture). Data outside HIPAA is exactly what MHMD, SB 370, and the CPRA's sensitive-data rules were written to protect — so they, and this policy, apply in full.

1.3. This policy uses the same category names as our Privacy Policy (privacy-policy). Where this policy gives you more protection than the Privacy Policy, this policy controls for consumer health data of the states above.

2.1. "Consumer health data" means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status. Mapped to our categories:

• Health and implant information you enter: your devices and implants (type, manufacturer, model, implant date, MRI status, safety flags, emergency instructions), the check-up dates you add to your plan for them (what each check-up is, the date you enter and whether it is done), allergies, medical conditions, blood type, advance directive (DNR status and document reference), emergency contacts, and notes.
• Information identifying you as seeking health services: holding a NeuraVate account at all reasonably signals that you live with an implanted or assistive medical device. We treat your account information (email, first name, last name) as consumer health data to the extent it carries that inference, and the same goes for an order for a printed card.
• Emergency-page access records and technical records about access to your health information, which we treat with the same care because they refer to it.
• Messages you send us, where you include health information in them.

2.2. What we do not collect — stated plainly:

• No precise geolocation. We do not collect precise location at all, so we cannot and do not use location to infer anything about your health or your visits to health facilities. The only location-related information we hold is a country derived from the network address of your sign-up request, used only for the age check.
• No biometric identifiers. The Service does not collect fingerprints, face data, or any other biometric information. If you turn on the app lock in a version of the NeuraVate.ai app that offers it, your phone checks your face or fingerprint itself and tells the app only whether the check passed, so no biometric information reaches the app or us (privacy-policy section 6.8).
• No medications, and no gender-affirming-care or reproductive-health categories. The launch Service has no field that asks for medications, and none that asks for or classifies gender-affirming-care or reproductive-health information. Honest caveat: your conditions and notes are yours to write and could contain anything you choose to enter. If you enter such information, it gets the same protection as all other consumer health data under this policy, and the same strict limits — we never use it for advertising, inference, or disclosure beyond your instructions.
• Date of birth IS collected at sign-up, and it is required, only to confirm you are 18 or older. It is never published on the emergency page, is not used for advertising, inference, profiling or any other purpose, and is deleted with the account. See privacy-policy section 6.1.
• No consumer health data of minors. The Service is for adults only: we refuse a sign-up from anyone under 18 and offer no guardian pathway. If we learn an account belongs to someone under 18, we delete it. See terms-of-service section 3 and privacy-policy section 14.

We collect consumer health data from one source: you, when you enter it in the app, buy a printed card, or write to us. We do not buy, license, or otherwise acquire consumer health data from anyone else.

4.1. Purposes. We collect and use consumer health data only to: provide the Emergency Passport and the emergency link you set up; make and post a printed card you order; keep the service secure and record access to your information; answer your support and rights requests; and comply with law. We do not process consumer health data for any other purpose, and we collect no more than is reasonably necessary for these.

4.2. Separate consents (MHMD). Consistent with MHMD, we obtain:

• a consent to collect your consumer health data — its own unticked box at sign-up, separate from accepting the Terms of Service and from acknowledging the Privacy Policy; and
• a separate consent to share it — given when you switch on emergency sharing for your link, which is the only sharing the Service does (to whoever holds your card or link).

Neither is pre-ticked or bundled, and each can be withdrawn as easily as it was given (section 6.2).

4.3. No sale. No ads. We do not sell consumer health data. Under MHMD, a sale would require a separate, signed authorisation naming the buyer — we do not seek and will not seek such authorisations. We show no advertising and do not use consumer health data for any advertising or marketing purpose.

5.1. Affiliates: none. We have no affiliated companies that access consumer health data. If that changes, this policy is updated before any affiliate receives consumer health data.

5.2. Recipients you choose: anyone you give your emergency card or link to (see privacy-policy section 5 for exactly what the emergency page shows and leaves off). At launch there is no other sharing — no caregiver, clinician, or organisation receives your data through the Service.

