Privacy Policy

Last updated January 25, 2026

This Privacy Notice for Hale Health ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

Visit our website at https://hale.med or any website of ours that links to this Privacy Notice

Use Hale. Hale is your personal health AI assistant that helps you manage chronic conditions and complex medical needs. Store your complete medical history—medications, conditions, doctors, and medical reports—and get personalized health guidance whenever you have questions. Whether you're wondering about medication interactions, trying to understand lab results, or managing health for your entire family, Hale provides clear, personalized answers based on your specific medical situation, available 24/7.

Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@hale.med.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

Do we collect any information from third parties? We do not collect any information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by visiting https://hale.med, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
HOW DO WE HANDLE YOUR SOCIAL LOGINS?
IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK FEATURES
DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
DO WE MAKE UPDATES TO THIS NOTICE?
HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

Health information
Cookies and tracking data
IP addresses
Names
Physical addresses
Payment information
Usage data and analytics
Account credentials
Communications and messages
Preferences and settings

Sensitive Information. We do not process sensitive information.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Google, GitHub, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is stored by Stripe. You may find their privacy notice link(s) here: https://stripe.com/privacy.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts
To deliver and facilitate delivery of services to the user
To respond to user inquiries/offer support to users
To send administrative information to you
To fulfill and manage your orders
To enable user-to-user communications
To request feedback
To send you marketing and promotional communications
To protect our Services
To identify usage trends
To save or protect an individual's vital interest

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent).

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Notice.

Stripe. Payment processing

SendGrid. Email delivery service

Cloudflare. CDN and DDoS protection

Supabase. Authentication

Amazon Web Services. Infrastructure

New Relic. Observability

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of any information that you share with third parties that we may link to or who advertise on our Services, but are not affiliated with, our Services.

The Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties that are not affiliated with us and which may link to other websites, services, or applications. Accordingly, we do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by the use of such third-party websites, services, or applications. The inclusion of a link towards a third-party website, service, or application does not imply an endorsement by us. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this Privacy Notice. We are not responsible for the content or privacy and security practices and policies of any third parties, including other websites, services, or applications that may be linked to or from the Services. You should review the policies of such third parties and contact them directly to respond to your questions.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.

8. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or Twitter logins). Where you choose to do this, we will receive certain profile information about you from your social media provider.

9. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information, in the United States and other countries.

10. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for specific periods depending on the type of data and your account status.

Retention Periods

Data Type	Retention Period
Account information	Duration of your account, deleted within 30 days of account termination or upon request
Protected Health Information (PHI)	Duration of your account, deleted upon request or within 30 days of account termination
Non-health content	Duration of your account, deleted within 30 days of account termination
Payment records	7 years (legal/tax requirements)
Usage logs	12 months
Support communications	3 years after resolution
Security and audit logs	6 years (HIPAA requirement)
HIPAA compliance documentation	6 years (HIPAA requirement)

After Account Termination

We will delete your account and PHI within 30 days, or within 48 hours upon request
You may request an export of your data during the 14-day post-termination period, unless you have requested data deletion
Security and audit logs are retained for 6 years per HIPAA requirements
Deletion requests are logged for compliance purposes

Requesting Early Deletion

You may request deletion of your personal information at any time by contacting us at privacy@hale.med. We will process deletion requests within the timeframes specified in Section 15 (Your Privacy Rights).

11. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We protect your personal information through specific technical and organizational security measures.

Technical Security Measures

We implement the following technical safeguards:

Encryption in Transit: All data transmitted between you and our Services is encrypted using TLS 1.2 or higher
Encryption at Rest: Personal information stored on our servers is encrypted using industry-standard AES-256 encryption
Access Controls: Role-based access controls, multi-factor authentication (MFA) for administrative access, and principle of least privilege
Infrastructure Security: Regular security patches, firewall protection, intrusion detection systems, and network monitoring

Organizational Security Measures

Employee Security: Background checks for employees with data access, security awareness training, and confidentiality agreements
Incident Response: Documented procedures for identifying, containing, and remediating security incidents
Regular Assessments: Periodic security assessments and vulnerability testing

Data Breach Response

In the event of a security breach affecting your personal information, we will:

Notify you within seventy-two (72) hours of confirming the breach
Provide details about the nature and scope of the breach
Describe measures taken to address the breach
Cooperate with regulatory authorities as required

Limitations

Despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We encourage you to use strong passwords, enable two-factor authentication where available, and protect your account credentials.

12. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to persons under 18 years of age.

