Effective Date: [8/27/2026]
1. INTRODUCTION
This Privacy Policy describes how Control Health LLC and its affiliates (collectively, “Company,” “we,” “us,” or “our”) collect, use, disclose, retain, and otherwise process Personal Information when you visit or use our website (the “Site”), mobile application (the “Mobile App”), AI-powered features, and related products and services (collectively, the “Platform”). For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual, as defined by applicable U.S. privacy laws.
Please read this Privacy Policy carefully. By accessing or using the Platform, you acknowledge that you have read and understand this Privacy Policy.
Capitalized terms not otherwise defined in this Privacy Policy have the meanings assigned to them in our Terms of Service (“Terms of Service”).
2. SCOPE OF THIS PRIVACY POLICY
This Privacy Policy applies to Personal Information collected through or in connection with your access to or use of the Platform.
This Privacy Policy does not apply to the privacy practices of independent Third-Party Services, including healthcare providers, laboratories, Laboratory Platform Providers, pharmacies, health systems, wearable device providers, electronic health record systems, health information exchanges, payment processors, or other third-party products or services, each of which operates independently from Company and maintains its own privacy policies and information handling practices.
3. IMPORTANT INFORMATION ABOUT THE PLATFORM
3.1 Company Does not Provide Medical Advice
Company is a technology company and not a physician, medical practice, laboratory, pharmacy, or other healthcare provider. The Platform is designed to help users securely access, organize, understand, and interact with their own Health Information. The Platform may also facilitate your ability to request Laboratory Services from independent Third-Party Services and to receive laboratory results through authorized electronic connections.
Company does not practice medicine, provide medical care, perform laboratory testing, collect specimens, issue or authorize laboratory orders, diagnose medical conditions, interpret laboratory results, prescribe or recommend treatment, exercise clinical judgment, or direct or control the independent professional judgment of any healthcare provider, laboratory, or other Third-Party Service.
The information, AI Features, and other content made available through the Platform are provided solely for informational and educational purposes and are not a substitute for professional medical advice, diagnosis, or treatment. Company encourages you to consult a qualified healthcare provider regarding any questions about your health, medical condition, laboratory results, or treatment options and to seek prompt medical attention if you believe you may have a medical emergency or require urgent medical care. You should not disregard, delay, or avoid seeking professional medical advice because of information or AI-generated content made available through the Platform.
3.2 HIPAA
Company provides the Platform as a consumer-directed technology service and, except as expressly provided in a separate written agreement, generally does not act as a healthcare provider, HIPAA Covered Entity, or Business Associate in connection with the operation of the Platform. Accordingly, information processed through the Platform may not be subject to the privacy, security, or breach notification requirements of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). The Company’s collection, use, disclosure, and protection of Personal Information and Health Information are governed by this Privacy Policy, our Consumer Health Data Privacy Policy, our Terms of Service, and applicable federal and state laws, which may include certain state privacy laws governing medical or health information.
Your interactions with healthcare providers, laboratories, pharmacies, and other Third-Party Services are governed by the terms, privacy notices, and legal obligations applicable to those organizations, including, where applicable, HIPAA. Company is not responsible for the privacy practices, legal compliance, or HIPAA obligations of any Third-Party Service.
Nothing herein shall be construed as a representation or warranty that the Platform is subject to, governed by, or compliant with HIPAA. While Company endeavors to implement security practices informed by HIPAA and other recognized healthcare industry standards, the Platform is not offered as a HIPAA-regulated service except to the extent expressly agreed in a separate written agreement.
3.3 Consumer Health Data
Certain information processed through the Platform may constitute Consumer Health Data under applicable state consumer health privacy laws.
If you reside in a state that provides additional rights regarding Consumer Health Data, please review our separate Consumer Health Data Privacy Policy (“Consumer Health Data Privacy Policy”), which supplements this Privacy Policy.
3.4 Intended Users
The Platform is intended solely for individuals who are located in the United States and are at least eighteen (18) years of age.