5.3. Processors (service providers) acting under contract and only on our instructions — full versioned list in our Subprocessor Register (subprocessor-register): Hetzner (Hetzner Online GmbH, Falkenstein, Germany — the server our databases and sign-in system run on, so the consumer health data in your account is stored in Germany); Cloudflare (network, security and DNS — every request to our sites passes through it); Resend (automatic service email: email verification and password reset; Resend, Inc. is a US company, and our emails are sent through Amazon SES in its Tokyo region, Japan); Migadu (Migadu-Mail GmbH, Switzerland, with mail servers in France and Germany — email hosting for our support, privacy and other addresses and the mailbox where we read and answer your emails: it stores the emails you send us and our replies); and Backblaze (encrypted backup storage, in its EU Central region in Amsterdam, the Netherlands). Stripe processes payments for the printed card: card data goes to Stripe directly and never touches our systems, and Stripe keeps the order records (name, email, shipping address, your account ID or the emergency link you typed in, what you bought) in our Stripe account. The postal or courier service that delivers a printed card receives your name and shipping address. No analytics vendor has access — none is used. Apple and Google are not our processors, including if you get the NeuraVate.ai app from Apple's App Store or Google Play, and the app shares no consumer health data with them (privacy-policy section 6.8).

5.4. No geofencing. We do not use geofencing at all — around health care facilities or anywhere else — to identify, track, or collect data from consumers, or to send notifications or messages.

Residents of Washington and Nevada (and other states whose laws grant equivalent rights) may:

6.1. Access your consumer health data — including confirmation of whether we collect, share, or sell it (we do not sell it), and a list of all third parties and affiliates with whom we have shared it, with an active email or online contact for each. Because the only sharing is your own emergency link, this list is the processors in section 5.3, plus Stripe and the postal or courier service if you bought a card.

6.2. Withdraw consent — for collection, for sharing, or both — at any time, as easily as you gave it. Switch off emergency sharing in the app to withdraw consent to share. To withdraw consent to collect, email [email protected]; because we cannot keep a passport without it, that leads to deletion unless you tell us otherwise.

6.3. Delete your consumer health data. Email [email protected]; we delete it by hand and confirm within 45 days. Deleting removes your sign-in account, your passport, your emergency link and your live consent records, and your emergency page and any printed cards stop working. A few records we must or may keep — which versions of our documents you accepted, the history of your consent choices, access and security records (including the record of each time your emergency page was opened), and tax records of what you bought — are kept under a pseudonym for 7 years, and a note that your account was deleted is kept without a time limit so that nothing can recreate your data; privacy-policy section 12.3 says what each period runs from and why. MHMD's deletion right also reaches archives and backups. Our database backups are encrypted, and each backup is kept for 30 days and then deleted automatically, so a copy made before your deletion is deleted with the backup that holds it. We never restore a deleted account from a backup: if we must restore one after a failure, we first re-apply by hand every deletion made since that backup was taken, before the service is used again. We also ask our email-delivery provider (Resend) to delete its records of the emails it sent you, and we delete your earlier emails from our mailbox at Migadu, keeping only your request and our answer as the record that we handled it. The copy of your passport that the NeuraVate.ai app keeps on your phone is deleted the first time the app renews your sign-in after the deletion (privacy-policy sections 6.8 and 12.3). Stripe keeps its own records of your card payments as an independent controller. If you ordered a printed card, we write to Stripe asking it to delete or redact your details (your name, email address, shipping address, and your account ID or the emergency link you typed in) from each card payment we find under your email address or your account ID, except what it must keep; Stripe decides what it keeps. Ordering a card creates no customer record in our Stripe account, so there is none for us to delete.

6.4. Non-discrimination. We will not deny you the service, charge you a different price, or degrade quality because you exercised any right. (The emergency features are free and never conditioned on consenting to anything optional.)

6.5. Authorised agents. You may use an authorised agent to submit any request on your behalf; we will check the agent's authority and confirm with you at the email address on your account, then proceed.

7.1. Submit a request to [email protected] from the email address on your account (or switch off sharing and edit your passport in the app). Because the sender of an email can be faked, we then write to the email address stored on your account — never to a different address a request comes from or asks us to reply to — and act only when you confirm from that mailbox; everything we send about the request goes only to that address. Exercising rights is free (MHMD allows limited fees only for repetitive requests within 12 months; we do not charge them).

