Privacy Policy

Plain-English summary

• Further Health is a privacy-first, local-first health information and educational tool, offered as a beta in the United States only. It is not a substitute for your clinician.
• Further Health will never sell your data. We do not "share" it for cross-context behavioral advertising, and we never give it to advertisers, data brokers, insurers, or employers. The only recipients are the service providers in Section 7.
• Your sensitive health data (lab results, genetic data, medical records, health records from Apple Health, cycle entries, wearable detail) is processed and stored on your own devices, encrypted with AES-256-GCM. Copies that sync between your devices or are backed up are encrypted before they leave the device. Your raw genetic file never syncs and is never included in a cloud backup. Health data reaches our servers and our AI service only while premium is active. Chat and Analysis use a pseudonymized copy (direct identifiers removed), plus any photos you attach to a question. We can't control what our AI service provider does with data it receives, so we remove personal identifiers first. Premium document import is the exception: the pages you choose are sent as they are, so they can be read (Section 4.3).
• Analysis keeps running after you close the app. When you start a Premium AI Analysis, the app uploads a pseudonymized copy of your records so our servers can finish the analysis without your phone. We keep that copy encrypted only while the analysis runs and delete it when it ends. The result is kept encrypted until your device collects it, at most thirty (30) days (Section 6C).
• Memory is on by default while premium is active for the account owner: the app uses your past conversations and, once you accept these terms (or the current premium consent on iPhone), notes and visit summaries from records you connected from a patient portal to personalize answers. Short, scrubbed excerpts go with a premium request. You can turn either part off at any time in Settings › Memory on iPhone or Settings › Security & Privacy on Mac (Section 6A).
• When you accept our terms or turn on a sensitive feature, we keep an append-only proof-of-consent record (the time, the version you agreed to, a hash of what you saw, your device identifier, your IP address, and the browser or software used to submit it), linked to your account. These consent records contain no health or genetic data.
• Family profiles. You can add profiles for family members, including children, and manage them from your account. Each has its own encrypted storage on your device. On iPhone, before a question about a family member goes to our AI processing, the app replaces their name with their relationship to you (Section 20).
• You control your data. You can export, delete, or revoke any data source at any time. Revoking a wearable connection, switching to a different wearable account, or deleting your account triggers the deletion steps below.
• You have rights under the CCPA/CPRA, the Washington My Health My Data Act, Nevada SB 370, GINA (for genetic data), the GDPR/UK GDPR where it applies, and other laws. We honor them regardless of where you live.

This summary is for convenience only. The full Privacy Policy below is the binding document. Effective date: October 26, 2026. These changes take effect for you when you accept them in the app, and on November 19, 2026 for anyone who has not accepted by then.

Table of contents

• Section 1. About this Policy
• Section 2. Who we are and how to contact us
• Section 3. Scope
• Section 4. Information we collect
• Section 5. How we use your information and legal bases
• Section 6. Our privacy architecture (on-device and pseudonymized cloud)
• Section 6A. Memory
• Section 6B. Sync and backup between your devices
• Section 6C. Premium AI Analysis on our servers
• Section 7. How we share information and sub-processors
• Section 8. Wearable and connected services
• Section 9. Genetic information (GINA)
• Section 10. Reproductive and sexual-health information
• Section 11. International data transfers
• Section 12. Data security
• Section 13. Data retention and deletion
• Section 14. Your privacy rights
• Section 15. Washington consumer-health-data policy (MHMDA)
• Section 16. Nevada and other consumer-health-data laws
• Section 17. Biometric information
• Section 18. HIPAA status
• Section 19. Health Breach Notification Rule
• Section 20. Children
• Section 21. Cookies and similar technologies
• Section 22. Automated processing and AI
• Section 23. Changes to this Policy
• Section 24. Contact

1. About this Policy

This Privacy Policy explains how Further Health ("Further Health," "we," "us," or "our") collects, uses, stores, shares, and protects personal information when you visit further.health (the "Site") or use the Further Health application or any associated service (together, the "Service").

Further Health is a health information and educational tool. It is not a healthcare provider, and its outputs — including AI-generated discussion of possible explanations, medications, or typical doses — are information to review with your clinician, not a diagnosis or prescription from a licensed professional. Decisions about your health should be made with a licensed healthcare provider. See our Terms of Service and Wellness Disclaimer.

The Service is currently offered as a beta, in the United States only.

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service. Where we rely on your consent (for example, to process special-category health, genetic, biometric, or reproductive data), you may withdraw it at any time as described in Section 14.

2. Who we are and how to contact us

Further Health is the data controller (or "business," depending on the law that applies to you) of the personal information described in this policy. The operating entity is Further Health LLC (postal mail: 30 N Gould St Ste N, Sheridan, WY 82801, USA).

• Privacy and data-rights requests: privacy@further.health
• General support: support@further.health
• Data Protection Officer: not appointed; privacy inquiries go to privacy@further.health.
• EU representative under GDPR Article 27: the Service is offered only in the United States and is not directed to the European Economic Area, so no EU representative has been appointed.
• UK representative under UK GDPR Article 27: the Service is not directed to the United Kingdom, so no UK representative has been appointed.

We will respond to verified requests within the timeframes required by the law that applies to you (typically 30 days under the GDPR/UK GDPR, 45 days under the CCPA/CPRA, and 30 days under the Washington My Health My Data Act).

3. Scope

This policy covers the Site and the Further Health application when used as a consumer product. If we ever offer the Service to a healthcare provider or organization under a separate business-associate or data-processing agreement, that agreement will govern that relationship.

The Service connects to, or imports files from, third-party services at your direction (for example WHOOP, Oura, Apple Health (including the health records you choose to share from the Health app), Quest Diagnostics, LabCorp, MyChart, consumer genomics services such as 23andMe, AncestryDNA, MyHeritage, and TellMeGen, and calendar providers such as Google Calendar, Apple Calendar, and Microsoft Outlook). Those services have their own privacy policies, which we encourage you to read. This policy explains how Further Health handles data we receive on your behalf — it does not change the practices of those services themselves.

4. Information we collect

We collect only the categories of personal information described below, and only for the purposes described in Section 5. Most sensitive health data is processed and stored on your device (Section 6). When you take a consent action (for example, accepting our terms or turning on a sensitive feature), we also keep a proof-of-consent record that contains no health data (Section 4.13).

4.1 Account information

When you create an Account we collect your email address and an optional display name. We never request a government-issued identifier, Social Security number, or full payment-card number except through a payment processor or platform (see Section 7).

4.2 Connected wearables (WHOOP, Oura, Apple Health)

When you authorize WHOOP or Oura through OAuth, our connection service receives a refresh token that lets the app read the categories of data you authorized. The connection service stores that token and the granted permissions (scopes) encrypted. It does not store your provider account identifier itself; it keeps only a keyed one-way hash of it, so it can recognize your connection and match the provider's notifications to it. Your devices use the resulting access to fetch the data classes you authorize directly from the provider; the wearable readings themselves are stored on your devices, not by the connection service. For example:

• WHOOP — heart rate, heart-rate variability (HRV), sleep stages and performance, recovery, strain, workouts, and skin temperature. We never request profile photos, payment information, or social-graph data.
• Oura — heart rate, HRV, body-temperature deviation, blood-oxygen estimates, respiratory rate, sleep stages and score, readiness, and activity. Our connection service does not store Oura readings; they are stored on your devices (see Section 8.2).
• Apple Health / HealthKit — only the data types you specifically authorize in the iOS permission sheet, read on your iPhone: activity (such as steps, active energy, distance, and flights climbed), heart rate, resting heart rate, HRV, VO₂ max, blood pressure, body weight, body fat, BMI, body temperature, blood oxygen, blood glucose, respiratory rate, sleeping wrist temperature, sleep, and workouts. The app reads this data and never writes to Apple Health. How this data syncs and is backed up is described in Sections 6B and 8.3. Health records from the Health app are described in Section 4.5A. We never sell HealthKit data, never use it for advertising or other use-based data mining, never share it with third parties for advertising, and never disclose it to a third party without your explicit permission.