4. INFORMATION WE COLLECT
The categories of information we collect depend on how you interact with the Platform and the services you choose to use, which may include:
5. HOW WE COLLECT INFORMATION
We collect information from a variety of sources depending on how you use the Platform, including:
We may combine information collected from these sources to provide, operate, secure, improve, and personalize the Platform, consistent with this Privacy Policy and applicable law.
6. HOW WE USE YOUR INFORMATION
We use Personal Information only for legitimate business purposes, to provide the Platform and requested services, fulfill our contractual obligations, comply with applicable law, protect our rights and users, improve our products and services, and as otherwise permitted or required by applicable law.
We do not use identifiable Health Information or identifiable AI conversations submitted through the Platform to train or improve third-party foundation artificial intelligence models. Our AI Features are designed to retrieve and process only the information reasonably necessary to respond to your request.
Subject to applicable law, Company may create, use, disclose, publish, license, commercialize, and otherwise use Aggregated Data, De-identified Data, Usage Data, Platform Data, and related analytics for research, benchmarking, quality improvement, product development, artificial intelligence development, statistical analysis, scientific publication, and other legitimate business purposes.
7. ARTIFICIAL INTELLIGENCE FEATURES
The Platform includes AI Features, including AI chat features, designed to help you organize, search, summarize, understand, and interact with your Health Information. AI Features are provided solely for informational and educational purposes and are not intended to provide medical advice, diagnose medical conditions, recommend or prescribe treatment, make clinical decisions, or replace the advice, diagnosis, treatment, or independent professional judgment of a qualified healthcare provider. Additional information regarding AI Features is provided in the Terms of Service.
7.1 Information Processed Through AI Features
When you use AI Features, the Platform retrieves, accesses, and processes information reasonably necessary to generate the AI-powered response or other requested functionality. Where technically feasible and consistent with the functionality requested, the Platform is designed to retrieve, access, and process information reasonably necessary to provide the requested AI functionality.
Depending on the AI Feature you use, Company may process your prompts, questions, instructions, uploaded documents, Health Information available within your Platform account, laboratory results, medical records, prior AI interactions within your account, User Content, and other information reasonably necessary to provide the requested AI functionality.
7.2 Third-Party AI Providers
To provide AI Features, Company may use one or more third-party artificial intelligence service providers to process information necessary to generate AI-powered responses and other requested Platform functionality. Depending on the feature you use, this may include processing your prompts, questions, instructions, uploaded documents, Health Information, and other information reasonably necessary to respond to your request.
Company selects AI providers that are intended to support secure and responsible processing of information and may require such providers to process information on Company’s behalf in accordance with applicable agreements and Company instructions, where applicable. Company does not authorize third-party AI providers to use your identifiable Health Information or identifiable AI conversations to train or improve their publicly available foundation models, except with your consent or as otherwise permitted by applicable law.
7.3 AI Limitations
AI Features generate outputs using statistical and probabilistic methods rather than human reasoning, clinical judgment, or independent medical evaluation. Accordingly, AI-generated outputs may be inaccurate, incomplete, outdated, inconsistent, or inappropriate for your particular circumstances and may reflect limitations in the information available to the Platform at the time your request is processed. You should independently evaluate and verify AI-generated outputs before relying on them, particularly for decisions affecting your health, medical care, finances, legal rights, or other important matters, and should consult a qualified healthcare provider regarding any medical questions or decisions.
7.4 AI Development
Company does not use your identifiable Health Information or identifiable AI conversations to train or improve publicly available third-party foundation artificial intelligence models. Instead, when you use AI Features, the Platform retrieves information from your authorized Health Information and other content available within your account that is reasonably necessary to generate the response you requested.
Subject to applicable law, Company may use Aggregated Data, De-identified Data, Usage Data, Platform Data, and other information that does not reasonably identify you to develop, evaluate, test, monitor, secure, maintain, improve, and enhance the Platform, AI Features, retrieval systems, search functionality, analytics, and related technologies, including evaluating the performance, accuracy, reliability, safety, security, fairness, and effectiveness of AI Features and other Platform functionality.
Company may modify, replace, suspend, or discontinue AI Features from time to time in its discretion to improve performance, safety, security, functionality, user experience, or compliance with applicable law.
