ArxovaARXOVATM← Back to home

Arxova Consumer Health Data Privacy Policy

Effective Date: August 15, 2026

Last Updated: August 15, 2026

HealthKey Labs, LLC d/b/a Arxova (“Arxova,” “we,” “us,” or “our”) respects your privacy and is committed to providing transparency and meaningful control over your Consumer Health Data.

This Consumer Health Data Privacy Policy (“CHD Policy”) supplements the Arxova Privacy Policy and describes our practices regarding Consumer Health Data under applicable state consumer health privacy laws, including:

  • The Washington My Health My Data Act (“MHMDA”);
  • Nevada’s Consumer Health Data Privacy Law; and
  • The Connecticut Data Privacy Act (“CTDPA”) and applicable Consumer Health Data provisions.

This CHD Policy applies where one of these laws governs Consumer Health Data collected through Arxova’s websites, mobile applications, platform, products, services, and related technologies.

The general Arxova Privacy Policy is available at: https://arxova.health/privacy-policy

If this CHD Policy conflicts with the general Privacy Policy concerning Consumer Health Data governed by an applicable Consumer Health Data law, this CHD Policy controls to the extent required by law.

1.What Is Consumer Health Data?

“Consumer Health Data” generally means personal information that is linked or reasonably linkable to an individual and identifies or reveals information concerning that individual’s past, present, or future physical or mental health status.

Depending on applicable law, Consumer Health Data may include information relating to:

  • Health conditions;
  • Diseases;
  • Diagnoses;
  • Medical history;
  • Treatments;
  • Medical interventions;
  • Procedures;
  • Surgeries;
  • Medications;
  • Laboratory testing;
  • Diagnostic testing;
  • Symptoms;
  • Vital signs;
  • Physiological measurements;
  • Bodily functions;
  • Mental or behavioral health;
  • Reproductive or sexual health;
  • Gender-affirming care;
  • Genetic or genomic information;
  • Health-related biometric information;
  • Wearable-device information;
  • Connected-health information;
  • Information concerning healthcare services sought or received;
  • Health-related location information where applicable;
  • Information derived or inferred from other information;
  • Algorithmically generated health information;
  • Artificial-intelligence-generated health information; and
  • Other information defined as Consumer Health Data under applicable law.

2.Consumer Health Data We Collect

The categories of Consumer Health Data Arxova collects depend on the features you use, information you provide, connections you authorize, and permissions you grant.

Medical and Clinical Information

We may collect:

  • Medical records;
  • Diagnoses;
  • Conditions;
  • Allergies;
  • Medications;
  • Immunizations;
  • Procedures;
  • Encounters;
  • Laboratory results;
  • Diagnostic information;
  • Imaging information;
  • Imaging reports;
  • Practitioner information;
  • Healthcare organization information;
  • Clinical measurements;
  • Medical history; and
  • Other health information contained in records you provide or authorize Arxova to receive.

Vital Signs and Physiological Information

This may include:

  • Heart rate;
  • Heart-rate variability;
  • Resting heart rate;
  • Blood pressure;
  • Respiratory information;
  • Blood oxygen;
  • Weight;
  • Body measurements;
  • Sleep;
  • Activity;
  • Exercise;
  • Steps;
  • Energy expenditure;
  • Glucose information where supported; and
  • Other physiological measurements.

Wearable and Connected Health Information

When you connect a supported device, wearable, health application, healthcare provider, health platform, or other data source, Arxova may receive Consumer Health Data made available through that connection.

The information actually received depends on:

  • The connected service;
  • Its capabilities;
  • Your permissions; and
  • Features you choose to use.

Information You Provide

You may provide:

  • Symptoms;
  • Manual vital signs;
  • Health history;
  • Wellbeing information;
  • Health goals;
  • Medications;
  • Supplements;
  • Supplement intake;
  • Lifestyle information;
  • Questionnaires;
  • Assessments;
  • Reproductive or cycle information where applicable;
  • Questions submitted to ARIA; and
  • Other health information you choose to provide.

