Privacy Policy

P1. Who we are and scope of this policy

Ziva Health Inc. is a California corporation. We operate the Ziva Health Platform - a digital health technology company providing wellness tools for general consumers and employers, and clinical care technology infrastructure for licensed healthcare providers.

This Privacy Policy applies to all users of the Platform: General Users (consumer wellness and employer-sponsored users), Patient Users (individuals enrolled by a healthcare provider for clinical care programs), and Clinic Staff Users (clinicians, coordinators, and admins invited by a healthcare organization).

We are not a HIPAA Covered Entity. When we process Protected Health Information (PHI) on behalf of a healthcare provider that is a Covered Entity, we act as a Business Associate under HIPAA and are bound by all applicable HIPAA obligations. General consumer wellness data is not PHI and is governed by this Privacy Policy and applicable state privacy laws.

P2. Information we collect

P2.1 Information you provide directly (all users)

• Account information: name, email address, date of birth, gender, phone number
• Health and wellness data: weight, blood pressure, blood glucose, heart rate, symptoms, medications, conditions, vitals, nutrition logs, activity data
• Communications you send us through support channels
• Feedback, survey responses, and submissions

P2.2 Additional data — Patient Users

• Demographic data entered by your Care Provider at enrollment
• Health readings submitted in response to care program prompts
• Medical history and condition information relevant to your care program
• Care participation data: reading frequency, response patterns, care notes visible to your care team

P2.3 Additional data — Employer accounts

• Organization name, size, department structure, billing information
• Aggregate and anonymized workforce wellness metrics
• Individual employee data is NEVER collected at the employer level - see Section P6

P2.4 Wearable device and third-party platform data

With your explicit authorization, we collect health data from connected devices and platforms including Apple HealthKit, Google Fit, Fitbit, Garmin, Oura Ring, WHOOP, and others.

P2.5 Payment information

Payment processing is handled by Stripe, Apple Pay, or Google Pay. We do not store full payment card numbers.

P2.6 Automatically collected technical data

• IP address, device type, operating system, browser type
• App usage patterns, features accessed, session duration and frequency
• Log data, error reports, crash data, and performance diagnostics
• Approximate geolocation data (with your permission)

P2.7 Sensitive personal information (CPRA)

The following categories are classified as sensitive personal information and receive heightened protection: health and medical information, biometric data, mental health and wellness data, precise geolocation (if enabled), and financial information.

P3. How we use your information

• To create and manage your account and provide Platform services
• To deliver personalized wellness insights, Isabella AI coaching, and health recommendations
• To transmit health data to your Care Provider (Patient Users only, with your authorization)
• To send care program reminders via SMS and automated phone calls (Patient Users)
• To provide aggregate wellness reporting to employer accounts (anonymized, never individual)
• To process payments and manage subscriptions
• To improve Platform features, reliability, and user experience
• To train and improve AI models - using ONLY de-identified, aggregated data
• To send marketing communications where you have separately consented
• To comply with applicable law and respond to lawful legal process
• To protect the security, integrity, and availability of the Platform

P4. Legal basis for processing (GDPR / UK GDPR)

For users in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases:

• Explicit Consent: For processing special categories of health data, biometric data, and mental health data; for marketing communications; for wearable device data integration.
• Performance of a Contract: To deliver services you have requested.
• Legitimate Interests: For fraud prevention, security, analytics, and service improvement, where our interests do not override your fundamental rights.
• Legal Obligation: Where processing is required to comply with applicable law.
• Vital Interests: Where necessary to protect your life or another person's life.

You may withdraw consent at any time without affecting the lawfulness of prior processing.

P5. How we share your information

With your Care Provider (Patient Users only)

With your explicit authorization, your health data is shared with the Care Provider that enrolled you and authorized members of your care team.

With service providers

We share limited data with trusted third-party vendors who assist in operating the Platform: cloud hosting, payment processing, analytics, communications infrastructure, and AI computation. All service providers are contractually bound to protect your data and comply with applicable privacy law including HIPAA where relevant.

For legal compliance and law enforcement

We may disclose data when required by valid legal process. Unless legally prohibited, we will notify you before complying with any government request for your data.

Business transfers

In a merger, acquisition, or sale of assets, your data may transfer to the acquiring entity. We will provide advance notice and an opportunity to opt out.