8. THIRD-PARTY MEDICAL RECORDS AND LABORATORY SERVICES
The Platform enables you to connect with independent Third-Party Services, including healthcare providers, laboratories, Laboratory Platform Providers, pharmacies, electronic health record systems, health information exchanges, wearable device providers, and similar organizations that you authorize.
8.1 Medical Records
At your direction, Company may retrieve, receive, organize, display, and maintain Health Information from Third-Party Services that you authorize.
Company does not create, modify, validate, verify, or control the underlying medical records maintained by those organizations and is not responsible for their accuracy, completeness, availability, or timeliness.
8.2 Laboratory Services
The Platform may allow you to request or schedule laboratory testing through independent Laboratory Platform Providers that coordinate laboratory services with licensed laboratories, specimen collection sites, and, where applicable, independent ordering providers.
When you request Laboratory Services, Company may collect, receive, use, and transmit information reasonably necessary to facilitate your request, including your registration information, contact information, payment information, Health Information, and other information required by the applicable Third-Party Services.
Laboratory results and related information may be transmitted to the Platform through secure application programming interfaces (APIs) or other authorized electronic means and displayed for your convenience. All laboratory results originate from independent Third-Party Services. Company does not create, modify, review, validate, interpret, or independently verify the accuracy, completeness, timeliness, or reliability of laboratory results or other information received from Third-Party Services and displays such information solely as received from the applicable Third-Party Service. If you have any questions regarding your laboratory results, you should contact the applicable laboratory or your healthcare provider.
Company does not perform laboratory testing, collect specimens, issue laboratory orders, diagnose medical conditions, interpret laboratory results, recommend treatment, or otherwise provide medical services.
8.3 Third-Party Privacy Practices
Third-Party Services operate independently from Company.
Your interactions with healthcare providers, laboratories, Laboratory Platform Providers, pharmacies, wearable device providers, electronic health record systems, health information exchanges, and other Third-Party Services are governed by the applicable privacy policies, terms of service, and legal obligations of those organizations.
Company is not responsible for the privacy, security, availability, or information handling practices of any Third-Party Service.
9. HOW WE DISCLOSE INFORMATION
We disclose Personal Information only as described in this Privacy Policy, with your authorization, or as otherwise permitted or required by applicable law.
We do not sell your Personal Information for monetary consideration.
Categories of Recipients of Personal Information
9.1 Service Providers
Company engages vendors and service providers to perform services on Company’s behalf. These providers are contractually required to use Personal Information only to perform services for Company and to protect Personal Information consistent with applicable law and their contractual obligations.
9.2 At Your Direction
We disclose information to Third-Party Services when you authorize or direct us to do so, including when you connect healthcare providers, request laboratory services, authorize retrieval of medical records, or otherwise instruct Company to facilitate interactions with Third-Party Services.
9.3 Legal Compliance and Protection
Company may disclose Personal Information where Company reasonably believes such disclosure is necessary to comply with applicable law, regulation, legal process, or lawful governmental request; protect the rights, property, or safety of Company, our users, or others; detect, investigate, prevent, or respond to fraud, abuse, security incidents, or other unlawful activity; enforce our agreements; or establish, exercise, or defend legal claims.
9.4 Aggregated and De-identified Information
Company may create, use, disclose, publish, license, commercialize, sell, transfer, and otherwise use Aggregated Data, De-identified Data, Usage Data, Platform Data, and related analyses, benchmarks, statistical information, and research for any lawful purpose consistent with applicable law, including product development, benchmarking, quality improvement, analytics, artificial intelligence development, commercialization, and other business purposes.
9.5 Sale, Sharing, and Targeted Advertising
Company does not sell Personal Information for monetary consideration.
However, certain online technologies used to operate, analyze, improve, secure, and market the Platform may constitute a “sale,” “sharing,” or “targeted advertising” under certain State Privacy Laws.
Where required by applicable law, Company provides appropriate notices, obtains required consent, recognizes browser-based privacy preference signals (including Global Privacy Control), and honors applicable opt-out rights.
