Open Health Agent
Consumer Health Data Privacy Policy
This Privacy Policy explains how Open Health Agent (“OHA,” “we,” “us,” or “our”), a consumer wellness service offered by AnyBio, collects, uses, shares, and protects your personal information, including your consumer health data. This is a specific, standalone privacy policy for the Open Health Agent consumer service and the consumer health data it handles, separate from AnyBio's enterprise privacy policy.
Open Health Agent is a general wellness service, not a healthcare provider. The information you use with Open Health Agent is consumer personal information, not information protected by HIPAA. HIPAA does not apply to this service, and this policy does not offer, and should not be read to offer, HIPAA-style protections or confidentiality.
1. Who is responsible for your data
For the Open Health Agent consumer service, AnyBio - that is, Any Biosignal, Inc., a Delaware corporation located at 2261 Market Street STE 86985, San Francisco, CA 94114 - is the controller of your personal information. That means we decide how and why your information is processed, and we are responsible for handling your consent, your rights requests, and deletion directly.
2. Scope of this policy
This policy applies to your use of the Open Health Agent website, app, and related features (the “Service”), and to the personal information and consumer health data we collect through them. It does not apply to third-party products you connect or visit, which have their own privacy policies, or to AnyBio's separate enterprise services.
3. Consumer health data we cover
We treat “consumer health data” broadly. It means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For Open Health Agent this can include, for example, biometric and wearable readings (such as heart rate, heart rate variability, activity, sleep, respiratory or oxygen measures, glucose, and similar signals), the wellness goals you set, information about how you feel, and information that could be derived or inferred from any of the above.
4. Your consent
We ask for your consent before we collect your consumer health data, and we ask separately before we use it for a materially different purpose. We make consent specific and granular, so you can understand and choose what you are agreeing to for each type of collection and each use, rather than a single all-or-nothing choice. Where a law such as the Washington My Health My Data Act requires a separate, valid authorization for a particular collection, sharing, or sale, we obtain that authorization separately. You can withdraw your consent at any time, which stops the related future collection or use.
5. Information we collect
- Account information. Identifiers such as your name, email address, and account and authentication details.
- Health and fitness data you authorize. Data you choose to connect and let us read, including data from Apple Health (HealthKit) or Android Health Connect, and from wearables and apps you link.
- Content you provide. Your wellness goals, notes, and the content of your conversations with our coaching and AI features.
- Device and usage information. Technical and usage information such as device type, app version, and how you interact with the Service, collected to operate and improve it. We use Google Analytics and similar product-analytics and crash-reporting tools, configured so that no health-derived values are included in their event payloads, and we do not use any advertising SDKs.
6. Apple Health and Android Health Connect
If you choose to connect Apple Health, Open Health Agent reads only the HealthKit data types you authorize, and only to provide the wellness features you use. In line with Apple's requirements:
- We do not use HealthKit data for advertising or for any use-based data mining other than improving your health and fitness.
- We do not sell HealthKit data.
- We do not store HealthKit data in iCloud, including via backups.
- We request only the data types needed for the wellness program you choose, and you can review and change these permissions in your device settings at any time.
The same principles apply to data you connect through Android Health Connect, consistent with Google's Health Connect requirements. You can disconnect a source or turn off a permission at any time; doing so stops future collection from that source.
7. How we use your information
We use your information to provide general wellness features: to organize and summarize your own data, to surface what has changed, to coach and nudge you toward the goals you set, to operate, secure, and improve the Service, and to communicate with you about it. We use it for wellness purposes only. We do not use it to diagnose, detect disease, or make medical decisions.
AI and external model providers
Open Health Agent uses artificial intelligence to power some features. To do this, we may send limited, relevant portions of your information to external AI model providers that process it on our behalf to generate a response. We are disclosing this to you directly rather than burying it, because it involves your health-related information.
Our current AI model providers are Anthropic and Google (Gemini). They process your information under contractual terms that prohibit them from using your data to train or improve their models and that provide zero data retention - they do not retain your inputs or outputs after generating a response. We treat these providers as subprocessors acting on our behalf, not as independent third parties, we name them in the relevant consent, and we send only what is needed for a given feature.
8. How we share your information
We do not sell your personal information. We do not share your consumer health data for targeted advertising or for cross-context behavioral advertising. We will not sell or share your consumer health data in ways that require your authorization without first obtaining that separate authorization from you.
We may share information with:
- Service providers and subprocessors that help us run the Service, under contracts that limit them to processing the information on our behalf. These fall into the following categories: cloud hosting and storage; security and authentication; product analytics (Google Analytics); AI model providers (Anthropic and Google); support and communications tools; and, if you make a purchase, payment processing.