Genetic and Genomic Information

Where you use supported genomic functionality, Arxova may process genomic information or information concerning genomic datasets you provide.

Derived and Inferred Information

Arxova may generate Consumer Health Data including:

  • Health summaries;
  • Trends;
  • Scores;
  • Alerts;
  • Clinical-engine outputs;
  • Health-related insights;
  • Knowledge-graph relationships;
  • Personalized health information; and
  • Information generated through ARIA.

3.Sources of Consumer Health Data

Arxova may collect Consumer Health Data from:

  • You;
  • Health information you upload or enter;
  • Healthcare providers you authorize;
  • Health-data networks or services you authorize;
  • Laboratories where supported and authorized;
  • Wearable devices;
  • Health applications;
  • Connected health platforms;
  • Authorized representatives;
  • Devices you connect; and
  • Arxova’s own systems when Arxova derives or generates health-related information.

Arxova does not purchase Consumer Health Data from data brokers for advertising or marketing purposes.

4.Why We Collect and Use Consumer Health Data

Arxova may collect and use Consumer Health Data to:

  • Provide the Arxova Service;
  • Import health information;
  • Synchronize connected data;
  • Store and organize health information;
  • Display health information;
  • Maintain longitudinal health information;
  • Generate summaries;
  • Identify trends and patterns;
  • Calculate and display scores;
  • Generate clinical-engine outputs;
  • Provide personalized health information;
  • Provide ARIA;
  • Enable user-directed data sharing;
  • Operate integrations;
  • Authenticate users;
  • Maintain security;
  • Protect accounts;
  • Prevent unauthorized activity;
  • Troubleshoot technical issues;
  • Respond to support requests;
  • Comply with legal obligations; and
  • Provide other functionality you request.

Arxova will not materially expand the categories of Consumer Health Data collected or materially expand the purposes for which Consumer Health Data is collected, used, or shared without providing notice and obtaining consent where required by applicable law.

5.ARIA and Anthropic

ARIA is Arxova’s artificial-intelligence-enabled health information and analysis feature.

When you choose to use ARIA, Arxova may transmit Consumer Health Data to Anthropic PBC (“Anthropic”) so Anthropic can process the information and generate the ARIA functionality you request.

Information Transmitted to ARIA

ARIA does not transmit your complete historical health dataset during every interaction.

Instead, each interaction may include a predefined, capped snapshot of recent health information.

The snapshot is assembled using predefined categories and technical limits and generally is not limited exclusively to information determined to be relevant to the specific question you ask.

Depending on information available through your account, an ARIA request may contain:

  • Clinical records;
  • Laboratory information;
  • Medications;
  • Conditions;
  • Allergies;
  • Immunizations;
  • Procedures;
  • Encounters;
  • Wearable information;
  • Wellbeing information;
  • Manual vital signs;
  • Supplements and supplement-intake information;
  • Imaging metadata;
  • Certain imaging or diagnostic report information;
  • Personal health scores and trends;
  • Clinical-engine summaries and alerts;
  • Limited genomic dataset information;
  • Health-related memory or contextual information; and
  • Recent ARIA conversation context.

Data Reduction

For certain clinical records, Arxova removes the underlying raw record structure and transmits only an allowlisted set of fields.

Certain direct identifying fields, including:

  • Name;
  • Street address;
  • Telephone number;
  • Medical record number; and
  • Date of birth

are not included in those processed clinical-record fields.

However, other information may remain, including:

  • Dates;
  • Healthcare organizations;
  • Practitioner information;
  • Resource identifiers;
  • Clinical narratives; and
  • Conversation context.

Arxova therefore continues to treat the transmitted information as Consumer Health Data.

Arxova does not represent that the information is legally de-identified merely because certain direct identifiers have been removed.