Company does not use Health Information, Consumer Health Data, or AI prompts or conversations for cross-context behavioral advertising.
10. COOKIES AND SIMILAR TECHNOLOGIES
Company and our service providers may use cookies, software development kits (“SDKs”), pixels, web beacons, local storage technologies, APIs, scripts, tags, and similar technologies (collectively, “Cookies”) to operate, maintain, secure, analyze, improve, and personalize the Platform; authenticate users; remember preferences; prevent fraud; measure Platform performance; understand user engagement; and, where permitted by applicable law, support analytics, marketing, audience measurement, and advertising activities. Cookies may be placed by Company or by our service providers, analytics providers, advertising partners, or other authorized third parties in connection with the operation of the Platform.
10.1 Types of Cookies
Depending on your use of the Platform, we may use the following categories of Cookies:
10.2 How We Use Cookies
Company and our service providers may use Cookies to provide, operate, maintain, secure, and improve the Platform; authenticate users; maintain secure sessions; remember user preferences; analyze Platform usage; measure performance; troubleshoot technical issues; detect and prevent fraud, abuse, and unauthorized access; improve the functionality and user experience of the Platform; measure the effectiveness of our communications and marketing efforts; and, where permitted by applicable law, support analytics, audience measurement, remarketing, and other interest-based advertising activities.
We may also use pixels, web beacons, SDKs, and similar technologies within the Platform, our websites, emails, text messages, push notifications, and other communications to determine whether communications have been opened, links have been clicked, features have been used, or users have otherwise interacted with the Platform or our communications.
10.3 Your Cookie Choices
Where required by applicable law, Company provides a Cookie Preference Center that allows you to accept, reject, or customize your preferences for non-essential Cookies. You may update your Cookie preferences at any time through the Cookie Preference Center or other settings made available through the Platform.
You may also manage certain Cookies by changing your browser or mobile device settings to block or delete Cookies, disable certain tracking technologies, or limit the use of your mobile device’s advertising identifier. You may also choose to use privacy-focused browsers or browser extensions that restrict certain tracking technologies. Please note that disabling certain Cookies or similar technologies may affect the availability, functionality, performance, or user experience of portions of the Platform.
10.4 Brower Privacy Controls
Certain web browsers permit users to transmit browser-based privacy preference signals, including Global Privacy Control (“GPC”). Where required by applicable law, Company recognizes and processes GPC signals as requests to opt out of the sale or sharing of Personal Information or targeted advertising for the browser or device from which the signal is transmitted.
Except as described above or otherwise required by applicable law, the Platform does not currently respond to browser “Do Not Track” (“DNT”) signals.
11. MARKETING COMMUNICATIONS
11.1 Transactional Communications
Company primarily communicates with users regarding their accounts and requested services. We may send transactional emails, text messages, push notifications, or other communications relating to account creation and authentication, password resets, security alerts, billing and subscriptions, laboratory order confirmations, laboratory result notifications, customer support, Platform updates, changes to our legal agreements or policies, and other account- or service-related matters. Because these communications are necessary to provide, maintain, secure, and administer the Platform, you may not opt out of receiving transactional communications while maintaining an active account.
11.2 Marketing Communications and Advertising.
Subject to applicable law and your privacy choices, Company may use Personal Information to communicate with you regarding the Platform and our products and services, personalize marketing communications, measure the effectiveness of our marketing efforts, and improve our products, services, and marketing activities.
We, and our service providers and advertising partners, may also use cookies, pixels, SDKs, web beacons, and similar technologies to understand how users interact with the Platform, our communications, and other online services and, where permitted by applicable law, to support interest-based advertising, audience measurement, remarketing, and similar advertising activities.
Where required by applicable law, Company will obtain your consent before using non-essential cookies or similar technologies for advertising purposes and will honor applicable opt-out rights, including browser-based privacy preference signals such as Global Privacy Control. Company does not use identifiable Health Information, laboratory results, Consumer Health Data, or AI prompt or conversations for interest-based advertising or cross-context behavioral advertising. Additional information regarding our use of cookies and similar technologies is provided in Section 10.