P6. Employer accounts — data segregation

Employer accounts receive only aggregate, anonymized, de-identified data at the company or department level. Individual employee health data, wellness data, biometric readings, AI coaching interactions, and any personally identifiable information is strictly inaccessible to employer administrators. This is an absolute technical and contractual restriction maintained in compliance with ADA, GINA, CCPA/CPRA, and applicable state employment privacy laws.

P7. HIPAA and protected health information

P7.1 Business Associate status

When Ziva Health processes PHI on behalf of a healthcare provider that is a HIPAA Covered Entity, we serve as a Business Associate under HIPAA and enter into a Business Associate Agreement (BAA) with each Covered Entity provider.

P7.2 PHI security safeguards

• End-to-end encryption: TLS in transit, AES-256 at rest
• Role-based access controls limiting PHI access to authorized personnel only
• Multi-factor authentication for all administrative and clinical access
• Comprehensive audit logging of all PHI access and disclosure
• Regular penetration testing and vulnerability assessments
• Dedicated Privacy Officer and HIPAA compliance program

P7.3 Breach notification

In the event of a breach of unsecured PHI, Ziva Health will notify affected individuals and the relevant healthcare provider within the timeframes required by HIPAA (generally no later than 60 days of discovery).

P7.4 Patient rights regarding PHI

Your rights regarding PHI processed on behalf of your Care Provider are governed by your Care Provider's Notice of Privacy Practices. Contact your Care Provider for access, correction, or restriction of PHI in their systems.

P8. Data retention

• General User accounts: Retained during account lifetime plus 12 months after termination, then deleted or de-identified.
• Patient User clinical data: Retained per applicable healthcare records retention law - minimum 7 years from date of service in California.
• De-identified data: May be retained indefinitely for analytics, research, and AI model improvement.
• Inactive accounts: Accounts inactive for 24+ months receive a 30-day notice before deactivation.

P9. Data security

We implement administrative, technical, and physical safeguards including AES-256 encryption at rest, TLS in transit, role-based access controls, MFA, penetration testing, intrusion detection, employee training, and incident response procedures.

If you believe your data has been compromised, notify us immediately at support@ziva.health with subject line "URGENT – Security."

P10. Cookies and tracking technologies

We use cookies, web beacons, and similar technologies. A cookie consent banner is displayed upon your first visit.

• Essential Cookies: Required for Platform operation. Cannot be disabled.
• Analytics Cookies: Help us understand how users use the Platform. Opt out via browser settings.
• Preference Cookies: Remember your settings and customizations.
• Marketing Cookies: Enable targeted advertising on third-party platforms. Opt out via browser settings.

EU/UK Users: Non-essential cookies are not activated without your prior consent per GDPR/UK GDPR. California Users: We do not sell personal information.

P11. Your privacy rights

All users

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data, subject to legal retention obligations
• Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing
• Opt Out of Marketing: At any time, through account settings or by emailing us

California residents (CCPA/CPRA)

• Right to Know, Delete, Correct, Opt Out of Sale/Sharing, Limit Sensitive Data Use, and Non-Discrimination. Response time: 45 days, extendable by 45 days with notice.

EEA/UK users (GDPR / UK GDPR)

• Restrict Processing, Data Portability, Object to processing, and right to lodge complaints with supervisory authorities (edpb.europa.eu · ico.org.uk).

How to exercise rights

P12. Children's privacy

The Platform is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If we discover an under-13 account, we terminate it and delete all data immediately. Please notify us at support@ziva.health if you believe a child under 13 has registered.

P13. Third-party links and services

The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those sites. We are not responsible for third-party privacy practices. Review the privacy policies of any third-party services you use.

P14. Law enforcement and government data requests

We will only disclose user data to law enforcement or government authorities pursuant to valid and legally binding legal process. We will review all requests carefully, challenge overbroad requests, notify you before complying where legally permitted, and disclose the minimum amount of data necessary. For PHI, all requests are evaluated against HIPAA's law enforcement disclosure provisions.

P15. Changes to this privacy policy

We may update this Privacy Policy to reflect changes in practices, technology, or law. Material changes will be communicated via email or in-app notice at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.

P16. Contact — Privacy Officer