You can disconnect any wearable from inside the Service at any time. Disconnection asks the provider to revoke our access, permanently erases the stored credentials on our connection service, stops new data, removes that provider's data from your device, and starts the deletion timeline in Section 13. Revocation at the provider is best effort: if the provider does not confirm it, the provider may treat the token as valid until it expires, so you can also revoke access from your account with the provider (Section 8).

Switching to a different wearable account. If you reconnect WHOOP or Oura and sign in to a different account with that provider than the one previously connected, the app asks you to confirm the switch before anything changes. If you confirm, the data imported from the previous account (daily summaries, workouts, and body measurements) is removed from your devices, the removal is applied on your other signed-in devices when they next sync, and the app then imports data from the new account. If you choose "Keep current," the new sign-in is discarded and nothing changes. This works the same on iPhone and Mac. On our connection service, the new account's credentials stay inactive until you confirm; an unconfirmed sign-in expires after fifteen (15) minutes and is deleted within a day. When you confirm, the previous account's stored credentials are permanently erased.

4.3 Laboratory results

You can upload lab reports as PDFs or photographs, or connect a laboratory or health-record provider, to import results. We extract structured values (analyte name, value, unit, reference range, specimen, collection date) and keep the underlying source document. Without premium, text is read from the PDF or photo on your device using Apple's on-device text recognition, and the file is not uploaded. The original document and the structured values are stored on your device, encrypted at rest.

Premium document import. With premium, you can instead have our AI read a document. For each page you choose (photos, scans, screenshots, PDFs, or files you share to the app), the app sends a reduced-size copy of the page, the text your phone already read from it, and close-up crops of hard-to-read parts to our servers and our AI service provider, to be read and sorted into your records. Photo metadata such as location is not included. The pages are sent as they are, including any names, dates of birth, or other details printed on them; they are not pseudonymized. Unlike premium chat and analysis (Section 6), we do not remove names or other details from the page images, and we can't control what our AI service provider does with them (Section 7.1). Our servers do not store or log the pages or what is read from them, and they are never kept for beta quality review. We hold the extracted result in memory for a short time, at most one (1) hour, so a retry is not charged twice. We keep a usage record (counts, token use, and cost, with no content) for up to fourteen (14) days after your last import, or until you delete your account if sooner; our general usage and billing records also note the import, without content (Section 13). On your device, the pages are stored encrypted, are not included in backups, and do not sync; you can remove them in Settings › Backup & data › Storage › "Uploaded pages" › "Remove pages" (the values already saved to your records stay). A file you share to the app from another app waits in the app's protected inbox, excluded from backups, until it is imported, for at most seven (7) days. Documents you import for a family member's profile are read the same way, names included (Section 20).

4.4 Genetic data and polygenic scores

You may upload a raw genetic data file (for example from a consumer genomics service) or a clinical VCF. The file is parsed on your device. The Service computes polygenic scores and carrier/trait observations from the variants it analyzes. The raw file is stored on your device, encrypted at rest, and is never transmitted to our servers, our sub-processors, or any third party. Genetic data is treated with heightened protection under Section 9 (GINA).

4.5 Medical and clinical records

You may import C-CDA documents, FHIR bundles, scanned records, or PDFs of clinical notes, imaging reports, or prescriptions. The Service parses these locally and stores them on your device, encrypted at rest. They sync, encrypted, between your own devices and are included in your encrypted backup as described in Section 6B.

4.5A Health records from Apple Health

On iPhone, you can let the app read the health records you choose to share from the Apple Health app. Records can be imported only on iPhone. The app asks for read-only permission to these record types: allergies, conditions, immunizations, lab results, medications, procedures, vital signs, insurance coverage, and clinical notes. It never writes to Apple Health. For each record it reads the record's FHIR content, the FHIR version and resource type, and the name and web address of the source that provided it. Apple Health asks for your permission before any record type is shared, and you can change that permission at any time in the Health app or iOS Settings.

• Storage. The records are stored encrypted on your iPhone in your Further Health data.
• Sync. Health records from Apple Health are never stored in iCloud. If your sync and backup storage is Further Health cloud storage (Section 6B), they sync, encrypted, to your own signed-in devices (including the Mac app): they are encrypted on your device before upload, so our storage provider and our servers receive only encrypted data. If your storage is iCloud (the default when iCloud Drive is available), they are not synced or backed up at all and stay on your iPhone. They are included in an encrypted copy you choose to make yourself with "Make a copy".
• Records that disappear from Apple Health. If a record no longer appears in Apple Health, the app deletes its copy the next time it fully re-reads Apple Health (when you tap Import, or automatically about once a day while the app is open). If every record from a hospital disappears from Apple Health, the app waits until that hospital has been missing for at least six (6) hours before deleting its records. These deletions also apply on your other synced devices. There is no setting for this; it happens automatically so your copy matches what you share in Apple Health.
• Removing them. You can remove the records imported from Apple Health at any time in Records › Apple Health › "Remove Apple Health records". Only the copies that came from Apple Health are removed; a record your hospital also sent through a direct connection stays. The removal also applies on your other synced devices, and automatic Apple Health import stops until you choose to import again.
• Use. We use these records only to show you your own health information and, if you use premium features, to personalize answers (Section 4.9). They are not added to the Memory search index (Section 6A). We never sell them, never use them for advertising, and never share them with anyone without your explicit permission.

4.6 Menstrual-cycle and reproductive information

If you enable cycle tracking (eligible adults only, strictly opt-in), we collect the cycle and symptom information you log. This is reproductive and sexual-health information and is treated as sensitive consumer health data under Sections 10, 15, and 16. It is stored on your device, encrypted at rest, and is subject to the accelerated deletion timeline in Section 13.

4.7 Calendar (optional)

If you authorize a calendar connection, we read the start time, end time, title, and any keywords you choose, solely to let you correlate events with health signals. We do not read attachments, attendees, or meeting links. Calendar contents are stored on your device.

4.8 Device and log information

When you use the Site or Service, our hosting provider automatically logs information that every web service receives — IP address, user-agent, referrer, and the endpoint requested — for operating, debugging, and protecting the Service. We do not correlate these hosting logs with your health data. Separately, certain consent actions create an identity-linked consent-evidence record described in Section 4.13; that record is deliberately tied to your account, but it too contains only proof-of-consent metadata — no health values, lab results, genetic data, or results of any kind.

When you activate a license on a device, we also record, with the license record, the IP address and request User-Agent of that activation, the app version and build, the operating system, the device model, the device label, the platform, and the device's public key, to protect licenses against misuse.

For each premium request we keep a usage and billing record: the feature used, token counts, and cost, linked to your account and device, with no health content (Section 13).

If you allow notifications on iPhone, our servers store your device's push-notification token, encrypted, so we can tell your phone about the status of a Premium AI Analysis. We keep one token for each analysis and delete it once the analysis no longer needs it: soon after it fails or is cancelled, or once you open a finished result or we have sent one reminder. It is deleted at most eight (8) days after the analysis starts, and when you delete your account. Notices are general wording such as "Your analysis is ready", "Open Further Health to continue your analysis" or "Your analysis couldn't finish", and contain no health information, results, or profile names. Apple, which delivers them, receives only the token, an analysis identifier, and the type of notice.

If you send a bug report or feature request from the app, we receive what you write (up to 5,000 characters; email addresses, phone numbers, and similar identifiers are removed automatically before it is stored), whether it is a bug or a feature request, the platform, the app and operating-system version, the device model, and the app's device identifier. If you have an active premium license, the report is linked to your account and its email address. No logs, screenshots, or health data are attached. We keep reports until your account is deleted.

