Arxova Privacy Policy

Effective Date: August 15, 2026

Last Updated: August 15, 2026

HealthKey Labs, LLC d/b/a Arxova (“Arxova,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal information and health information.

This Privacy Policy explains how Arxova collects, uses, processes, stores, shares, and protects information when you access or use our websites, mobile applications, platform, products, features, and related services (collectively, the “Service”).

By using the Service, you acknowledge the practices described in this Privacy Policy.

1.Consumer Health Data Privacy Notice

Certain U.S. states provide additional protections for Consumer Health Data.

If you are a resident of Washington, Nevada, or Connecticut, or your Consumer Health Data is otherwise covered by the consumer health privacy laws of one of those states, please review our separate:

Consumer Health Data Privacy Policy
https://arxova.health/consumer-health-data-policy

That policy supplements this Privacy Policy and describes additional rights and disclosures under applicable Consumer Health Data laws, including:

Washington’s My Health My Data Act;
Nevada’s Consumer Health Data Privacy Law; and
Connecticut’s Data Privacy Act and applicable Consumer Health Data provisions.

If this Privacy Policy conflicts with our Consumer Health Data Privacy Policy regarding information governed by one of those laws, the Consumer Health Data Privacy Policy controls to the extent required by applicable law.

2.Information We Collect

The information Arxova collects depends on the features you use, information you choose to provide, services you connect, and permissions you grant.

Account Information

We may collect:

Email address;
Display name;
Authentication information;
Account identifiers;
Wallet address where applicable;
Account preferences; and
Information necessary to administer your account.

Health and Fitness Information

With your authorization, Arxova may collect health and fitness information from supported services, applications, devices, and platforms.

Depending on your permissions and connected services, this may include:

Heart rate;
Heart-rate variability;
Resting heart rate;
Blood pressure;
Weight;
Blood oxygen;
Respiratory information;
Steps;
Physical activity;
Exercise and workouts;
Sleep;
Energy expenditure;
Glucose information where supported; and
Other physiological, fitness, or health measurements.

Medical and Clinical Records

With your authorization, Arxova may receive or process health information from healthcare providers, health-data networks, health-information exchanges, connected services, uploads, and supported FHIR or similar health-data connections.

This information may include:

Conditions and diagnoses;
Medications;
Allergies;
Immunizations;
Procedures;
Encounters;
Laboratory results;
Diagnostic information;
Imaging information and reports;
Practitioner information;
Healthcare organization information;
Clinical measurements; and
Other medical-record information you authorize Arxova to receive or process.

Information You Provide Directly

You may provide:

Symptoms;
Manual vital signs;
Medications;
Supplements;
Supplement intake;
Wellbeing information;
Health goals;
Lifestyle information;
Questionnaires;
Health assessments;
Reproductive or cycle information where applicable;
Health-related questions submitted to ARIA; and
Other information you choose to provide.

Genomic Information

Where you choose to use supported genomic features, Arxova may process genomic information or information concerning genomic datasets you provide.

Derived and Inferred Health Information

Arxova may generate information based on health information available through the Service, including:

Health summaries;
Trends;
Scores;
Alerts;
Clinical-engine outputs;
Health-related insights;
Knowledge-graph relationships;
Personalized information; and
Information generated through ARIA.

Usage and Technical Information

We may collect information such as:

Device type;
Operating system;
Browser information;
IP address where applicable;
Application version;
Feature interactions;
Crash and performance information;
Website traffic;
Referral information; and
Cookie and similar technology information.

3.How We Use Information

Arxova may use information to:

Create and administer accounts;
Authenticate users;
Import and synchronize health information;
Store and organize records;
Display health information;
Generate summaries, scores, trends, and insights;
Provide ARIA;
Enable user-directed sharing;
Operate wearable and health-platform integrations;
Provide customer support;
Maintain, troubleshoot, and improve the Service;
Conduct product analytics;
Protect accounts and systems;
Detect fraud, abuse, or unauthorized access;
Maintain security;
Comply with legal obligations; and
Protect the rights, property, and safety of Arxova, our users, and others.

Arxova does not sell your Consumer Health Data.

Arxova does not use Consumer Health Data for targeted advertising.

4.ARIA and Artificial Intelligence

ARIA is Arxova’s artificial-intelligence-enabled health information and analysis feature.

ARIA uses technology provided by Anthropic PBC (“Anthropic”).

When you choose to use ARIA, Arxova may transmit Consumer Health Data to Anthropic so Anthropic can process the information and generate the ARIA functionality you request.

Information Sent to ARIA

ARIA does not transmit your complete historical health dataset with every interaction.

Instead, an ARIA interaction may include a predefined, capped snapshot of recent health information available through your account.

The snapshot is assembled according to predefined categories and technical limits and is generally not restricted solely to information determined to be relevant to the specific question you ask.

Depending on information available in your account, the snapshot may include:

Medical and clinical records;
Laboratory information;
Medications;
Conditions;
Allergies;
Immunizations;
Procedures and encounters;
Wearable information;
Wellbeing information;
Manual vital signs;
Supplement information;
Imaging metadata and certain report information;
Health scores and trends;
Clinical-engine summaries and alerts;
Limited genomic dataset information;
Health-related contextual or memory information; and
Recent ARIA conversation context.