You may opt out of receiving promotional or marketing communications at any time by following the unsubscribe instructions included in the communication, adjusting your account preferences where available, or contacting Company. Opting out of marketing communications will not affect transactional, account-related, security, or other legally required communications.
Company does not use identifiable Health Information, Consumer Health Data, or AI prompts or conversations to personalize marketing or advertising.
12. DATA RETENTION
Company retains Personal Information only for as long as reasonably necessary to provide, operate, maintain, secure, and improve the Platform and requested services; comply with applicable law and contractual obligations; protect the rights, property, and security of Company and others; resolve disputes; enforce our agreements; and pursue other legitimate business purposes. Retention periods vary depending on the nature of the information, the services you use, applicable legal requirements, operational needs, and other relevant circumstances.
When Personal Information is no longer reasonably necessary for these purposes, Company will securely delete, anonymize, aggregate, or de-identify the information in accordance with applicable law and Company’s record retention practices.
If you request deletion of your account, Company will process your request in accordance with applicable law. Company may retain information to the extent reasonably necessary to comply with legal obligations, resolve disputes, enforce our agreements, prevent fraud, investigate security incidents, protect Company or others, or otherwise as permitted or required by applicable law.
Company may retain Aggregated Data, De-identified Data, Usage Data, Company Data, and other information that no longer reasonably identifies you indefinitely, subject to applicable law.
13. SECURITY
Company employs administrative, technical, and organizational safeguards designed to protect Personal Information. These safeguards include measures designed to limit access to information, retrieve only information reasonably necessary to fulfill user requests, segregate customer information, encrypt information during transmission and storage where appropriate, monitor access, and protect the confidentiality, integrity, and availability of information processed through the Platform.
Our information security program is designed to protect the confidentiality, integrity, and availability of information processed through the Platform and is regularly evaluated and updated to address evolving security risks.
Although Company uses commercially reasonable safeguards, no method of transmitting information over the Internet, mobile networks, or electronic storage systems can be guaranteed to be completely secure. Accordingly, Company cannot guarantee the absolute security of any information transmitted to or through the Platform.
You are responsible for maintaining the confidentiality of your account credentials, using strong passwords, safeguarding your devices, and promptly notifying Company of any suspected unauthorized access to your account.
If Company becomes aware of a security incident involving your Personal Information, Company will investigate the matter and provide any notifications required by applicable law.
14. DATA LOCATION
The Platform is intended solely for individuals residing in the United States. Company may collect, store, process, maintain, transmit, and otherwise process Personal Information in the United States and in other jurisdictions where Company or its service providers operate. By using the Platform, you acknowledge that your Personal Information may be transferred to and processed in jurisdictions whose privacy and data protection laws may differ from those of your state of residence. Company implements reasonable administrative, technical, contractual, and organizational safeguards designed to protect Personal Information regardless of where it is processed.
15. YOUR PRIVACY RIGHTS AND CHOICES
Depending on your state of residence and applicable law, you may have certain choices regarding your Personal Information.
15.1 Account Information
You may access, review, update, or correct certain account information through your account settings.
15.2 Account Deletion
You may request deletion of your account by contacting Company or through available account settings.
Deletion of your Platform account will not necessarily result in deletion of information maintained independently by healthcare providers, laboratories, pharmacies, Laboratory Platform Providers, or other Third-Party Services.
15.3 Cookie Preferences
Where required by applicable law, you may manage your Cookie preferences through Company’s Cookie Preference Center.
15.4 Browser Privacy Controls
Where required by applicable law, Company recognizes browser-based privacy preference signals, including Global Privacy Control (“GPC”), as requests to exercise applicable opt-out rights for the browser or device from which the signal is transmitted.
15.5 Marketing and Advertising Preferences
You may opt out of receiving promotional or marketing communications at any time by following the unsubscribe instructions included in the communication, adjusting your account preferences where available, or contacting Company. Opting out of marketing communications will not affect transactional, account-related, security, or other legally required communications.