4.9 Premium AI Analysis inputs

When you use a premium feature (premium chat or a Premium AI Analysis), or the app runs one on its own while premium is active (Section 6), a pseudonymized subset of your data (with direct identifiers removed) is transmitted to our servers and our cloud large-language-model sub-processor to generate the answer. That subset can include short summaries of your medical records and health records from Apple Health; short excerpts of your clinical notes (including notes from Apple Health), with direct identifiers redacted; excerpts of your earlier conversations (Section 6A); your explicit answer preferences (reading level, length, and language); any photos you attach to a question (Section 4.10); and the other categories described in Section 6 and in the premium consent the app shows before premium is activated. Automated redaction may not remove every name that appears in free-text notes. In Answers & language, Auto saves no preference; absent choices let the AI adapt to the conversation.

A Premium AI Analysis uses the same pseudonymized categories, but uploads most of them at the start so the analysis can run on our servers (Section 6C). Premium document import is described in Section 4.3; unlike other premium requests, imported pages are not pseudonymized.

4.10 What we do not collect

• We do not collect precise geolocation.
• We do not collect mobile advertising identifiers (IDFA, AAID) and we do not run advertising or marketing trackers.
• We do not collect your contacts or microphone input (dictation is transcribed on your device). We collect only the images you choose to capture or upload in the app. Without premium, a photo of a lab report is read on your device and is not uploaded; with Premium document import it is sent to be read (Section 4.3). If you attach photos (up to five) to a note on a question, they are stored encrypted on your device and, when you use a premium feature with that question, sent once with the request as a reduced-size image with its metadata (including location) removed. The photo content itself is not redacted, so do not attach photos that show information you do not want to send.
• We do not buy personal information about you from data brokers, credit bureaus, or any third party.

4.11 Data-category, sensitivity, and source table

4.12 Categories under the California Consumer Privacy Act

For California residents, the table below maps what we collect to the categories in Cal. Civ. Code § 1798.140(v) and the "sensitive personal information" subcategories in § 1798.140(ae).

We collect personal information from (i) you directly, (ii) the third-party services you authorize, (iii) the documents and files you upload, and (iv) standard server logs. We do not buy personal information from data brokers.

4.13 Consent and compliance records

When you take a consent action in the Service — for example, accepting the wellness Terms and this Privacy Policy, accepting the genome-entry agreement before you read your genome, turning on "Show sensitive results" in the Genome feature, or agreeing to premium cloud processing of your health data before you activate premium — the application sends a device-signed consent-evidence attestation to our licensing API, and our server keeps one append-only record of that action. We keep these records as evidence that your consent was obtained and that it was freely given, specific, and informed. For most features the record does not gate, unlock, or enable the feature — the feature works from your consent on your device, and the record is separate proof that the consent happened. Two exceptions: before every premium request our server checks that you have accepted our terms or the premium cloud-processing consent and have not withdrawn that consent, so withdrawing it stops premium processing; and the app uses your signed acceptance of these terms (or, on iPhone, of the current premium consent) to decide whether health-records Memory may start on by default (Section 6A).

Each record contains only consent metadata:

• The consent event — the fact that you gave consent, the exact time you consented, and the time our server received the attestation.
• What you agreed to — the version number of the disclosure you accepted and a SHA-256 hash of the exact text you were shown (an integrity proof of the wording you agreed to).
• Device proof — a per-install device identifier (a random UUID), the device's public key, and signature-verification flags confirming the attestation was signed on your device.
• Network and environment — the IP address observed when the attestation was uploaded, a coarse description of the browser or application software that submitted it (the request User-Agent), and the platform, operating-system version, and application version.
• Account linkage — the account, user, and license identifier the record belongs to, which our server derives from your authenticated session (we do not accept these values from the application).

These records contain none of your health data. They include no lab values, no genetic data or DNA, no polygenic scores, no cycle or reproductive data, and no wellness observations or results of any kind — only proof that a consent action occurred. They are linked to your account (not anonymous), and we use them solely as legal and regulatory compliance evidence, never for advertising, profiling, marketing, or any other purpose. This is a distinct record from the hosting logs in Section 4.8 and the Premium AI inputs in Section 4.9: it links your device, IP address, and the time of a consent action to your account, but contains no health data. The legal bases are in Section 5.1, the retention rule is in Section 13, and — because the genome-entry and sensitive-results consent records concern health features — they are also addressed as consumer health data in Section 15.

5. How we use your information and legal bases

We use personal information only to deliver the Service you asked for and for closely related operational purposes:

• Authenticate you, run the application, and synchronize data between the connected services you authorize.
• Generate the observations, trend summaries, pattern descriptions, polygenic scores, and educational references the Service produces. These are informational context for conversations with your licensed clinician. Where an AI answer discusses possible explanations, medications, or typical doses, it is information to confirm with your doctor, not a diagnosis or prescription from a licensed professional.
• Provide premium features while premium is active (Sections 6 and 6C), and personalize answers with Memory unless you turn it off (Section 6A).
• Sync your data, encrypted, between your own devices and keep your encrypted backup (Section 6B).
• Respond to your support and privacy requests.
• Maintain the security and integrity of the Service, prevent fraud and abuse, and comply with legal obligations.
• Record and keep proof that you gave consent when you accept our terms or turn on a sensitive feature, so that we can demonstrate the consent was obtained (Section 4.13).
• Conduct internal product analytics on aggregated and de-identified usage data (for example, how many users connected a wearable in a week). We do not use your health data for product analytics. For de-identified data, we maintain the technical safeguards and contractual prohibitions on re-identification that the CCPA requires, and we do not attempt to re-identify it.

We do not use your information for advertising, profiling for marketing, automated decision-making with legal or similarly significant effects, credit scoring, insurance underwriting, or employment decisions.

5.1 Legal bases (GDPR / UK GDPR)

To the extent the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on consent (including explicit consent for special-category data), you may withdraw it at any time without affecting the lawfulness of processing already carried out (Section 14). Withdrawing consent for special-category processing may make parts of the Service unavailable.

6. Our privacy architecture (on-device and pseudonymized cloud)

The Service is built local-first: your sensitive health data lives on your devices. When it leaves a device to sync or back up, it is encrypted on the device first, with keys our servers do not have (Section 6B). Premium features are different: our servers have to read what is sent in order to answer. What they receive, and how long they keep it, is described below and in Section 6C.

