Security at Arxova

In transit. The app, the website and our services talk to each other over encrypted connections (HTTPS/TLS). Our servers redirect any unencrypted request to an encrypted connection.

At rest, for everything. Every Arxova database is stored on encrypted disk volumes. Our backups are snapshots of those encrypted volumes.

Per record, for the most sensitive data. On top of disk encryption, three kinds of data are encrypted one item at a time with AES-256-GCM, using encryption keys wrapped separately from the stored records:

• source documents and records you import (for example, records from your health system, documents and imaging reports),
• your ARIA conversations,
• raw data from your devices.

Other information, such as daily wearable totals, medication lists, symptoms, cycle data and daily summaries, is protected by disk encryption only. Features such as your scores, charts and ARIA need to read it.

Who holds the keys. You decide who can see your records. Sharing, clinic access and research all require your action, and you can revoke them. Arxova holds the encryption keys for most records so features like ARIA and scores can work; records encrypted with your wallet’s key require that key or an authorized decryption path.

The keys Arxova holds are kept in a secrets system that is separate from the databases. Every time our servers decrypt health data, we log who or what did it, the reason (the part of the service that asked) and how many records were involved. The log never contains the health data itself.

Some records, including imported health records, are stored on Arweave, a public network that keeps data permanently. Every record is encrypted before it is uploaded, so the network holds only scrambled data.

Two things to know:

• Copies on Arweave cannot be deleted by anyone, including Arxova. When you delete your account, we remove the encryption keys we hold from active systems. Copies in our database backups expire within 5 days. After those retained key copies expire, encrypted files cannot be opened using Arxova’s retained keys. This does not erase plaintext or keys someone previously obtained, or the public labels described below.
• Labels on older uploads are public. Uploads made before October 1, 2026 carry public, permanent labels that show a wallet address and the type of record. Uploads since then carry no such labels.

Arxova writes tamper-evident audit receipts to the Solana blockchain. They record that something happened, so that you, a clinic or a regulator can check later that a record of it was not changed. Receipts are written when:

• data is accessed, shared, synced or deleted,
• a health alert is generated,
• you grant or revoke access: clinic access, share links, research participation and community insights.

A receipt is also written when you give or withdraw your AI consent, and when you add or remove an Arxova Circle contact.

Health records and health values are not written to Solana. Since October 1, 2026, each receipt uses a random reference and a generic name. Arxova holds the private reference that connects a receipt to its account until that reference is deleted.

Older receipts are public. Receipts written before October 1, 2026 were linked to the person's wallet and named the kind of event, for example a health alert or a device sync. They are public and cannot be removed.

Not every action has a receipt. Connecting or disconnecting a device or app and changing your analytics setting are recorded only in Arxova's own systems.

• You sign in with email, Apple or Google through Privy, our sign-in provider. Privy creates a Solana wallet for you as part of your account.
• To start a session, the app proves it controls your wallet by signing a one-time challenge that expires after two minutes.
• A session lasts up to 7 days and can be renewed, but never more than 90 days after you last signed in. After that, you sign in again.
• When you delete your account, your sessions are ended.
• Requests for one person's data from another person's session are refused and logged.

Clinics use a separate provider console.

• A clinic can see your information only after you grant access, for example by giving the clinic a one-time pairing code from the app. Codes expire, can be used once, and are stored only in scrambled (hashed) form.
• Access is limited to what the grant covers, such as a specific condition or data type. A clinic that wants more must ask, and you approve or decline.
• You can revoke a clinic's access in the app at any time.
• Clinicians must use multi-factor authentication to sign in. We check this on our servers, not only in the browser.
• Clinic sessions end after 8 hours and are held in secure, browser-protected cookies.
• Every chart or panel a clinician opens is logged.

You can share a record or summary with anyone through a link or QR code.

A share link works for anyone who has it until it expires or you revoke it. Treat it like a key. Depending on the type of share, a link expires after the time you choose or stays open until you revoke it. Check the expiry when you create a share, and revoke links you no longer need.

When you revoke a share, the link stops working. Revoking cannot take back anything the recipient already viewed, saved or downloaded.

We limit how many times a link can be tried from one internet address in a short period, to reduce link-guessing attempts. Each view of a shared record is logged.

• Cloud services (Oura, WHOOP, Withings, Polar, Strava, Garmin through ROOK, Sensor Bio, and health systems through Fasten Health) connect through the provider's own sign-in and authorization page. We store the access tokens they issue in encrypted form.
• Apple Health, Health Connect and Samsung Health are read on your phone, with the permissions you grant in your phone's settings. Arxova does not send anything to Apple, Google or Samsung to read this data. You can change those permissions in your phone's settings at any time.
• When you disconnect Strava, Garmin (through ROOK), Oura, WHOOP, Polar or Withings, Arxova also revokes its access at that company. Fasten Health and Sensor Bio do not offer a way for us to do this. When you disconnect them, we delete our tokens, and you may need to revoke permission in the connected health system’s patient portal or Sensor Bio account. If no revocation option is available, contact that provider or privacy@arxova.health for help.
• Data that was already synced stays in Arxova until you delete it or delete your account.

