Privacy Policy

1. Scope and the Two Types of Data

TyHealth provides a Personal health space directly to you and patient-portal services on behalf of participating clinics. Data in your Personal space is controlled through your TyHealth account. Medical records held by a clinic—including chart notes, appointments, billing, insurance, and clinic messages—remain controlled and retained by that clinic.

2. Information We Collect

Depending on the features you choose, we may collect:

• Account and contact information, such as name and email
• Profile details and health information you report
• Patient Care conversations, attachments, and saved memories
• Data you choose to sync from Apple Health, Health Connect, or a connected medical or payer record source
• Appointment requests, clinic links, record shares, and feature usage needed to operate and secure the service
• Device, log, and security information

3. How We Use Your Information

We use your information to:

• Provide, personalize, secure, and support TyHealth
• Explain information, compile trends, and respond to questions you ask in Patient Care
• Connect you with clinics and support appointments, messages, billing, and insurance workflows
• Prevent fraud, abuse, and security incidents
• Measure and improve reliability and patient experience
• Comply with legal and regulatory requirements

4. Artificial Intelligence

Patient Care uses artificial-intelligence service providers to generate the response you request. Relevant conversation, profile, memory, device, or connected-record context may be sent to those providers for that purpose. TyHealth does not sell this information or use Personal health data or Patient Care conversations to train foundation models or target advertising. AI responses can be incomplete or wrong and do not replace a qualified clinician.

5. HIPAA and Clinic Records

When TyHealth handles Protected Health Information for a clinic, TyHealth acts under that clinic's instructions and applicable healthcare privacy obligations, including HIPAA where it applies. The clinic's Notice of Privacy Practices governs its medical records. Information you place in a direct-to-consumer Personal space may not be PHI under HIPAA, but we still apply privacy and security safeguards to it.

6. When We Share Information

We do not sell your personal information. We disclose it only as needed to provide the service, at your direction, or as required by law, including to:

• Clinics you link to or information you expressly choose to share
• Connected health, medical-record, and payer services you authorize
• Infrastructure, communications, analytics, support, security, and AI vendors working under contractual restrictions
• Insurers and payment services when needed for a requested workflow
• Authorities or other parties when legally required

7. Your Controls

You can:

• Review and correct Personal profile and health details
• Connect or disconnect device and record sources
• Turn Patient Care memory off or delete saved memories
• Delete a Patient Care conversation and its private attachments; saved memories are separate and remain until you delete them
• Revoke a Personal record share
• Delete your TyHealth Personal account

8. Account Deletion and Clinic Retention

Account deletion permanently disables your login and removes the Personal portion of your account, including your Personal profile, conversations, memories, private attachments, device and connected record data, shares, login methods, and portal links. We may retain limited security, legal, and audit records or de-identified data where permitted or required.

Deleting your TyHealth account does not delete medical or business records held by clinics. Clinics may be legally required to retain charts, appointments, prescriptions, billing, insurance, and communications. Contact each clinic directly to request access, correction, restriction, or deletion where applicable.

9. Security

We use encryption in transit, access controls, audit logging, and other administrative and technical safeguards. No system is completely secure, and you should protect your account credentials and devices.

10. Your Privacy Rights

You have the right to:

• Request access to or correction of eligible information
• Request deletion or restriction where applicable
• Receive a portable copy where required by law
• Appeal or complain about a privacy decision
• Exercise applicable healthcare rights through the clinic that maintains the record

11. Retention

We keep information for as long as needed to provide the service, meet legal and security obligations, resolve disputes, and enforce agreements. Retention for clinic medical records is determined by the clinic and applicable law. Service providers may keep limited copies for a short period for security, abuse prevention, legal compliance, or backup recovery before deletion completes.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise rights over TyHealth Personal data, use the controls in your account or contact TyHealth support. For clinic-held records, contact the clinic's privacy office or use clinic messaging in the patient portal.