• Two-tier on-device model. Raw personal health information (full lab values, raw genetic files, medical records, cycle entries, wearable detail) is held in an encrypted on-device store (Tier 1), encrypted at the column level with AES-256-GCM under a random data-encrypting key. That key is stored only in wrapped (encrypted) form, once for each way you can unlock (Section 12). A separate on-device store (Tier 2) holds a pseudonymized copy from which direct identifiers (such as name, date of birth, and contact details) have been removed. Synchronization is one-way (Tier 1 → Tier 2); there is no reverse path.
• Pseudonymized, not anonymized. We describe the Tier 2 / outbound data as pseudonymized. Although direct identifiers are removed, combinations of remaining values could in principle be re-identifiable, so we continue to treat that data as personal data with full safeguards. We do not claim it is anonymous.
• What leaves your device. Apart from encrypted sync and backup (Section 6B), sensitive raw data does not leave your device in directly identifying form (apart from photos you choose to attach to a question, Section 4.10, and pages you choose to import with Premium document import, which are sent in full, Section 4.3), and health data is sent for processing only while premium is active. How identifiers are removed is described in the next point.
• How we remove identifiers. We can't control what our AI service provider does with the data it receives, so we reduce the risk before anything is sent. Premium chat and analysis data comes from the pseudonymized (Tier 2) copy, and automatic filters on your device and on our servers remove or block direct identifiers such as names, dates of birth, contact details, and record or account numbers. The filters follow fixed rules, so they can miss a name written in ordinary sentences, and they cannot read images such as photos you attach. That is why we call this data pseudonymized, not anonymized. Premium document import is the exception: imported pages are sent as they are, with printed names and dates of birth.
• Your genetic file never leaves your device. This is absolute: the genotype file you import is read, processed, and stored only on your own device, and the file itself is never transmitted to us or to anyone else. What can be sent, and only with a premium request, are interpreted results derived from it (Section 9). Your genotype, the individual variants you carry, and any identifier for them are never included. That derived output is pseudonymized, not anonymous: it is sent on a request you make from your account, so we continue to treat it as your personal data with full safeguards. On Mac, if you have premium, the app also sends per-score calibration figures to our servers so a score can be placed against a reference population; Section 9 describes exactly what they contain.
• Consent-evidence attestations. Separately from the automated data flows above, when you take a consent action the application sends a small device-signed attestation to our server so we can keep proof that consent was obtained (Section 4.13). This attestation carries only consent metadata — the time, the version and a hash of the text you agreed to, a per-install device identifier, and your IP address — and never any health, genetic, or result data.
• What our servers keep from a premium request. Our servers hold the context of a premium conversation in memory for up to twelve (12) hours so a follow-up question can continue it; this is not written to disk. Health content from premium requests is written to our database only for a Premium AI Analysis, encrypted (Section 6C), for the case-file notes described below, and for beta review. During the beta, when beta quality review is switched on, we keep an encrypted, re-pseudonymized copy of premium turns (your question, the context sent, and the answer) for up to ninety (90) days to find and fix errors, and then delete it automatically. This includes the steps of a Premium AI Analysis that run on our servers. Turns that include cycle data, and Premium document import, are never kept for review. Beta review relies on the same basis as premium processing (your acceptance of our terms or your premium consent); withdrawing your premium consent deletes your kept turns, and deleting your account deletes them too.
• Features that stay on your device. "Worth a look" lab notes and charts are worked out and drawn on your device. A chart in a premium chat is drawn on your device from data it already holds; our server only says which chart to show. "Worth a look" notes and your list of questions sync, encrypted, to your other devices (Section 6B); asking the app to look at a question again runs a Premium AI Analysis. Tracking your progress on a plan runs on your device. On Mac, daily fitness coaching with premium sends pseudonymized dates and numbers to our servers and does not use our AI service provider.
• Premium work that runs on its own. While premium is active, the app can run a few premium requests without being asked: a daily review of your case file and plans, Coach suggestions, and a daily read of your wearable data. They use the same pseudonymized data and filters as premium chat. Our servers keep the finished case-file notes for seven (7) days so your other devices don't run them again. For Coach, they keep records with no health content of the suggestions offered (up to thirty (30) days) and of the ones you act on (until you delete your account).
• Supplement and medicine interaction pages. When an answer checks how a supplement and a medicine interact, our servers may fetch a public page from the U.S. National Library of Medicine or the National Institutes of Health (MedlinePlus, DailyMed, or NCCIH). The request is only the page address; it carries none of your data.
• Streaming answers. Premium chat answers appear as they are written. Partial text is sent straight to your device and is not stored.
• Transport security. Outbound network calls are made over TLS 1.2 or higher.
• Support emails. If you email our support address, the contents (including any health information you choose to include) are processed by our email provider (Section 7). We recommend you not include sensitive health details in support emails unless necessary.

6A. Memory

Memory lets the app use what you have already told it, and notes from records you connected from a patient portal, to make answers more relevant to you.

• What it covers. Memory has two parts, each with its own switch: your past conversations, and the text of notes and visit summaries in records you connected from a patient portal. On iPhone the switches are in Settings › Memory ("Use memory in answers" and "Use health records in answers"); on Mac they are in Settings › Security & Privacy under "Semantic recall" ("Search your conversation memories by meaning" and "Search your clinical document text by meaning"). Health records from Apple Health are not part of Memory. The app also keeps a list of facts it has learned from your conversations ("What Further remembers"), which you can review, edit, and remove in Settings › Memory on iPhone.
• On by default. Each part is on by default only while premium is active for the account owner and you have not withdrawn your premium cloud-processing consent. Conversation memory is on by default once you have accepted our terms or the premium consent. Health-records memory is on by default once you accept Terms of Service version 7 or later (version 7 is the version that first described it) or, on iPhone, the current premium consent. If you have never made a choice, no setting is stored; the default applies until you choose. Your on or off choice syncs to your other devices, and the most recent choice applies on all of them. While premium is not active, Memory is off even if you turned it on.
• Family profiles. A profile you manage has its own Memory and its own Memory settings, kept in that profile's encrypted storage (Section 20).
• How it works. To find relevant passages, the app builds an encrypted search index on the device from your conversations and from the record text described above. The index is kept only on that device: it never syncs to your other devices and is never included in a backup or export. Your genetic data is never indexed. The search index itself is never uploaded. When you run a Premium AI Analysis, the facts Memory has learned are part of the pseudonymized copy uploaded for it, unless "Use memory in answers" is off, and are deleted when the analysis ends (Section 6C).
• What is sent. When you use a premium feature (chat or analysis, on iPhone or Mac), the app may include up to eight short excerpts (each up to 800 characters) found through Memory with each search it runs for the request. Before an excerpt leaves your device, raw genetic content is removed and it passes our deterministic privacy filters, which strip direct identifiers such as contact details and record numbers; our server screens the request again before it reaches our AI provider. These excerpts are pseudonymized, not anonymous: they may still contain health details, so we treat them as your personal data. A name you type in your own words may not always be recognized and removed.
• Recent conversation history. Separately from the Memory switches, and even when they are off, a premium chat includes the most recent messages of the conversation you are in (up to 24, each up to 800 characters; messages where personal identifiers are detected are skipped), so answers stay consistent. When "Use memory in answers" is on, our AI service can also search your other saved chats. This uses only conversations that are still saved. To stop it, set chat history to "Don't save new chats" (which also stops older saved chats being used), delete chats, or use "Forget" in Settings › Memory, which excludes everything you said before it.
• Turning it off. You can turn either part off at any time. Turning a part off stops it being used in answers and deletes that part's on-device search index straight away, on this device and, when the choice syncs, on your other devices. It does not delete your conversations, the facts list, or your records; you can delete those separately (on iPhone, Settings › Memory › "Forget everything from our conversations" removes what was learned from conversations, and chat history settings remove conversations). Turning memory back on rebuilds the index from scratch.
• How long it is kept. The on-device index is kept until you turn that part of Memory off, use Forget, or delete the app's data; it is not used while premium is inactive. Your conversations are kept for the period you choose in chat history settings (forever by default, or automatically deleted after 30 days, 90 days, or one year, or not saved at all). Deleting a chat, by hand or automatically, removes its messages but not the facts already learned from it or their index entries; remove those with Forget in Settings › Memory. Our servers do not keep a lasting memory store; excerpts sent with a request are handled as described in Section 6 ("What our servers keep from a premium request"), and the copy uploaded for a Premium AI Analysis as described in Section 6C.

6B. Sync and backup between your devices

• Sync. Your health data syncs between your own signed-in devices. Each device encrypts the data before it is uploaded, using keys derived from a random secret created on your device. That secret is kept in your device keychain and reaches your other devices either through iCloud Keychain (older accounts) or wrapped under a key derived on your device from your account password; our server stores only that wrapped (encrypted) form, so its protection depends on the strength of your password. Our servers and our storage provider store only encrypted data under keyed, opaque names.
• Where it is stored. By default, encrypted sync and backup data is stored in your own iCloud Drive. If iCloud Drive is not available, or you choose it (on Mac, "Switch to Further Health cloud"), it is stored in Further Health cloud storage, which runs on Cloudflare R2. Health records from Apple Health are never stored in iCloud (Section 4.5A). Other data you allow the app to read from Apple Health (such as activity, heart rate, sleep, and workouts) is included, encrypted, in whichever storage you use, including iCloud (Section 8.3).
• What is not synced or backed up. Your raw genetic file never syncs and is never included in an iCloud or Further Health cloud backup; on Mac it is included only in an encrypted backup file you choose to export yourself. The Memory search index never syncs and is never backed up or exported.
• Deletion. When your account is deleted, we delete all of your encrypted data in Further Health cloud storage, including uploads that arrive just after deletion begins, before we delete your account records. When newer copies of your data are stored, earlier encrypted copies are removed automatically after the new copy is saved. We cannot delete data in your own iCloud; if you switch from iCloud to Further Health cloud storage, your existing encrypted iCloud copy stays in your iCloud until you delete it, and you can delete it in your iCloud settings.
• Account recovery. We do not hold a usable copy of your encryption keys. Recovery uses factors you set up on your devices (such as your passphrase and recovery code). If you lose all of them, you may lose access to your encrypted data.
• Export. You can export your data at any time from Settings, as an encrypted file or a readable CSV file.