ARIA and other AI features use Anthropic's Claude, through Anthropic’s commercial services. We send a capped snapshot from defined categories of information, not necessarily only the information relevant to a particular question. Your name is removed from the health record before ARIA sees it, and no account, email, phone, address or device identifiers are attached. Photos, documents and text you type are sent as they are and can include your name. We do not authorize Anthropic to train its models on information sent through these commercial services. The app asks whether to allow AI features. Until you allow them, no AI features run for your account, including background features such as morning insights. Older app versions cannot show this choice, so AI features do not work on them until you update the app and answer. If you decline or withdraw in Settings, AI features stop. Our Privacy Policy explains each AI feature in detail.

• The Arxova app contains no advertising, attribution or social-media SDKs. There is no Meta SDK and no AppsFlyer SDK.
• Some of our marketing links use AppsFlyer OneLink to send you to the right app store. When you tap one of those links, AppsFlyer records the click. Arxova does not include the AppsFlyer SDK in the app. OneLink click tracking is separate from in-app analytics.
• We do not use your health data for advertising.

We do not sell your health data. Clinics and research institutions pay Arxova for the matching and care infrastructure they use, not for your data, and we do not pay people for their data.

We use PostHog to understand which features people use. Product analytics is separate from the sign-in, security and operational logs we use to run and protect the Service. Turning off app analytics does not stop those necessary logs.

• We have not asked for a separate app-analytics permission. In the app, analytics is on by default. You can turn it off in Settings. Since September 30, 2026, the app sends only a fixed list of feature-use events, with no health values, under a pseudonymous identifier derived from your account. Events before that date included limited health details, such as a symptom type or a step total, and some used the wallet address.
• Some usage events are sent from Arxova's servers. The in-app setting does not affect those.
• On our website, PostHog loading is controlled by the cookie-choice banner. The app’s analytics setting does not control website cookies.

• Automated security checks run every 10 minutes. They look for signs of misuse, such as one account opening many people's data or a request for data that does not belong to the account making it. A finding alerts our team immediately.
• Our research and clinic services connect to our databases through their own restricted accounts, separate from the main app.
• We keep security logs, such as decryption and refused-access logs, without an end date, for security purposes. When you delete your account, your identity is removed from them.
• Everyone at Arxova with access to personal data completes privacy and security training, and we review our privacy and security practices at least once a year.
• We follow a written incident response process: preserve evidence, contain the problem, investigate with restricted access and use metadata first where possible, fix the cause, and notify as the law requires.

We take a snapshot of each database once a day and keep it for 5 days. Snapshots are encrypted like the databases they copy. If you delete your account, copies of your data in backups expire within 5 days.

• SOC 2 Type 1. Arxova completed a SOC 2 Type 1 examination covering the Security criteria, as of August 31, 2026. The report was issued by Percilchofe CPA LLC on September 23, 2026. A Type 1 report looks at how our controls were designed at one point in time. It does not test how they operated over a period; that is a Type 2 report. We are currently working toward a SOC 2 Type 2 examination. SOC 2 is an attestation report, not a certification. The report is confidential. You can request it through the Arxova Trust Center at trust.arxova.health or by writing to privacy@arxova.health.
• Penetration test. An independent penetration test of Arxova is underway.
• CMS Health Tech Ecosystem. HealthKey Labs, LLC is an approved participant in the CMS Health Tech Ecosystem, in the "Patient Facing Apps — Conversational AI Assistants" and "Patient Facing Apps — Kill the Clipboard" categories. Participation is not an endorsement by CMS.

Arxova is not a HIPAA covered entity. When a clinic uses Arxova's provider console, Arxova acts as the clinic's business associate. We sign a Business Associate Agreement with each clinic before it uses Arxova. For services involving clinic protected health information, we require the appropriate Business Associate Agreements and service configurations before processing that information. Our page "How HIPAA applies to Arxova" explains this in full.

If a breach affects your personal or health information, we will notify you and the authorities as the law requires. That includes the FTC Health Breach Notification Rule, HIPAA where we hold information for a clinic (in that case we notify the clinic, which notifies its patients), and applicable state law.

If you find a security vulnerability in Arxova, please email privacy@arxova.health with a description and the steps to reproduce it, before you share it publicly.

When testing, please:

• do not access, keep or share anyone else's health data,
• do not use another person's account or credentials,
• do not disrupt the service.

We review every good-faith report and will work with you to understand and fix the issue. We will not pursue legal action against researchers who report vulnerabilities in good faith and follow this policy.

• Security reports and SOC 2 report requests: privacy@arxova.health
• Privacy questions and requests: privacy@arxova.health
• Mail: HealthKey Labs, LLC d/b/a Arxova, 382 NE 191st St PMB #924568, Miami, FL 33179