Anthropic’s Role

Anthropic processes information transmitted through ARIA to provide the AI functionality requested through ARIA.

Arxova does not use Consumer Health Data to train ARIA’s underlying artificial-intelligence model.

Anthropic does not use Customer Content processed through its eligible services to train the underlying AI models powering those services, subject to Anthropic’s applicable contractual terms, trust-and-safety requirements, and permitted processing.

Where Arxova uses Anthropic to process PHI in a HIPAA-regulated context, applicable Anthropic services are provided pursuant to a Business Associate Agreement between Arxova and Anthropic and through an appropriately configured HIPAA-eligible Anthropic environment.

The existence of that Business Associate Agreement does not mean that every item of Consumer Health Data processed through ARIA is PHI or that HIPAA applies to every ARIA interaction.

6.Product Analytics

Arxova uses PostHog for product analytics.

PostHog may receive product-usage events, such as whether a user:

  • Opened a feature;
  • Uploaded information;
  • Downloaded information;
  • Used ARIA;
  • Viewed dashboard functionality; or
  • Interacted with other features.

Arxova intentionally configures PostHog so that the underlying Consumer Health Data associated with these actions is not provided to PostHog.

Arxova does not send health records, laboratory values, genomic information, ARIA health context, or other underlying Consumer Health Data to PostHog for product analytics.

7.How We Share Consumer Health Data

Arxova may share Consumer Health Data in the following circumstances.

Anthropic

When you choose to use ARIA, applicable Consumer Health Data may be transmitted to Anthropic as described in Section 5.

Amazon Web Services

Arxova uses Amazon Web Services (“AWS”) for cloud infrastructure and related services.

AWS may process Consumer Health Data on Arxova’s behalf as necessary to provide applicable services.

Fly.io

Arxova uses Fly.io for hosting, computing, networking, and related infrastructure services.

Fly.io may process Consumer Health Data on Arxova’s behalf as necessary to provide applicable services.

At Your Direction

Arxova may share Consumer Health Data when you intentionally direct or authorize Arxova to do so.

Recipients may include:

  • Healthcare providers;
  • Researchers;
  • Research organizations;
  • Health services;
  • Family members;
  • Caregivers; or
  • Other recipients you select.

Connected Services

Arxova may exchange Consumer Health Data with connected services when necessary to provide functionality you request or authorize.

Professional Advisors

Arxova may disclose Consumer Health Data to professional advisors where reasonably necessary and permitted by law.

Legal Requirements

Arxova may disclose Consumer Health Data where required or permitted by applicable law, court order, subpoena, or other valid legal process.

Corporate Transactions

Consumer Health Data may be transferred as part of a merger, acquisition, restructuring, financing, bankruptcy, sale of assets, or similar transaction, subject to applicable law.

8.Categories of Consumer Health Data We Share

Depending on the feature and recipient, Arxova may share:

  • Medical and clinical information;
  • Laboratory information;
  • Diagnostic information;
  • Medication information;
  • Vital signs;
  • Physiological information;
  • Wearable information;
  • Wellbeing information;
  • User-provided health information;
  • Imaging-related information;
  • Health scores;
  • Summaries;
  • Trends;
  • Derived and inferred health information;
  • Limited genomic-related information;
  • Health-related conversation information; and
  • Other Consumer Health Data necessary to provide functionality you request.

Not every category is shared with every recipient.

9.Categories of Third Parties and Affiliates

Categories of entities that may receive Consumer Health Data include:

  • Artificial-intelligence service providers;
  • Cloud infrastructure providers;
  • Hosting providers;
  • Technology service providers;
  • Connected health services;
  • Healthcare providers you select;
  • Researchers or research organizations you select or authorize;
  • Professional advisors; and
  • Governmental, regulatory, judicial, or law-enforcement authorities where legally required or permitted.

Current service providers that may process Consumer Health Data include:

Anthropic PBC
Artificial-intelligence processing for ARIA.