6C. Premium AI Analysis on our servers

A Premium AI Analysis can take several minutes. So that it keeps running when you close the app or your phone locks, it runs on our servers instead of going back and forth with your phone.

• What is uploaded. When you start an analysis, the app uploads the pseudonymized (Tier 2) copy of your lab results, wearable data, workouts, body measurements, medications, the facts Memory has learned, and your medical records. If "Use memory in answers" is off, the facts are not uploaded; if "Use health records in answers" is off, your medical records are not uploaded (Section 6A). Each line passes the same on-device privacy filter as any premium request (Section 6).
• What your phone sends only when asked. Your conversations, the full text of your record documents, and your genetic results are not uploaded. If the analysis needs one of them, our server asks your phone, and your phone sends only what was asked for, filtered the same way. Those answers are kept encrypted with the analysis and deleted when it ends. Our server does not ask for your conversations while "Use memory in answers" is off.
• Never your genome. Your raw genetic file, your genotype, and any variant identifiers are never sent. Genetic results go only in the interpreted form described in Section 9. Our servers also refuse any upload that looks like raw genetic data.
• How it is stored. The upload is written to our database encrypted (AES-256-GCM) with a key held by our servers, because our servers need to read it to run the analysis. Each copy is tied to one person, so a family profile you manage has its own copy. It is used only for that analysis.
• How long it is kept. The uploaded copy is deleted as soon as the analysis ends, whether it finishes, fails, or you cancel it. Normally that is minutes. If the upload never completes, it is deleted after twenty-four (24) hours. If the analysis has to wait for your phone, it is deleted after seven (7) days. After an analysis ends we keep a record of it with no health content (its status, the kinds of data it read and for which dates, and counts) until its result is collected or the analysis fails, and then for seven (7) days; at most thirty-seven (37) days.
• The result. The finished result is kept encrypted until your device collects it, and then deleted. If it is never collected, it is deleted after thirty (30) days.
• Notifications. If you allow notifications, our servers can send your phone notices about the analysis (Section 4.8). They contain no health information.
• Beta review. While beta quality review is on, steps of an analysis can be kept for review as described in Section 6.
• Your control. You can cancel an analysis at any time, which deletes its copy. Withdrawing your premium consent (on iPhone, Settings › Privacy & security › Premium cloud analysis) stops new analyses and ends a running one at its next step, which deletes its copy. Deleting your account deletes the copy and any result, and stops a running analysis.

7. How we share information and sub-processors

Further Health will never sell your data. We do not share your information with third parties for their own marketing, advertising, profiling, or data-broker purposes, and we never share your data with insurers or employers. We do not "share" personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.

We share limited information only with:

• Service sub-processors and providers that operate the Service, under contract or, for our AI service provider, under its own terms of service (see the directory below).
• The connected services you authorize. When you authorize a service such as WHOOP or Oura, we exchange authentication tokens to receive the data you asked us to receive.
• Legal and safety recipients when required by law (for example, a valid subpoena), when necessary to investigate fraud or protect the rights, property, or safety of any person, or in connection with a business transfer (in which case the successor will be bound by this policy or one at least as protective). For reproductive and sexual-health data, see the heightened protections in Section 10.

When we use sub-processors, we do so under written contracts that require confidentiality, security, and use only for the purposes we instruct. Our AI service provider is the exception: it processes data under its own terms of service, not a contract with us (Section 7.1). We will publish or notify any change to our sub-processor list at least thirty (30) days before it takes effect, and we will identify the then-current payment processor at the point of purchase. A current list is available on request from privacy@further.health.

7.1 Sub-processor directory

Our AI service provider. It processes what we send under its own terms of service. We can't control what it does with data it receives, so we limit what it gets: only what a request needs, pseudonymized (Section 6), except Premium document import pages, which are sent as they are (Section 4.3). We never sell your data. You can ask privacy@further.health which provider we use.

If we ship through another distribution platform, that platform operator may process your account/billing relationship under its own terms; we will update this directory accordingly.

8. Wearable and connected services

Each connection is governed by the third party's own terms and privacy policy as well as this policy.

8.1 WHOOP

When you connect WHOOP, we exchange tokens under WHOOP's API Terms of Use and use WHOOP data only to power wellness features for you. We do not market, sell, license, or lease WHOOP data, and we do not expose it to any third party except as described in Section 7. Our connection service does not store WHOOP readings; it stores WHOOP's change notifications, encrypted, and deletes them after thirty (30) days, or immediately when your account is deleted. To revoke access, visit your WHOOP account at whoop.com.

8.2 Oura

When you connect Oura, we exchange tokens under the Oura Cloud API Agreement. Oura may collect use data related to your use of the Oura API and platform, including data collected through your authorization of the connection, and may use such usage data for its business purposes. We use Oura data only to power wellness features for you; we do not use Oura data in advertisements; we do not directly or indirectly disclose, market, sell, license, or lease Oura data to any third party (including advertisers and data brokers); and we comply with Oura's Brand Guidelines. Our connection service does not store Oura readings; Oura data is stored on your devices. Oura-derived information sent with a premium request is handled like other premium request content (Section 6): held in server memory for up to twelve (12) hours and, during the beta when beta quality review is on, kept encrypted for up to ninety (90) days. With respect to data flowing between Further Health and Oura, each party acts as an independent data controller within the meaning of Article 26 of the GDPR. To revoke access, visit cloud.ouraring.com.

8.3 Apple Health / HealthKit

When you grant the iOS app access to specific HealthKit data types, including health records you choose to share from the Health app (Section 4.5A), the Service reads those types on your iPhone and stores them encrypted in your Further Health data. Health records from Apple Health are never stored in iCloud and sync only through Further Health cloud storage. Other HealthKit data (such as activity, heart rate, sleep, and workouts) syncs and is backed up, encrypted, through the storage you use (Section 6B); if that storage is iCloud, this encrypted data is stored in your own iCloud Drive. We never sell HealthKit data, never use it for advertising or other use-based data mining, never share it with third parties for advertising, and never disclose it to a third party without your explicit permission. You can remove imported Apple Health records in the app, and revoke any HealthKit permission at any time in the Health app or iOS Settings.

8.4 Laboratory and clinical-record providers

When you connect a laboratory or health-record provider, we use a one-time credential or OAuth token to fetch the records you choose. For a patient-portal connection (such as MyChart), our connection service stores the portal's refresh token and granted permissions, encrypted, together with the portal's address, the portal's patient identifier for you, and the connection's name. Your device uses it to fetch records directly from the portal; the connection service never receives the records. It keeps a log of when your devices fetch, with no health data, for up to ninety (90) days. When you disconnect, the token and permissions are erased; the rest of the connection record is kept until you delete your account. Records are stored on your device and sync, encrypted, between your devices (Section 6B). If the provider later marks a record as entered in error or ruled out, the app deletes its copy, including on your other synced devices. A record the provider simply stops sending is kept until you delete it or disconnect that provider. You can disconnect any provider at any time, and choose to delete the data imported from it.

8.5 Calendar providers

The calendar connection is read-only and limited to the start time, end time, title, and any keywords you specify. We do not read attachments, attendees, or meeting links. You can revoke calendar access at any time.