7.2. Response times: Washington requests — within 45 days, extendable once by a further 45 days where reasonably necessary (we will tell you within the first 45). Nevada requests — within 60 days, extendable by 30 (NRS/SB 370). We aim to answer every request within 30 days, and we apply the shorter window where your state of residence is unclear.

7.3. Appeals (MHMD-required). If we refuse a request, you may appeal within a reasonable period by replying to our decision or writing to [email protected] with the subject "Appeal". Your appeal is reviewed by the NeuraVate privacy contact ([email protected]) as the designated appeal reviewer — and, where team size allows, by someone other than the original decision-maker — and answered in writing within 45 days with the reasons for the outcome. If you are unsatisfied with the result, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint (Washington residents), the Nevada Attorney General (Nevada residents), or your state's attorney general.

Consumer health data is kept for the periods privacy-policy sections 10 and 12.3 state (they summarise our Data Retention Schedule, retention-schedule), and protected by the measures in privacy-policy section 11: HTTPS (TLS) on every connection between your device and NeuraVate, with Cloudflare filtering attacks first (traffic between the components inside our own server runs on a private network and is not separately encrypted); the passport content encrypted in our database with keys our service holds separately from the database; encrypted backups; each account able to read and change only its own passport, with the administrator exception described in privacy-policy section 8.2; and records of changes to your passport and of every opening of your emergency page. The NeuraVate.ai app keeps a copy of your passport on your phone, only in the phone's secure storage, so that you can open it without a connection; privacy-policy section 6.8 says what it keeps and for how long.

9.1. For California residents, consumer health data as described in this policy is sensitive personal information under the CPRA. This section supplements our Privacy Policy.

9.2. Limited use of sensitive personal information. We use and disclose sensitive personal information only for purposes permitted by CCPA regulations §7027(m): providing the service you asked for (the Emergency Passport, the emergency link and the printed card), security and integrity, quality assurance, and legal compliance — and never to infer characteristics about you for other purposes. Because our use stays within these permitted purposes, we are not required to offer a "Limit the Use of My Sensitive Personal Information" link. If our use ever expands beyond §7027(m), we will provide that link and honour the limitation right before doing so.

9.3. CCPA rights summary. California residents may: know/access what we collect (sections 2–5 are the disclosure; ask for specifics at [email protected]); delete (section 6.3); correct inaccurate information (in the app, or on request); and opt out of sale or sharing for cross-context behavioural advertising — noting that we do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We also honour non-discrimination (section 6.4) and authorised agents (section 6.5). CCPA response window: 45 days, extendable once by 45.

Material changes (new categories of consumer health data, new purposes, new recipients, or any change reducing your rights) will be notified in advance by email and in the app, and — where a change requires new consent under MHMD (for example a new sharing purpose) — we will ask for that consent separately rather than treat continued use as agreement. Each version carries the slug consumer-health-data-privacy-policy and a version identifier; this is v1.6-2026-10-29-LAUNCH, which adds to section 2.1 the check-up dates you add to your plan, and changes nothing else this policy says about your information; v1.6-2026-10-28-LAUNCH added to section 2.2 that your phone, not the app, checks your face or fingerprint for the app lock; v1.6-2026-10-27-LAUNCH, like v1.6-2026-10-24-LAUNCH, changed nothing this policy says about your information; v1.6-2026-10-21-LAUNCH corrected what section 6.3 says we do about Stripe's records of a card order and said in sections 5.3, 6.3 and 8 what the NeuraVate.ai app keeps on your phone; v1.5-2026-10-19-LAUNCH said in section 5.3 that the order records Stripe keeps hold your account ID for an order placed from the app; v1.4-2026-10-15-LAUNCH corrected what section 6.3 says deletion keeps; v1.3-2026-10-12-LAUNCH was the version published for the public launch.

• Operator: PairOx Pty Ltd (ABN 82 154 477 728, ACN 154 477 728), which operates the NeuraVate service
• Registered address: 4 Lorikeet Street, Glenwood NSW 2768, Australia
• Telephone: +61 402 614 311
• Privacy requests, appeals, and questions: [email protected]
• Website: neuravate.ai

Related documents: privacy-policy (Privacy Policy) · hipaa-notice-posture (HIPAA Posture Statement) · retention-schedule (Data Retention Schedule) · subprocessor-register (Subprocessor Register) · terms-of-service (Terms of Service).