- You and those you direct. If you choose to export or hand your own data to someone (such as a clinician you decide to share it with), we act on your instruction. Some connected platforms restrict onward sharing of their data, which can limit what may be shared.
- Legal and safety reasons where required by law or to protect rights and safety, and business transfers in connection with a merger, acquisition, financing, or similar transaction, in which case the information remains subject to this policy or a successor policy at least as protective.
9. Retention, deletion, and portability
We keep your information for as long as your account is active or as needed to provide the Service, and then only for a limited period as required for legal, security, or record-keeping reasons.
You can ask us to delete your consumer health data, and you can export a copy of your data in a portable, machine-readable format. When you ask us to delete data, we delete it from our active systems within 30 days, instruct our service providers and AI model providers to do the same, and remove any copies remaining in routine backups within 90 days as those backups cycle. We retain a limited amount of information beyond that only where the law requires it or to resolve disputes or enforce our agreements, and we hold it under a narrow legal-hold exception. Revoking a device permission stops future collection from that source but does not by itself delete data we already collected - use the deletion controls for that.
10. How we protect your information
We use administrative, technical, and organizational measures designed to protect your information, such as encryption in transit and at rest, multi-factor authentication, access controls, and audit logging. AnyBio maintains a SOC 2 Type II program covering the systems that operate the Service. No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security.
11. Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate personal information.
- Delete your personal information, including consumer health data.
- Obtain a portable copy of your data.
- Withdraw consent, and opt out of any sale or sharing of your personal information, targeted advertising, and certain automated decision-making or profiling.
- Not be discriminated against for exercising your rights.
To exercise these rights, contact us at privacy@anybiosignal.com or use the privacy controls in the app. We may need to verify your identity before we act on a request, and you may use an authorized agent where state law allows. We acknowledge requests within 5 business days and respond substantively within 30 calendar days; where permitted, we may extend by up to an additional 60 days and will tell you if we do. If we decline a request, you may appeal by replying to our response.
12. Data breach notification
If a breach of your health information occurs, we will notify you and any applicable authorities as required by law. Where the FTC Health Breach Notification Rule applies, we will notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach, notify the Federal Trade Commission, and include the information those rules require. We will also comply with applicable state breach-notification laws, which may require notice to you and to state authorities within their own timeframes.
13. State-specific disclosures
Some states provide additional rights and require specific disclosures.
Washington (My Health My Data Act)
If you are a Washington resident, the Washington My Health My Data Act gives you specific rights in your consumer health data. The categories of consumer health data we collect, our sources, and our purposes are described in Sections 3, 5, and 7 above. We share consumer health data only with the categories of service providers and subprocessors described in Section 8, which process it on our behalf, and we do not sell it. You have the right to confirm whether we collect, share, or sell your consumer health data and to access it; to withdraw consent to our collection and sharing of it; and to have your consumer health data deleted. To exercise these rights or withdraw consent, contact privacy@anybiosignal.com or use the in-app controls, and you may appeal a denial as described in Section 11. The Act provides a private right of action, which is why we drafted this policy to its standard.
Nevada
If you are a Nevada resident, Nevada law (SB 370) provides rights in your consumer health data, including the right to access, and to have deleted, the consumer health data we maintain about you, and the right to opt out of any sale of that data. We do not sell your consumer health data. To exercise these rights, contact privacy@anybiosignal.com.
California
If you are a California resident, the CCPA/CPRA gives you the right to know the categories and specific pieces of personal information we collect, use, disclose, and share; to delete personal information; to correct inaccurate personal information; to opt out of the sale or sharing of personal information; and to limit the use of sensitive personal information. The categories of personal information we collect are described in Section 5. We do not sell personal information or share it for cross-context behavioral advertising, and we use sensitive personal information only to provide the Service and for other purposes for which the right to limit does not apply. You will not be discriminated against for exercising these rights, and you may use an authorized agent. To exercise these rights, contact privacy@anybiosignal.com or use the in-app controls.
As Open Health Agent becomes available in more states, we will add the disclosures those states require.
14. Children
Open Health Agent is intended for adults 18 and older and is not directed to children. We do not knowingly collect personal information from children, and if we learn that we have, we will delete it promptly.
15. Changes to this policy
We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you and will update the effective date - such as posting the updated policy with a new effective date, emailing the address associated with your account, or showing a prominent notice in the Service. Where a change materially affects how we handle your consumer health data, we will obtain your consent again before the change applies to that data.
16. Contact us
Questions or concerns about your privacy, or want to file a complaint? Contact us at privacy@anybiosignal.com, or by mail at Any Biosignal, Inc., 2261 Market Street STE 86985, San Francisco, CA 94114.