The Services are intended for users who are at least 18 years old. Persons under the age of 18 are not permitted to use or register for the Services. We do not knowingly collect personal information from persons under 18. If we learn we have collected personal information from a person under 18, we will delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@hale.med.

This policy complies with the Children's Online Privacy Protection Act (COPPA) and similar laws.

13. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your local data protection supervisory authority.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

14. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

15. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California or other US states with privacy laws, you have specific rights regarding your personal information.

California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

Your Rights Under CCPA/CPRA

You have the right to:

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the purposes for collection, and the categories of third parties with whom we share it.
Right to Delete: Request deletion of your personal information, subject to certain exceptions (such as completing transactions, detecting security incidents, or complying with legal obligations).
Right to Correct: Request correction of inaccurate personal information we maintain about you.
Right to Opt-Out of Sale/Sharing: Opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising purposes.
Right to Limit Use of Sensitive Personal Information: If we collect sensitive personal information, you may limit our use to what is necessary to provide the Services.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

Do Not Sell or Share My Personal Information

We do not "sell" personal information as traditionally defined. However, under CCPA/CPRA's broad definitions, certain data sharing activities (such as sharing data with advertising partners) may be considered a "sale" or "sharing."

To opt out of any sale or sharing of your personal information:

Email us at privacy@hale.med with subject line "Do Not Sell or Share My Personal Information"
If available, use the "Do Not Sell or Share My Personal Information" link on our website

We honor Global Privacy Control (GPC) signals as a valid opt-out request.

How to Exercise Your Rights

To exercise your CCPA/CPRA rights, you may:

Email us at privacy@hale.med
Visit https://hale.med and use our privacy request form (if available)

We will respond to verifiable consumer requests within forty-five (45) days. If we need more time (up to an additional 45 days), we will notify you of the reason and extension period in writing.

Verification

To protect your privacy, we must verify your identity before fulfilling your request. We may ask you to:

Confirm your email address
Provide information that matches our records
For deletion requests, confirm your request through a two-step verification process

Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization and may still verify your identity directly.

Categories of Personal Information

In the preceding 12 months, we may have collected the following categories of personal information:

Category	Examples	Collected
Identifiers	Name, email address, account name	Yes
Customer Records	Name, address, payment information	Yes
Commercial Information	Products purchased, usage history	Yes
Internet/Network Activity	Browsing history, interactions with Services	Yes
Geolocation Data	Approximate location based on IP	Yes
Professional Information	Company name, job title	If provided
Sensitive Personal Information	Account credentials	Yes

Shine the Light

California Civil Code Section 1798.83 ("Shine The Light") permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Other US State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, or other states with comprehensive privacy laws, you may have the following rights:

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA)

Right to Access: Confirm whether we process your personal data and access that data
Right to Correct: Correct inaccuracies in your personal data
Right to Delete: Delete personal data you have provided or we have obtained
Right to Data Portability: Obtain a copy of your personal data in a portable format
Right to Opt Out: Opt out of targeted advertising, sale of personal data, and profiling for decisions with legal or significant effects

Utah (UCPA)

Right to Access: Know whether we process your personal data and access that data
Right to Delete: Delete personal data you have provided
Right to Data Portability: Obtain a copy of your personal data
Right to Opt Out: Opt out of targeted advertising and sale of personal data

How to Exercise State Privacy Rights

To exercise your rights under these state laws:

Email us at privacy@hale.med with subject line "State Privacy Request - [Your State]"
Include your name, state of residence, and the specific right you wish to exercise

We will respond within the timeframe required by your state's law (typically 45 days, with possible extension).

Right to Appeal

If we decline to take action on your request, you have the right to appeal. To appeal, email us at privacy@hale.med with subject line "Privacy Appeal." We will respond to appeals within the timeframe required by applicable law. If your appeal is denied, you may contact your state's Attorney General.

Data Breach Notification by State

In addition to the 72-hour notification described in Section 11, we comply with state-specific breach notification requirements:

State	Notification Timeline	Authority Notification
California	"Most expedient time possible"	AG if 500+ residents affected
Virginia	Without unreasonable delay	AG if 500+ residents affected
Colorado	Within 30 days	AG if 500+ residents affected
Connecticut	Within 60 days	AG if any residents affected
New York	"Most expedient time possible"	AG, DFS, and State Police
Texas	Within 60 days	AG if 250+ residents affected

For residents of other states, we will comply with applicable breach notification laws.

16. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date and the updated version will be effective as soon as it is accessible. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification.

17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at privacy@hale.med or contact us by post at:

Hale Health
418 Broadway, STE N
Albany, NY 12207

18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, please visit: https://hale.med.