Amazon Web Services (AWS)
Cloud infrastructure and related services.

Fly.io
Hosting, computing, networking, and related infrastructure.

Affiliates

Arxova does not currently share Consumer Health Data with affiliates.

10.Arxova Does Not Sell Consumer Health Data

Arxova does not sell Consumer Health Data.

Arxova does not sell identifiable Consumer Health Data to:

  • Advertisers;
  • Data brokers;
  • Researchers;
  • Research sponsors;
  • Pharmaceutical companies;
  • Healthcare organizations; or
  • Other third parties.

If Arxova’s practices were ever to change in a manner that constitutes a sale under applicable Consumer Health Data law, Arxova would comply with applicable authorization, disclosure, consent, and other legal requirements before such sale.

11.Advertising and Cross-Site Tracking

Arxova does not provide Consumer Health Data to advertising networks for targeted advertising.

Arxova does not permit third parties to collect Consumer Health Data through the Arxova health-data platform over time and across unrelated websites or online services for targeted advertising based on an individual’s health information.

12.Consent and Your Choices

Where required by applicable law, Arxova obtains consent before collecting or sharing Consumer Health Data.

Consent to collect Consumer Health Data and consent to share Consumer Health Data may be treated separately where required by law.

Certain processing may occur without a separate additional consent where applicable law permits the processing because it is necessary to provide a product or service you specifically request.

For example, when you intentionally use ARIA, Consumer Health Data may be processed as necessary to provide the ARIA functionality you requested.

You may withdraw applicable consent for future collection or sharing by:

Withdrawal of consent may prevent Arxova from providing functionality that requires the applicable information.

Withdrawal does not necessarily affect processing that occurred lawfully before withdrawal.

13.Your Consumer Health Data Rights

Depending on the state and applicable law, you may have rights to:

  • Confirm whether Arxova collects Consumer Health Data concerning you;
  • Confirm whether Arxova shares Consumer Health Data;
  • Confirm whether Arxova sells Consumer Health Data;
  • Access Consumer Health Data concerning you;
  • Request deletion;
  • Withdraw consent;
  • Obtain information concerning third parties or affiliates receiving Consumer Health Data;
  • Correct inaccurate information where applicable;
  • Obtain portable information where applicable;
  • Appeal certain privacy decisions; and
  • Exercise protected privacy rights without unlawful discrimination.

Legal exceptions and limitations may apply.

14.How to Exercise Your Rights

Submit a Consumer Health Data request by emailing: privacy@arxova.health

Please use the subject line: Consumer Health Data Privacy Request

Identify the right you wish to exercise.

Arxova may take reasonable steps to authenticate your identity or authority before processing your request.

Arxova will not request information beyond what is reasonably necessary to authenticate you and process the request.

Where applicable law permits, an authorized agent may submit a request on your behalf.

Arxova will respond within the timeframe required by applicable law.

15.Appeals

If Arxova declines to take action on a request and applicable law provides a right to appeal, submit your appeal to: privacy@arxova.health

Use the subject line: Consumer Health Data Appeal

Include enough information for Arxova to identify the original request and decision.

Arxova will respond to eligible appeals within the timeframe required by applicable law.

16.Arweave and Encrypted Consumer Health Data

Certain Consumer Health Data may be stored as encrypted data objects through Arweave, a distributed data-storage network.

Consumer Health Data is encrypted before being stored through this architecture.

The underlying Consumer Health Data is not intended to be readable from the encrypted object without the cryptographic material necessary to decrypt it.

Arweave is designed as persistent storage. Accordingly, an encrypted object may continue to exist on the Arweave network after an Arxova account or applicable information is deleted.

Cryptographic Deletion

Where applicable Consumer Health Data stored using this architecture is deleted, Arxova uses cryptographic deletion by destroying or rendering unavailable the cryptographic material required to decrypt the information.

The encrypted object may remain on Arweave while the underlying Consumer Health Data becomes cryptographically inaccessible through the applicable decryption mechanism.