9. Genetic information (GINA)

We treat genetic information with extra care because it can never be re-issued.

• Your raw genetic data file is parsed locally on your device and is never transmitted to our servers or to any third party. This is the strongest guarantee in this Policy and it has no exceptions: the file itself, the individual variants you carry, and any identifier for them never leave your device.
• What can leave your device is the result, not the data. Only with a premium request (chat or a Premium AI Analysis), the app can send interpreted results from your genetic report: the name of a finding, a short plain-language interpretation, how strong the evidence is (for example "strong" or "likely pathogenic"), and its limits. Your genotype, the variants you carry, variant identifiers, positions, and raw statistics are never included; a result that would reveal them is removed before it is sent, and our servers check again on arrival. Results our app treats as sensitive, and cancer-related results, are sent only if you have unlocked them in the Genome feature. For a Premium AI Analysis, your phone sends them only when the analysis asks for them, and they are deleted with the analysis (Section 6C). This derived output is pseudonymized, not anonymous: you request it from your account and the answer comes back to you, so we continue to treat it as your personal data with the full safeguards in this Policy. The genetic file itself is never transmitted in any circumstance.
• Score calibration on Mac. On Mac, if you have premium and have not withdrawn your premium cloud-processing consent, the app sends calibration figures to our servers automatically when it computes your polygenic scores for your own profile (never a managed family member's), so each score can be compared with a reference population. For each eligible score (built from at least 1,000 variants, up to 32 scores per request) it sends: the score's catalog identifier; the score's raw weighted sum; how many variants were used, in total and unsupported; the versions of the analysis pipeline and reference panel; and your nearest reference ancestry group (a broad continental group code) with its calibration quality. No genotypes, variants, positions, or file names are sent, and scores for Alzheimer's disease (APOE), the opt-in cancer scores, and behavioral or psychiatric traits are never sent. Our server returns a coarse result for each score and does not store the figures it receives; it keeps only a record that a request was made, its status, and (if our abuse protection is switched on) a keyed fingerprint per score per day, all deleted when your account is deleted. Withdrawing your premium consent stops this.
• The consent-evidence record we keep when you accept the genome-entry agreement or turn on sensitive results (Section 4.13) contains no genetic data — no variants, genotypes, or polygenic scores — only proof that you consented.
• We never use, sell, transfer, or disclose genetic data to health insurers, life insurers, employers, employment screeners, or anyone making credit, lending, or housing decisions, consistent with the U.S. Genetic Information Nondiscrimination Act (GINA, Pub. L. 110-233) and analogous state and international laws.
• We do not include genetic information in any advertising, analytics, or research dataset.
• Polygenic scores and genetic observations are probabilistic, research-grade, educational wellness information — not a clinical genetic test, not a diagnosis, and not medical advice. They are calibrated to ancestry groups and may be less accurate for some ancestries, and should be confirmed clinically. See the Wellness Disclaimer.
• You can delete your genetic data and the derived findings from inside the Service at any time. On the Mac where you imported it, deleting your genome removes the raw file and its results. On iPhone, Settings › Backup & data › "Remove genetic data" removes your genetic results from that iPhone and from your other synced devices; your raw genetic file is only on the Mac where you imported it. Encrypted cloud backups are updated the next time a backup runs.

10. Reproductive and sexual-health information

We treat reproductive and sexual-health information with heightened sensitivity in light of the post-Dobbs legal landscape, the Washington My Health My Data Act, Nevada SB 370, and similar laws.

• The Service's cycle-tracking and related reproductive features are strictly opt-in (eligible adults only). You can disable them at any time; on disabling, we delete the data on the accelerated schedule in Section 13.
• Reproductive and sexual-health data is processed and stored on your device, encrypted at rest, and is never shared with advertisers, data brokers, insurers, or employers.
• We do not respond to law-enforcement or other third-party requests for reproductive or sexual-health data without lawful process, and we will challenge requests that are facially invalid or that we believe are inconsistent with applicable law. Where law allows, we will notify you of a request before complying so you have an opportunity to object.
• The Service does not infer pregnancy, fertility status, ovulation for contraceptive purposes, or any clinical condition from cycle data. Cycle features are wellness pattern observation only — not contraceptive, not a fertility/TTC tool, not diagnostic, and not an aid in detection.

11. International data transfers

The Service is intended for users in the United States and is not directed to individuals located in the European Economic Area or the United Kingdom; we do not knowingly target them.

The Service is operated from the United States. If you nonetheless access the Service from the EEA, the United Kingdom, Switzerland, or another jurisdiction with data-transfer rules, the limited data we process on our cloud sub-processors may be transferred to and processed in the United States. We rely on the European Commission's Standard Contractual Clauses (SCCs), including (where applicable) Module 2 (Controller to Processor) and Module 3 (Processor to Processor), on equivalent UK and Swiss addenda, and on supplementary technical measures — including encryption in transit and at rest, column-level on-device encryption for health data, pseudonymization, and a deterministic outbound privacy filter — to provide appropriate safeguards. The applicable module is identified in our agreement with each sub-processor. Our AI service provider is not covered by such an agreement: it processes data under its own terms of service (Section 7.1). You may request a copy of the relevant transfer mechanism from privacy@further.health.

12. Data security

Security is the foundation of the Service rather than an afterthought.

• Sensitive on-device health data is encrypted column-by-column with AES-256-GCM. The data is encrypted under one random data-encrypting key (DEK). Each way you can unlock (your passphrase, Face ID, an app passcode, your account sign-in, or a recovery code) has its own key-encrypting key (KEK) that wraps the DEK; the passphrase KEK is derived with PBKDF2-SHA256 at 1,000,000 iterations. Changing your passphrase re-wraps the DEK rather than re-encrypting every record.
• Sensitive raw data — full lab values, medical records, health records from Apple Health — leaves your device in readable form only when you choose to: pages you import with Premium document import (Section 4.3). Otherwise it leaves only encrypted, for sync and backup (Section 6B). Your raw genetic file is not transmitted (Section 9). Premium chat and analysis receive only a pseudonymized copy, after a deterministic outbound privacy filter and an additional safety check, together with any photos you attach to a question (Section 4.10). The copy held for a Premium AI Analysis is encrypted in our database and deleted when the analysis ends (Section 6C).
• Your vault files on iPhone are protected by iOS until you first unlock your iPhone after it restarts.
• Unlocking on iPhone. After you unlock the app, it keeps your data unlocked for the time you choose in Settings › Privacy & security › "Require Face ID": Immediately, or after 1, 5, or 15 minutes (5 minutes unless you change it). During that time a chat or analysis that was already running can finish, and a backup can run if it is on. When the time runs out, the app locks, and opening it again needs Face ID, your app passcode, or your passphrase. Locking your iPhone ends the time early: the app locks as soon as iOS next lets it run. Tapping "Lock Further Health" locks at once. Choosing a longer time asks you to confirm it's you first.
• Background work while your iPhone is locked. After you first unlock your iPhone following a restart, the app can do some work in the background even while the phone and the app are locked: keep its private on-device copy and search index up to date, read new Apple Health data, back up or sync, fetch new patient-portal records, and move a running Premium AI Analysis forward. To do this, iOS keeps a copy of the app's data key in this iPhone's keychain. That copy never leaves this iPhone, is not synced or backed up, and is removed when you erase the app's data or reset the vault. Opening the app still needs Face ID, your app passcode, or your passphrase.
• Outbound network calls are made over TLS 1.2 or higher.
• We implement organizational and technical measures consistent with Article 32 of the GDPR (Section 12.1).

No security program is perfect. If you discover a vulnerability, please write to privacy@further.health and we will respond promptly.

