Privacy Policy

Last updated: October 12, 2026

1. Information We Collect

Identity and Contact Information

• Full name, date of birth, biological sex
• Email address, phone number, mailing address
• Government-issued ID (for identity verification)

Health and Medical Information

• Medical history, current diagnoses, medications, supplements
• Laboratory results (~70-marker comprehensive blood panel)
• Prescription history issued through our physician network
• Intake questionnaire responses including PHQ-2 screening, family history, lifestyle factors
• Symptom ratings and self-reported health data
• Laboratory reports and other health records you choose to upload (the original file and the results extracted from it), including the laboratory name and collection dates shown on the report

Wearable and Biometric Data

• Heart rate variability (HRV), resting heart rate
• Sleep staging, sleep quality scores, and readiness scores
• Body temperature (baseline and deviation)
• Activity levels, recovery metrics
• Continuous monitoring data from connected devices (Oura, WHOOP, Garmin)

Financial Information

• Payment card information (processed by our contracted payment processors — we do not store raw card numbers)
• Billing address and transaction history

Usage and Technical Data

• IP address, browser type, device identifiers
• Platform usage patterns, session duration, feature interactions
• UTM parameters and referral source

2. How We Use Your Information

• Provide health optimization services and deliver your personalized protocol
• Generate AI-assisted recommendations through Aris, our clinical intelligence system
• Read and organize health records you upload, using automated tools that include a third-party artificial-intelligence service (see Section 4), so that you can review and confirm the results and so that Aris can use confirmed results as context
• Facilitate physician review of your lab results, intake data, and flagged conditions
• Fulfill lab orders with our contracted laboratory and specimen-collection partners
• Dispense prescribed medications through our compounding pharmacy partners
• Communicate with you about your protocol, results, and account
• Process payments and maintain billing records
• Improve our platform and AI models (using de-identified data only)
• Comply with legal, regulatory, and licensing requirements

3. Data Storage and Security

All data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. We use Supabase for database infrastructure and Vercel enterprise infrastructure for application hosting. Both platforms maintain SOC 2 Type II compliance. Access to PHI is restricted to authorized personnel and Business Associates on a need-to-know basis. All access is logged and audited.

Uploaded files are stored in private, access-controlled storage that is not publicly accessible. They are available only to you and to authorized personnel and service providers who need them to operate the service.

4. Business Associates and Third-Party Sharing

We work with a network of independent healthcare providers, pharmacies, and laboratories to deliver your care. Where a partner's role requires access to protected health information, we require that partner to enter into a Business Associate Agreement consistent with HIPAA's requirements before PHI is shared. Aurum Health does not itself provide medical diagnosis, prescribing, pharmacy, or laboratory services — those are provided by independent, licensed third parties.

Artificial intelligence service providers. Aurum uses OpenAI to process certain health information for platform functions, including uploaded laboratory result extraction, Aris, protocol drafting, lab-results communications, weekly insights, and session organization. These services are used only under Aurum’s approved healthcare configuration. We do not use your health information to train generalized AI models.

We do not sell your personal information to any third party, ever.

Text Messaging

Text messaging originator opt-in data and consent will not be sold, rented, or shared with any third parties for marketing or promotional purposes.

5. Your HIPAA Rights

• Right to Access: Request a copy of your PHI within 30 days.
• Right to Amend: Request correction of inaccurate or incomplete PHI.
• Right to Accounting of Disclosures: Request a list of disclosures in the prior six years.
• Right to Request Restrictions: Request restrictions on use or disclosure of your PHI.
• Right to File a Complaint: File with us or with HHS Office for Civil Rights without retaliation.

6. Data Retention

Member health records are retained for a minimum of seven (7) years following the last date of service, as required by HIPAA and applicable state medical record retention laws. Financial records are retained for seven years. You may request deletion of eligible account data at any time, subject to applicable legal, regulatory, medical-record, security, and retention requirements.

Uploaded records. Health records you upload yourself, and results extracted from them, are not part of a medical record created by the physician network. You may delete them from your account at any time. When you do, the uploaded file and its extracted results are removed from your account and Aurum’s active systems. Residual copies may remain temporarily in encrypted backups until those backups expire or are overwritten through Aurum’s normal backup lifecycle. If information from an uploaded record has been incorporated into care you received through the physician network, the physician network’s applicable medical-record retention obligations may continue to apply to its record of that care.

7. Cookies and Tracking

• Authentication cookies: Required for maintaining your secure session
• Google Analytics (GA4): Aggregate usage analytics to improve the platform
• Meta Pixel: Conversion tracking for advertising campaigns
• Attribution cookie: Records how you first arrived at Aurum, such as campaign information and referring page, for up to 90 days so we can understand which marketing efforts lead people to Aurum

Analytics cookies do not include PHI and cannot be used to identify individual health data.

Analytics events about uploads record only that an upload started, completed, failed or was deleted. They never include file names, test names or results.

8. California Residents (CCPA)

• Right to Know: Request disclosure of categories and specific pieces of personal information we have collected.
• Right to Delete: Request deletion of personal information, subject to health record retention requirements.
• Right to Opt-Out: Aurum Health does not sell personal information. There is nothing to opt out of.

9. Contact