Privacy Policy

• We do not collect or sell your personal health data.
• We do not track your activity across apps or websites.
• We do not store unencrypted personal information on our servers.
• We do not use your health data for advertising or marketing purposes.

• All health data — whether from wearables, apps, EHR integrations, or manual entry — is encrypted in transit and at rest.
• The Solana blockchain is used as a permission ledger and provenance layer only. No raw health data is ever stored on-chain.
• Permanent health record storage on Arweave is encrypted on-device. Arxova holds no decryption keys.
• We use industry-standard security practices and HIPAA-compliant infrastructure to protect your information.
• In the event of a data breach affecting your personal or health information, we will notify you in accordance with applicable law, including HIPAA's Breach Notification Rule (within 60 days of discovery for breaches affecting 500 or more individuals, and as part of our annual summary for smaller breaches). We will notify you through the app, by email, or both, depending on the nature and scope of the breach.

• You choose which data to share and for what purpose.
• You can revoke access to any data source at any time through the app.
• When access is revoked, it is immediately terminated and logged on-chain.
• You may request a complete export of your data at any time.
• You may request full deletion of your account and all associated data by contacting us or through the app settings. Upon deletion, all personal data, health data, and account information will be permanently removed from our servers within 30 days.
• Note: Data stored on Arweave is permanent by design and cannot be deleted upon request. This is disclosed before any Arweave storage occurs and requires your explicit consent.
• If you are a California resident, you have additional rights under the CCPA, including the right to know what data we collect, the right to deletion, and the right to opt out of sale (we do not sell your data).
• If you are in the European Economic Area, you have rights under the GDPR, including access, rectification, erasure, restriction of processing, and data portability.

• No third party can access your data without your explicit, prior authorization.
• Approved research or service partners receive only the data you consent to share.
• We do not sell, rent, or trade your personal or health data to any third party.
• Third-party integrations (Apple Health, Google Health Connect, Oura, Withings, Polar, Fasten Health) are governed by their respective privacy policies in addition to this one.
• MoonPay's handling of payment and identity data is governed exclusively by MoonPay's privacy policy.

Arxova is developing a future feature that will allow you to optionally share de-identified health data directly with research institutions — and receive compensation in $ARXV tokens. This feature is not yet active. When it launches:

• Participation will be entirely opt-in with a separate, explicit consent process.
• Only de-identified data will be eligible for sharing.
• You will control which data types are included and may withdraw at any time.
• A supplemental Data Sharing Agreement will govern each transaction.

No health data is shared for research purposes today without your explicit action.

Arxova™ may request the following device permissions:

• Health data access (Apple Health / Google Health Connect) — to read and display your fitness and health metrics.
• Push notifications — to send you reminders, activity updates, and token-related alerts.
• Internet access — required for syncing data, blockchain transactions, and app functionality.

All permissions are optional and can be managed through your device settings at any time.

We retain your personal and health data only for as long as your account is active or as needed to provide the Service. If you delete your account, all associated personal data and health data will be permanently deleted from our servers within 30 days. Anonymized, aggregated analytics data that cannot be linked to any individual may be retained for service improvement purposes. On-chain permission records and Arweave-stored data are immutable by the nature of their respective networks.

Arxova™ is intended solely for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected data from a user under 18, we will take immediate steps to delete that information. If you believe a minor has provided us with personal data, please contact us at contact@arxova.health.

We align our practices with HIPAA, GDPR, CCPA, and other applicable privacy laws. We are committed to maintaining the highest standards of data protection and user privacy. Arxova™ operates on HIPAA-compliant infrastructure and executes Business Associate Agreements (BAAs) with applicable service providers. A full HIPAA Notice of Privacy Practices is available at arxova.health/hipaa-npp.

We may update this Privacy Policy from time to time. When we make material changes — such as adding new data categories, enabling new integrations, or changing how your data is used — we will notify you through the app and require your affirmative re-acceptance before you can continue using the Service. Non-material changes will be reflected in the “Last Updated” date at the top of this page. We encourage you to review this policy periodically.

Email: contact@arxova.health

Website: www.arxova.health

Operated by: HealthKey Labs, LLC d/b/a Arxova™

Address: 382 NE 191st St PMB #924568, Miami, FL 33179