12.1 Technical and organizational measures (Article 32 GDPR)

• Pseudonymization and encryption. Column-level AES-256-GCM for sensitive on-device data; a random data-encrypting key wrapped by a separate key for each unlock method (the passphrase key derived with PBKDF2-SHA256); deterministic pseudonymization on outbound calls; TLS 1.2+ for all transport; encryption of backups and exports at rest.
• Confidentiality. Least-privilege engineering access; confidentiality obligations for all contractors and employees and in every sub-processor agreement; multi-factor authentication on administrative consoles; just-in-time privileged access for production systems.
• Integrity. Versioned source control with mandatory review and automated security checks before merge; cryptographic integrity (GCM authentication) tags on every encrypted column to detect tampering; deterministic re-execution of the outbound privacy filter on every call.
• Availability and resilience. Redundant hosting; automated failover for critical surfaces; encrypted database snapshots retained for a rolling window; documented disaster-recovery procedures.
• Restoration after incident. Tested backup-restoration procedures; documented incident-response runbooks; root-cause and remediation reports for every incident.
• Testing and evaluation. Continuous static-analysis and dependency-vulnerability scanning; periodic penetration testing; periodic review of these measures; a vulnerability-disclosure channel.
• Data minimization and purpose limitation. We collect only the categories in Section 4 and use them only for the purposes in Section 5; we do not repurpose personal information without a new lawful basis.
• Sub-processor due diligence. Each sub-processor undergoes a written security and privacy review before onboarding and is monitored for compliance.
• Personnel and training. All personnel with access to personal data complete privacy- and security-awareness training at least annually.
• Logging and monitoring. Audit logs of administrative actions; alerting on anomalous access; logs retained only as long as needed for security and audit.

13. Data retention and deletion

We keep personal information only as long as needed for the purposes in Section 5, plus a short period for legal, security, audit, or accounting purposes.

You can delete your account and its data yourself on iPhone in Settings › Your account › Delete account, or request deletion of any data we hold by writing to privacy@further.health. We will complete verified deletion within thirty (30) days under the Washington My Health My Data Act, within forty-five (45) days under the CCPA/CPRA, and within thirty (30) days under the GDPR/UK GDPR (extendable by two months for complex requests, with notice).

14. Your privacy rights

Subject to the law that applies to you and to identity verification, you have rights to:

• Access the personal information we hold about you (GDPR Art. 15; CCPA § 1798.110).
• Correct inaccurate personal information (GDPR Art. 16; CPRA right to correct).
• Delete personal information (GDPR Art. 17; CCPA § 1798.105; MHMDA RCW 19.373.030; analogous state laws).
• Restrict certain processing or object to processing based on legitimate interests (GDPR Art. 18, 21).
• Data portability — receive a copy in a machine-readable format (GDPR Art. 20; CCPA right to know).
• Withdraw consent at any time, without affecting the lawfulness of prior processing (GDPR Art. 7(3)).
• Opt out of sale or sharing of personal information (CCPA/CPRA § 1798.120). We do not sell or share personal information for cross-context behavioral advertising; this right is preserved by default.
• Limit use of sensitive personal information (CPRA § 1798.121).
• Non-discrimination for exercising any of these rights.
• Appeal a denial (under state laws that provide an appeal right; see Sections 15–16).
• Lodge a complaint with a supervisory authority — your local data-protection authority in the EEA, the UK Information Commissioner's Office, or your state attorney general in the US.

To exercise any right, write to privacy@further.health. You can also delete your account yourself on iPhone in Settings › Your account › Delete account. We may need to verify your identity. You may use an authorized agent under the CCPA/CPRA; we may require written proof of authorization. We do not charge a fee for verified rights requests. We honor verifiable opt-out signals such as Global Privacy Control (GPC) where applicable.

One limited qualification applies to the consent-evidence records in Section 4.13. Because those records are our proof that your consent was obtained, where the law permits us to keep proof of consent to comply with a legal obligation or to establish, exercise, or defend legal claims (for example, GDPR Article 17(3)(b) and 17(3)(e)), we may retain the minimum necessary rather than fully erase them in response to a deletion request. We honor Washington consumer-health-data deletion rights over the health-feature consent records listed in Section 15.1 as described in Section 15.

Residents of California: in the twelve (12) months preceding this policy, we collected the categories in Section 4 for the purposes in Section 5; we did not sell or share personal information for cross-context behavioral advertising; and we did not knowingly sell or share personal information of consumers under sixteen (16). The Service is offered only to adults aged eighteen (18) or older.

14.1 State-by-state rights summary

Where the law of your residence imposes additional or stronger requirements, we honor those as well.

15. Washington consumer-health-data policy (MHMDA)

This section satisfies our obligation to publish a separate consumer-health-data privacy policy under RCW 19.373.020 of the Washington My Health My Data Act (MHMDA) and applies in addition to the rest of this Privacy Policy. This section, together with the rest of this Policy, is our MHMDA Consumer Health Data Privacy Policy.

15.1 Categories of consumer health data we collect

• Biometric and physiological data, including heart rate, HRV, sleep stages, recovery, strain, respiratory rate, blood-oxygen estimates, and body temperature (from wearables).
• Diagnoses, conditions, medications, immunizations, and other clinical information you import from medical records.
• Laboratory results and reference ranges.
• Genetic data and findings derived from genetic data.
• Reproductive and sexual-health data, including menstrual-cycle information when you enable cycle tracking.
• Mental-health and wellness self-reports.
• Health records you choose to share from Apple Health (Section 4.5A).
• Health information an account holder adds about a family member they manage (Section 20).
• Memory: facts learned from your conversations and excerpts of your conversations and records used to personalize answers (Section 6A).
• Health-related inferences and observations the Service generates from the above.
• Consent and authorization records relating to health features — specifically, proof that you accepted the genome-entry agreement, turned on "Show sensitive results", or agreed to premium cloud processing of your health data before activating premium (Section 4.13). These are proof-of-consent metadata only (time, version, a hash of the text you saw, device identifier, and IP address); they contain no health values, genetic data, or results.

15.2 Sources

We collect consumer health data from you directly, from the third-party services you authorize (Section 8), and from the documents and files you upload.

15.3 How and why we collect and use consumer health data

We collect and use consumer health data only to provide the wellness and educational features you request, as described in Section 5, and we obtain your consent for the collection and (where applicable) sharing of consumer health data separately from other terms.

15.4 Categories of consumer health data shared, and recipients

We share consumer health data only with the sub-processors listed in Section 7, only as necessary to operate the Service for you: in encrypted form for sync and backup storage; after pseudonymization for premium chat and Premium AI Analysis (including the encrypted copy held while an analysis runs, Section 6C); and, for Premium document import only, the pages you choose, in full, to be read (Section 4.3). We do not sell consumer health data, and we do not share it for advertising or profiling. We do not collect or use a "geofence" around any facility that provides in-person health-care services.

15.5 Affiliates with whom data is shared

None at present.

15.6 Your MHMDA rights

• Right to confirm whether we collect, share, or sell your consumer health data, and to access it.
• Right to withdraw consent to the collection and sharing of your consumer health data.
• Right to have your consumer health data deleted, including (where technically feasible and lawful) to direct us to ask our sub-processors and affiliates to delete it.
• Right to non-discrimination for exercising any of these rights.
• Right to appeal a denial. We will respond to an appeal in writing within forty-five (45) days, explaining the decision. If your appeal is denied, you may submit a complaint to the Washington State Office of the Attorney General using the consumer-complaint form at atg.wa.gov/file-complaint, or by writing to: Office of the Attorney General, Consumer Protection Division, 800 Fifth Avenue, Suite 2000, Seattle, WA 98104.

If you ask us to delete or withdraw consent for the health-feature consent-evidence records listed in Section 15.1 and described in Section 4.13, we will honor that request to the extent the My Health My Data Act requires. Because those records are our proof that consent was obtained, where a law separately requires us to keep proof of consent we may retain only the minimum necessary and will delete or de-identify the rest; withdrawing consent also stops the corresponding feature from creating new consent records.

15.7 How to exercise these rights

Email privacy@further.health with the subject line "Washington consumer health data" and tell us which right you wish to exercise. We will respond within thirty (30) days (extendable by fifteen (15) days when reasonably necessary, with notice).