Depending on your device, browser, and applicable law, you may also be able to limit or opt out of certain interest-based advertising by:
Please note that these preferences are generally browser- and device-specific and may need to be configured separately for each browser and device you use. Disabling certain cookies or advertising technologies may affect the availability or functionality of certain Platform features. Also, please note that opting out of interest-based advertising does not mean you will stop seeing advertisements. Instead, the advertisements you see may be less relevant to your interests.
15.6 Mobile Device Permissions
You may control certain device permissions, including push notifications and other mobile permissions, through your device settings. Disabling certain permissions may affect Platform functionality.
16. ADDITIONAL STATE PRIVACY RIGHTS
Residents of certain U.S. states may have additional rights regarding Company’s collection, use, disclosure, retention, and processing of Personal Information under applicable state privacy laws. This Section supplements the other provisions of this Privacy Policy only to the extent required by applicable law and applies solely to residents of states whose laws provide such rights.
16.1 Your State Privacy Rights
Depending on your state of residence and applicable law, you may have the right to:
These rights are subject to applicable legal limitations and exceptions.
16.2 Exercising Your Rights
To exercise any applicable privacy right, you (or your authorized agent, where permitted by law) may submit a request by:
Company may verify your identity before responding to your request.
Where required by applicable law, Company will provide instructions for appealing decisions regarding privacy requests.
16.3 Exercising Advertising and Sale Opt-Out Rights
Depending on your state of residence, you may have the right to opt out of the sale or sharing of Personal Information, targeted advertising, or certain profiling activities. Although Company does not sell Personal Information for monetary consideration, certain online technologies used to support analytics or advertising may constitute a “sale,” “sharing,” or “targeted advertising” under applicable State Privacy Laws. Where required by applicable law, Company provides mechanisms to exercise these rights, including recognition of browser-based privacy preference signals such as Global Privacy Control. Additional information regarding Company’s information disclosure practices is provided in Section 9 (How We Disclose Information).
16.4 California Notice at Collection
California residents are entitled to receive information regarding the categories of Personal Information we collect, the sources from which we collect it, the purposes for which we use it, the categories of recipients to whom it is disclosed, and our data retention practices. Those disclosures are provided throughout this Privacy Policy, including Sections 4 through 12.
16.5 Consumer Health Data
Certain information processed through the Platform may constitute Consumer Health Data under applicable state consumer health privacy laws.
Please review Company’s separate Consumer Health Data Privacy Policy for additional disclosures and rights applicable to Consumer Health Data.
17. CHILDREN’S PRIVACY
The Platform is intended solely for individuals who are at least eighteen (18) years of age. Company does not knowingly permit individuals under the age of eighteen (18) to establish an account, access, or use the Platform, and Company does not knowingly collect Personal Information directly from individuals under the age of eighteen (18).
By accessing or using the Platform, you represent and warrant that you are at least eighteen (18) years of age. If Company reasonably believes that an account has been created or used by an individual under the age of eighteen (18), Company reserves the right to suspend or terminate the account, remove or delete any associated Personal Information, and take any other action Company reasonably deems appropriate, subject to applicable law.
If Company becomes aware that it has collected Personal Information directly from an individual under the age of eighteen (18) in violation of this Privacy Policy, Company will take reasonable steps to delete such information as required by applicable law. If you believe an individual under the age of eighteen (18) has provided Personal Information through the Platform, please contact Company promptly.
18. CHANGES TO THIS PRIVACY POLICY
Company may modify this Privacy Policy from time to time to reflect changes in the Platform, Company’s business practices, applicable law, or regulatory requirements.
If Company makes material changes, Company will provide notice as required by applicable law, including by updating the “Effective Date” date above, posting the revised Privacy Policy on the Platform, sending an email, providing in-Platform notice, or by other reasonable means.
Your continued use of the Platform following the effective date of an updated Privacy Policy constitutes your acknowledgment of the revised Privacy Policy except where additional consent is required by applicable law.
19. CONTACT US
If you have questions regarding this Privacy Policy or Company’s privacy practices, or wish to exercise your privacy rights, please contact:
Control Health LLC
Attn: Privacy
421 Penman St., Suite 310
Charlotte, NC 28203
Email: privacy@controlhealth.ai