LegalDRAFT · PENDING LEGAL REVIEW

Privacy Policy

Effective October 6, 2026 · Last updated October 6, 2026

The short versionYour health data belongs to you. We use it to run Verdai for you. We do not sell it, we do not use it for advertising, and you can export or delete it whenever you like.

Who we are

Verdai, Inc. ("Verdai", "we", "us"), a [STATE] corporation located at [REGISTERED ADDRESS], operates the Verdai app, website and waitlist (together, the "Service"). Verdai is the controller of the personal information described in this policy.

Questions can be sent to privacy@verdai.health.

Verdai and HIPAA

Verdai is a direct-to-consumer wellness service. When you share information with us directly, we are generally not acting as a "covered entity" or "business associate" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), so HIPAA usually does not apply to that information. We protect it as described in this policy and as required by the consumer health privacy laws that do apply.

Information we collect

Information you give us

Waitlist and account details, such as your name, email address and date of birth.
Conversations with the Verdai assistant, including your questions and any context you share.
Health information you choose to add, such as lab results, biomarkers, symptoms, conditions, medications, supplements, sleep, diet and lifestyle notes.
Data from wearables or lab services you choose to connect.
Messages you send to support.

Information collected automatically

Device and usage data, such as app version, operating system, crash logs and feature usage.
IP address and the approximate location derived from it, used for security and to apply the correct regional rules.
Cookies and similar technologies, described below.

We do not collect precise geolocation, contacts, photos or microphone data unless you grant access for a specific feature.

Consumer health data

Some U.S. states, including Washington, Nevada and Connecticut, give extra protection to "consumer health data". Most of the health information described above falls into that category.

Consent. We collect and use consumer health data only with your consent and only to provide the Service you request. We ask for separate consent before sharing it with anyone other than our service providers.
Sources. You, and the wearables or lab services you connect.
Purposes. Answering your questions, building your health profile, showing trends, keeping the Service secure, and the other uses listed in this policy.
Your controls. You can confirm what we hold, get a list of the third parties and affiliates we share it with, withdraw consent, and ask us to delete it.

We do not sell consumer health data, and we do not use geofencing around health care locations.

How we use information

To provide the Service, including answering questions and personalising guidance.
To track your biomarkers over time and show trends.
To secure accounts, prevent fraud and enforce our Terms.
To improve the Service using de-identified or aggregated data.
To contact you about your account and, if you opt in, about product news.
To comply with law.

We do not use health information for advertising or to build marketing profiles.

Legal bases (EEA, UK and Switzerland)

Where these laws apply, we rely on your explicit consent for health data, on contract to provide the Service, on legitimate interests for security and product improvement, and on legal obligation where required.

AI processing

Verdai's assistant is an AI system, not a person. When you send a message, the message and relevant parts of your profile are processed by AI models to generate a reply. Some of this processing is done by third-party providers, currently [AI PROVIDER(S)], acting on our instructions under contracts that restrict them from using your data to train their own models or for any purpose other than providing the Service to us.

We will not use identifiable conversations or health records to train or fine-tune models unless you opt in separately. You can change that choice at any time in Settings.

We do not sell personal information and do not share it for cross-context behavioural advertising. We disclose it only:

To service providers that host, secure, analyse and support the Service for us, under written contracts that limit their use of the data.
To lab or wearable services when you ask us to connect them.
When required by law or valid legal process, or to protect someone's safety. Where permitted, we will tell you first.
In a merger, acquisition or sale of assets, in which case the recipient must protect your information consistent with this policy.
With your consent.

Cookies and analytics

Our website uses essential cookies to work, and limited analytics to understand site traffic. We do not place third-party advertising pixels or trackers on pages where you enter health information, and we do not send health information to advertising platforms. We honour Global Privacy Control signals as a request to opt out of any sale or sharing.

De-identified data

Where we use de-identified data, we take reasonable steps to keep it de-identified, we commit not to attempt to re-identify it, and we require anyone we share it with to make the same commitment.

Security

We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit and at rest and restricted, logged access. No system is completely secure. If a breach affects your information, we will notify you and the relevant authorities as required by law, including the FTC Health Breach Notification Rule.

Retention

We keep information while your account is active. If you delete your account, we delete or de-identify your personal and health data within 30 days, and it is removed from backups within a further [NUMBER] days, unless we must keep certain records to meet a legal obligation.

Your rights

Depending on where you live, you may have the right to:

Access your information and receive a portable copy.
Correct inaccurate information.
Delete your information.
Withdraw consent and opt out of optional processing.
Opt out of any sale, sharing or targeted advertising.
Appeal a decision we make about your request.
Complain to your data protection authority or state attorney general.

Most of these are available in Settings. You can also email privacy@verdai.health. We will verify your identity, respond within the time the law requires, and you may use an authorised agent. If we deny a request, you can appeal by replying to our decision. We will not treat you differently for using your rights.

International transfers

We are based in the United States and process data there. Where we transfer personal data from the EEA, UK or Switzerland, we use approved safeguards such as Standard Contractual Clauses.

Children

The Service is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

Changes to this policy

We will post any changes here and update the date above. For material changes, we will notify you in the app or by email before they take effect, and we will ask for your consent where the law requires it.

Contact

Verdai, Inc.
[REGISTERED ADDRESS]
Email: privacy@verdai.health