16. Nevada and other consumer-health-data laws

For residents of Nevada, this section addresses Nevada SB 370 (NRS Chapter 603A, consumer health data). We do not sell your consumer health data, and we will honor a verified request to opt out of any sale and to confirm our collection of your consumer health data. We do not use a geofence around an in-person health-care facility to identify or track consumers or to send health-related advertising. To exercise a Nevada right, email privacy@further.health with the subject line "Nevada consumer health data." We honor comparable consumer-health-data protections in other states (such as Connecticut's consumer-health-data amendments) as described in Sections 14–15.

17. Biometric information

Several U.S. state laws regulate biometric information separately, including the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/1 et seq.), the Texas Capture or Use of Biometric Identifier Act (CUBI, Tex. Bus. & Com. Code § 503.001), and Washington's biometric statute (RCW 19.375).

• We do not collect, use, store, or disclose any biometric identifier (such as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry) for identification of individuals, and we do not generate any such identifier from photographs or voice recordings.
• Wearable physiological data (heart rate, HRV, sleep, respiratory rate, blood-oxygen estimates, temperature) and laboratory analyte values are used solely for the wellness purposes in Section 5. We do not use them to identify or authenticate any person.
• Genetic data is treated separately under Section 9 (GINA) and is never used for identification.
• Where state law requires written consent before collecting a regulated biometric identifier, we obtain it at the point of collection; where no regulated identifier is collected, we still apply the Section 12 safeguards to all physiological data.

18. HIPAA status

Further Health is not a HIPAA Covered Entity, and we do not act as a Business Associate of any Covered Entity in our consumer service. The information you provide is generally not regulated as "protected health information" under HIPAA. That HIPAA does not apply does not mean your information is unprotected — it is protected by this Policy, by the Section 12 security measures, and by other laws (the FTC Act, the Washington My Health My Data Act, the GDPR, and others). If we ever offer the Service under a Business Associate Agreement to a provider or organization, we will do so under a separate written agreement.

19. Health Breach Notification Rule

The Service holds personal-health-record-related information. If we discover a breach of unsecured individually identifiable health information, we will notify affected individuals without unreasonable delay and no later than sixty (60) calendar days after discovery. For breaches affecting 500 or more individuals, we will notify the U.S. Federal Trade Commission and prominent media within the same period; for breaches affecting fewer than 500 individuals, we will notify the FTC as the Rule requires — in each case in accordance with the FTC Health Breach Notification Rule (16 C.F.R. Part 318) and any other applicable law, subject to any law-enforcement delay request. We will also comply with applicable state breach-notification laws.

20. Children

Accounts are for adults aged eighteen (18) or older, and the Service is not directed to children. An adult account holder may add a profile for a child they parent or are the legal guardian of. In that case the account holder, not the child, provides the information, and we process it only to provide the Service to the account holder, with the same protections that apply to their own health information. We comply with the U.S. Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501-6506) and analogous laws.

The profile has its own separate storage on the account holder's device. Any backup of it is encrypted, including the profile's name, so that only the account holder's account and keys can open it.

On iPhone, when a question about a managed profile goes to our AI processing, the app first replaces the person's name with the word you use for them (for example, "my daughter") and describes them only by that and a general age range, never their date of birth. Only that person's name is replaced, not other names you type. Please don't add other identifying details about family members to your questions. When you ask us to read a document you upload for a family member, such as a lab report, our AI processing reads the document as it is, including any name printed on it, the same way it reads your own documents.

We never sell this information or use it for advertising.

The account holder can view, export or remove a managed profile at any time. Removing it:

• deletes it from that device straight away;
• stops new AI processing for that profile;
• deletes its backups from our servers shortly afterwards;
• removes it from the account holder's other devices the next time they sync.

We keep a small record of the removed profile (the relationship, an age range, and when it was added) until you delete your account, so it can't be silently restored. An analysis already running for it is deleted when it ends or expires. Deleting your account erases every profile you manage.

If you believe a child has created an account or given us information directly, write to privacy@further.health. We will delete it promptly and confirm in writing.

21. Cookies and similar technologies

The Site does not run advertising or analytics cookies, and we do not use any cookie or similar technology to track you across other websites or over time. The only cookies and browser storage the Site uses are strictly necessary to run the Service:

• Sign-in and device cookies. When you sign in on the website, we set cookies that are strictly necessary to keep you signed in and to recognize your browser as a device on your account — for example, to apply the new-device security check. They are not used for tracking.
• Browser local storage. The Site uses your browser's local storage to remember display preferences such as light or dark mode, and small amounts of short-lived state needed to finish a step you have started. This stays in your browser.
• Security check (Cloudflare Turnstile). On the sign-up, sign-in, waitlist, and password-reset pages we use Cloudflare Turnstile, a privacy-preserving bot-protection check, to stop automated abuse. To run the check, your IP address and a challenge token are sent to Cloudflare, Inc., our sub-processor for this purpose (Section 7.1). Turnstile shows no ads and is not used to profile you.

Our hosting provider writes standard server access logs as described in Section 4.8. These are not cookies and are used only for the limited operational purposes in that section. We do not sell or share personal information for cross-context behavioral advertising, so the Service has no such opt-out to interpret; we nonetheless honor any verifiable opt-out request received through Global Privacy Control (GPC), the "Do Not Track" (DNT) header, or by direct email.

22. Automated processing and AI

The Service uses statistical, algorithmic, and machine-learning techniques, including (for Premium AI Analysis) a large language model, to organize your data and surface patterns. Further Health does not use these outputs to make automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22(1) of the GDPR (such as decisions about employment, insurance, or credit). Outputs are presented to you for your own use in conversations with your licensed clinician, who remains the decision-maker for any clinical action. Where outputs are AI-generated, they are identified as such. AI outputs may be incomplete or contain errors; where they discuss possible conditions, medications, or typical doses, they are information to confirm with your clinician, not a diagnosis or prescription from a licensed professional. See the Wellness Disclaimer. The Service is not a substitute for a licensed clinician.

23. Changes to this Policy

What changed in this version (October 26, 2026): Profiles you manage for family members, including children (Sections 4.11, 6A, 13, 15.1, and 20); Premium document import, which sends the pages you choose as they are so our AI can read them (Sections 4.3, 4.9, 4.10, and 7.1); a Premium AI Analysis that runs on our servers using an encrypted copy of your pseudonymized records, deleted when the analysis ends, with the result kept until your device collects it (new Section 6C, and Sections 4.9, 4.11, 6, 6A, 9, 13, and 15.4); analysis notifications and the push token we keep for them (Section 4.8); premium work the app runs on its own, and the usage and billing records we keep (Sections 4.8, 6, and 13); which features stay on your device, and the public interaction pages our servers fetch (Sections 6 and 7.1); how we remove identifiers before premium AI, its limits, and that our AI service provider is now described by category (Sections 6, 7, and 7.1); a more exact description of the interpreted genetic results that premium features can send (Section 9); how long the iPhone app stays unlocked, and the background work it can do while your iPhone is locked (Section 12); deleting your account in the app (Sections 13 and 14); and a corrected description of how your on-device encryption keys are protected (Sections 6 and 12). Because these changes affect how health data is used, we ask you to accept this version before you continue. These changes take effect for you when you accept them in the app, and on November 19, 2026 for anyone who has not accepted by then.

We may update this Privacy Policy from time to time. The "Effective date" at the top reflects the most recent change. Material changes will be communicated through the Service or by email at least thirty (30) days before they take effect, and where required by law (or where the change materially affects special-category processing or your consent) we will obtain your renewed consent. Your continued use of the Service after a non-material change constitutes acceptance of the updated policy.

24. Contact

For privacy questions, data-rights requests, or to report a security concern:

• Privacy / data rights: privacy@further.health
• Support: support@further.health
• Operating entity: Further Health LLC

See the companion Terms of Service and Wellness Disclaimer.