Arxova does not represent that deletion physically removes encrypted bytes previously written to Arweave.

17.Solana

Arxova may use the Solana blockchain for permission, authorization, audit, provenance, transaction, reward, or related functionality.

Arxova does not store Consumer Health Data or personal health records on Solana.

Underlying health information is not transmitted through Solana as part of blockchain transactions.

18.Data Retention and Deletion

Arxova retains Consumer Health Data for as long as reasonably necessary to:

  • Provide requested services;
  • Maintain applicable functionality;
  • Protect security;
  • Comply with applicable law;
  • Resolve disputes; or
  • Fulfill another permitted purpose.

When a valid deletion request applies, Arxova will delete applicable Consumer Health Data from systems under its control as required by law and communicate required deletion requests to applicable processors or recipients.

Consumer Health Data stored through persistent distributed storage is subject to the cryptographic-deletion process described above.

Information may be retained where permitted or required by applicable law.

19.Security

Arxova maintains administrative, technical, and physical safeguards designed to protect Consumer Health Data.

Depending on the applicable system, these safeguards may include:

  • Encryption;
  • Client-side encryption;
  • Cryptographic access controls;
  • Authentication;
  • Authorization controls;
  • Restricted access;
  • Secure transmission;
  • Logging and monitoring;
  • Security testing;
  • Vulnerability management;
  • Incident-response procedures; and
  • Processor and vendor security controls.

Access to Consumer Health Data is limited according to legitimate operational requirements and applicable permissions.

No information system can guarantee absolute security.

20.Geofencing

Arxova does not use geofencing around healthcare facilities to:

  • Identify consumers seeking healthcare;
  • Track consumers seeking healthcare;
  • Collect Consumer Health Data in a manner prohibited by applicable law; or
  • Send health-related advertising or messages in a manner prohibited by applicable Consumer Health Data law.

21.HIPAA and Consumer Health Data

Consumer Health Data under state law is not necessarily Protected Health Information under HIPAA.

Information may therefore be governed by this CHD Policy even when HIPAA does not apply.

Where Arxova processes PHI in a HIPAA-regulated context, applicable HIPAA requirements and contractual safeguards apply.

Where Arxova uses Anthropic for processing of PHI in such a context, applicable Anthropic services are provided pursuant to a Business Associate Agreement and through an appropriately configured HIPAA-eligible environment.

The Business Associate Agreement applies only to the extent Anthropic processes PHI for or on behalf of Arxova in circumstances in which Anthropic is acting as Arxova’s Business Associate.

22.Children

Arxova’s general consumer Service is intended for individuals 18 years of age or older unless otherwise expressly provided.

If Consumer Health Data concerning a minor is processed through an authorized service, Arxova will comply with applicable parental-consent, health privacy, and children’s privacy requirements.

Questions may be directed to: privacy@arxova.health

23.Changes to This Policy

Arxova may update this CHD Policy to reflect changes in:

  • Applicable law;
  • Products or services;
  • Technologies;
  • Integrations;
  • Consumer Health Data practices;
  • Service providers;
  • Security practices; or
  • Operational practices.

Where required by applicable law, Arxova will provide notice of material changes and obtain consent before materially expanding applicable categories of Consumer Health Data, purposes, or sharing practices.

The Last Updated date identifies the current version.

24.Contact Arxova

HealthKey Labs, LLC d/b/a Arxova

Website: https://arxova.health

Privacy Policy: https://arxova.health/privacy-policy

Consumer Health Data Privacy Policy: https://arxova.health/consumer-health-data-policy

Privacy Email: privacy@arxova.health

Mail:
HealthKey Labs, LLC d/b/a Arxova
382 NE 191st St PMB #924568
Miami, FL 33179
United States

Effective Date: August 15, 2026

Last Updated: August 15, 2026

© 2026 HealthKey Labs, LLC d/b/a Arxova. All rights reserved.