Data Reduction Before Transmission

For certain clinical records, Arxova removes the underlying raw record structure and limits transmitted information to an allowlisted set of clinically relevant fields.

Certain direct identifying fields, including name, street address, telephone number, medical record number, and date of birth, are not included in those processed clinical-record fields.

Other information may remain, including dates, healthcare organizations, practitioner information, resource identifiers, clinical narratives, and conversation context.

Arxova therefore continues to treat information transmitted through ARIA as health information and does not represent that information as legally de-identified merely because certain direct identifiers have been removed.

Anthropic Data Handling

Arxova does not use Consumer Health Data to train ARIA’s underlying artificial-intelligence model.

Anthropic does not use Customer Content processed through its eligible services to train the underlying AI models powering those services, subject to Anthropic’s applicable agreements, service terms, trust-and-safety requirements, and other permitted processing.

Where Arxova uses Anthropic to process Protected Health Information (“PHI”) in a HIPAA-regulated context, applicable Anthropic services are provided pursuant to a Business Associate Agreement between Arxova and Anthropic and through an appropriately configured HIPAA-eligible Anthropic environment.

The existence of a Business Associate Agreement does not mean that every item of Consumer Health Data processed through Arxova is PHI or that HIPAA applies to every Arxova user or interaction.

Anthropic may retain or process information where permitted or required under its applicable service terms, legal obligations, trust-and-safety requirements, and contractual arrangements with Arxova.

5.Product Analytics

Arxova uses PostHog for product analytics.

PostHog may receive events indicating that a user performed an action, such as:

Opening a feature;
Uploading information;
Downloading information;
Using ARIA;
Viewing dashboard features or health rings; or
Interacting with other application functionality.

Arxova intentionally configures its PostHog implementation so that the underlying Consumer Health Data is not provided to PostHog.

For example, PostHog may receive an event indicating that a feature was used without receiving the medical record, health measurement, ARIA health context, laboratory result, genomic information, or other underlying health information associated with the interaction.

Arxova does not permit PostHog to use Consumer Health Data for advertising or health-based profiling.

6.Website Analytics and Cookies

Arxova may use cookies, analytics technologies, performance tools, and similar technologies on our public-facing website.

These technologies may collect:

Browser information;
Device information;
General website activity;
Referral information;
Page interactions;
Approximate location derived from IP address; and
Similar technical information.

Arxova does not intentionally provide the health records stored within the Arxova platform to public-website advertising or analytics technologies.

Where required by applicable law, Arxova provides appropriate choices concerning optional cookies or similar technologies.

7.How We Share Information

Arxova may share information as described below.

Anthropic

When you use ARIA, Anthropic may process Consumer Health Data as described in Section 4.

Amazon Web Services

Arxova uses Amazon Web Services (“AWS”) for cloud infrastructure and related technology services.

AWS may process information on Arxova’s behalf as necessary to provide applicable infrastructure services.

Fly.io

Arxova uses Fly.io for cloud hosting, computing, networking, and related infrastructure.

Fly.io may process information on Arxova’s behalf as necessary to provide applicable services.

At Your Direction

Arxova may share information when you intentionally direct or authorize us to do so.

For example, you may choose to provide access to information to:

A healthcare provider;
A researcher;
A research site;
Another health service;
A family member;
A caregiver; or
Another recipient you select.

Connected Services

When you connect a third-party device, application, health platform, healthcare provider, or other service, Arxova may exchange information with that service to provide the connection you requested.

Professional Advisors

Information may be disclosed to legal, accounting, security, insurance, compliance, or other professional advisors where reasonably necessary and legally permitted.

Legal Requirements

Arxova may disclose information when required or permitted by applicable law, court order, subpoena, governmental request, or other valid legal process.

Corporate Transactions

Information may be transferred in connection with a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, subject to applicable law.

Affiliates

Arxova does not currently share Consumer Health Data with affiliates.

8.We Do Not Sell Consumer Health Data

Arxova does not sell Consumer Health Data.

Arxova does not sell identifiable Consumer Health Data to:

Advertisers;
Data brokers;
Research organizations;
Pharmaceutical companies;
Healthcare organizations; or
Other third parties.

Arxova is not a health-data broker.

9.Research

Arxova may support voluntary participation in clinical or health research.

Research participation is optional.

Depending on the particular research opportunity:

You may choose whether to participate;
Additional study-specific information may be presented;
Informed consent may be required;
Institutional Review Board (“IRB”) review may apply;
Information shared depends on the applicable authorization or consent;
You may withdraw subject to the applicable study consent, protocol, and law; and
Information already used in research may not always be capable of being withdrawn or deleted.

Arxova may provide technology supporting activities such as:

Study discovery;
Preliminary eligibility matching;
Screening infrastructure;
Consent management;
Participant engagement;
Health-data aggregation; and
Secure transmission of authorized information.

Arxova does not sell your Consumer Health Data to research sponsors or research organizations.

