Privacy Policy

Our approach to your health data

We designed AskSalus around a simple principle: your health information belongs to you.

• You own your record. AskSalus maintains a longitudinal health record that is yours to access, export, and delete.
• Local-first by design. Wherever possible, we aim to keep your health data on your own device and to minimize what we hold on our servers.
• No sale, no advertising. We do not sell your health data, and we do not use it for advertising.

What laws apply to us

AskSalus, in its consumer form, is generally not a “covered entity” under HIPAA, because HIPAA applies to health plans, health-care providers, and clearinghouses.

We are, however, bound by and committed to:

• the Federal Trade Commission Act, which prohibits unfair or deceptive practices, including misrepresenting how we use your data;
• the FTC Health Breach Notification Rule, which requires us to notify you (and regulators) if your identifiable health information is breached; and
• applicable state health-privacy laws, including Washington’s My Health My Data Act and California’s privacy and medical-information laws.

When AskSalus works with a clinical partner (for example, a primary-care organization offering AskSalus to its members), and we handle health information on that partner’s behalf, we operate under a Business Associate Agreement, and HIPAA protections apply to that data.

Information we collect

• Health information you provide or connect.
• Insights we generate: trend summaries and guidance derived from your inputs (shown to you as your Summary of Trends).
• Account information: name, email, and authentication data.

How we use your information

• To maintain your personal health record and show you your Summary of Trends.
• To provide AI-powered guidance. Our guidance draws on a curated base of verified medical research (harvested from peer-reviewed journals) to reduce inaccuracies. This medical-literature knowledge base contains no personal data, and where generating your guidance involves processing your own inputs, we limit that processing to what is necessary to provide the service.
• When AI processing involves third parties. Some AI processing may be carried out by trusted AI providers acting on our behalf. When it is, they are bound by agreements that limit them to providing the service to us and prohibit them from using your health information to train their own models or for any other purpose.
• To secure, maintain, and improve the service.

We do not use your health information to serve advertising, and we do not sell it.

How your information is stored and protected

• Local-first storage. We follow a local-first approach, keeping data on your device where possible and minimizing what we store on our servers.
• Encryption in transit and at rest for any data we do hold.
• Access controls limiting who at AskSalus can access systems.
• No security system is perfect, and we cannot guarantee absolute security — but we work to protect your information consistent with the sensitivity of health data.

How long we keep your information

We keep your health information for as long as your account is active, so we can maintain your longitudinal record and show you your Summary of Trends.

• You can delete your record and account at any time. When you do, we delete your health information from our active systems.
• Residual copies may persist in encrypted backups for a limited period before they are overwritten, and we may retain a minimal amount of information where the law requires it.

Where your information is processed

AskSalus is operated from the United States, and your information is processed and stored there. Where a service provider processes information in another country, we take steps to ensure it remains protected consistent with this policy.

When we share information

We share information only in limited circumstances:

• Service providers / subprocessors who help us operate the app — for example, cloud hosting and infrastructure, and, where applicable, AI-processing and analytics providers. Each is bound by agreements that restrict their use of your information to operating the service on our behalf.
• Clinical partners, only with your knowledge and under appropriate agreements (see above).
• Legal requirements, where we are compelled by law.

We will tell you in this policy — and, where required, ask your consent — before sharing identifiable health information with any new category of third party.

Your rights and choices

Because your record is yours, you can:

• Access and export your health information at any time.
• Correct information.
• Delete your record and account.
• Withdraw consent to specific data uses or sharing.

If there is a breach

If we discover a breach of your unsecured identifiable health information, we will notify you promptly, and notify the FTC (and, in some cases, the media) as required by the Health Breach Notification Rule. Notice will tell you what happened, what information was involved, and what you can do.

Children

AskSalus is intended for users 18 and over and is not directed to children.

Changes to this policy

We may update this policy as AskSalus evolves. When we do, we will revise the “Last updated” date above. If the changes are material — for example, a new category of data use or sharing — we will give you prominent notice and, where required, ask for your consent before the change takes effect.

Contact us

Questions about this policy, or a request to access, correct, export, or delete your health information? Contact us at privacy@asksalus.com.