10.Arweave and Encrypted Storage

Certain Consumer Health Data may be stored as encrypted data objects using Arweave, a distributed data-storage network.

Health information is encrypted before being stored through this architecture.

The underlying health information is not intended to be publicly readable from the encrypted object without the cryptographic material necessary to decrypt it.

Arweave is designed as persistent storage. Accordingly, encrypted data objects written to Arweave may continue to exist on the network even after an Arxova account is deleted.

Cryptographic Deletion

Where applicable information stored on Arweave is deleted, Arxova uses cryptographic deletion by destroying or rendering unavailable the cryptographic material required to decrypt the applicable information.

The encrypted object may remain on Arweave while the underlying health information becomes cryptographically inaccessible through the applicable decryption mechanism.

Arxova does not represent that deletion physically removes encrypted bytes previously written to Arweave.

11.Solana

Arxova may use the Solana blockchain for permission, authorization, audit, provenance, transaction, reward, or related functionality.

Arxova does not store Consumer Health Data or personal health records on Solana.

The underlying health information is not transmitted through Solana as part of the blockchain transaction.

Public blockchain information, including wallet addresses and transaction information, may be visible publicly by the nature of blockchain technology.

12.Data Security

Arxova maintains administrative, technical, and physical safeguards designed to protect personal information and Consumer Health Data.

Depending on the applicable system, safeguards may include:

Encryption;
Client-side encryption;
Cryptographic access controls;
Authentication;
Authorization controls;
Restricted access;
Secure transmission;
Logging and monitoring;
Vulnerability management;
Security testing;
Incident-response procedures; and
Processor and vendor security controls.

No information system can guarantee absolute security.

If a security incident requires notification under applicable law, Arxova will provide notice as required.

13.HIPAA

Consumer Health Data is not necessarily the same as Protected Health Information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

HIPAA generally applies only in particular regulated relationships and circumstances.

Where Arxova processes PHI in a context in which Arxova is subject to HIPAA requirements, Arxova applies applicable HIPAA safeguards and contractual requirements.

Certain service providers used by Arxova may also operate pursuant to Business Associate Agreements where required.

Nothing in this Privacy Policy should be interpreted to mean that every Arxova user, every Arxova service, or every item of Consumer Health Data is regulated by HIPAA.

14.Data Retention and Account Deletion

Arxova retains information for as long as reasonably necessary to:

Provide the Service;
Maintain your account;
Provide requested functionality;
Protect security;
Resolve disputes;
Enforce agreements;
Comply with legal obligations; or
Fulfill other lawful purposes.

You may request deletion through applicable in-app functionality or by contacting Arxova.

When applicable information is deleted, Arxova deletes information from systems under its control in accordance with applicable law and retention practices.

Information stored through persistent or immutable technologies is subject to the limitations described in Sections 10 and 11.

Aggregated or appropriately de-identified information may be retained where permitted by law.

15.Your Privacy Rights

Depending on where you live, you may have rights to:

Access personal information;
Confirm whether information is processed;
Correct inaccurate information;
Delete information;
Obtain a portable copy of information;
Withdraw consent;
Opt out of certain processing;
Obtain information concerning disclosures; and
Appeal certain privacy decisions.

To exercise an applicable privacy right, contact: privacy@arxova.health

Arxova may take reasonable steps to authenticate your identity or authority before fulfilling a request.

Washington, Nevada, and Connecticut

If you reside in Washington, Nevada, or Connecticut, please review the:

Arxova Consumer Health Data Privacy Policy
https://arxova.health/consumer-health-data-policy

That policy describes additional Consumer Health Data rights available under applicable state law.

16.Device Permissions and Connected Services

Arxova may request device or service permissions necessary for features you choose to use.

These may include:

Apple Health permissions;
Android Health Connect permissions;
Wearable-platform access;
Notifications;
Authentication permissions;
Network access; and
Other permissions necessary for optional functionality.

You may manage applicable permissions through your device, the connected service, or Arxova where supported.

Revoking a permission may prevent the associated functionality from working.

17.Children’s Privacy

Arxova’s general consumer Service is intended for individuals 18 years of age or older, unless Arxova expressly provides a service designed for younger users in compliance with applicable law.

Arxova does not knowingly permit individuals under 18 to create general consumer accounts.

If you believe information concerning a minor has been provided improperly, contact: privacy@arxova.health

18.Changes to This Privacy Policy

Arxova may update this Privacy Policy to reflect changes in:

Applicable law;
Products or services;
Technologies;
Integrations;
Processors;
Security practices; or
Data practices.

Where required by applicable law, Arxova will provide notice of material changes and obtain additional consent where necessary.

The Last Updated date identifies the current version.

19.Contact Us

HealthKey Labs, LLC d/b/a Arxova

Website: https://arxova.health

Consumer Health Data Privacy Policy: https://arxova.health/consumer-health-data-policy

Privacy Email: privacy@arxova.health

Mail:
HealthKey Labs, LLC d/b/a Arxova
382 NE 191st St PMB #924568
Miami, FL 33179
United States

Effective Date: August 15, 2026

Last Updated: August 15, 2026