Privacy Policy

1. Who We Are and What This Policy Covers

Lenaya Health is operated by Clargenta AI LLC ("Clargenta," "we," "us," or "our"). Lenaya Health is the name of the product; Clargenta AI LLC is the company that provides it and is the entity responsible for the information described in this Policy.

Lenaya Health provides a consumer service that helps you record, understand, and remember your medical appointments. With the Services you can record a visit, receive a plain-language summary and a checklist of what your clinician asked you to do, upload your own health documents such as lab results and after-visit notes, ask questions about your own care, and invite family members or caregivers into a Care Circle so they can follow along.

This Policy applies to individuals who use the Services directly: the person whose care is being recorded and organized, and the family members or caregivers they invite. It covers our websites, our iOS application, and related services.

Our relationship to health privacy laws

We are a consumer service. We are not a healthcare provider, health plan, or healthcare clearinghouse, and we do not act as a HIPAA covered entity or business associate. Your clinician's own records remain governed by their privacy practices, not by this Policy. Information you bring into Lenaya Health is governed by this Policy and by the consumer privacy and consumer health data laws that apply to us, including state consumer health data laws and the Federal Trade Commission's Health Breach Notification Rule.

We say this plainly because the distinction matters: HIPAA does not follow your information once you choose to place it in a consumer application. The protections that apply here are the ones described in this Policy.

2. Information We Collect

Account and contact information

Your name and email address, which we receive from Google when you sign in with your Google account. A mobile telephone number, if you choose to add one for verification or notifications. Your account preferences and settings.

Health information you provide

This is described in detail in Section 3. In summary: audio recordings of medical visits, the transcripts and summaries derived from them, documents you upload, and the questions you ask about your own care.

Care Circle information

If you invite someone into your Care Circle, we process the email address you provide for them, the role you assign, and the status of the invitation. If you join someone else's Care Circle, we process your membership and the permissions the account owner grants you.

Payment information

Subscription details, plan selections, billing history, invoices, and transaction records. Payment card details are collected and stored by our third-party payment processor, not by Lenaya Health. We receive limited information such as the card brand and last four digits.

Usage, device, and technical information

IP address, device type and operating system, application version, sign-in times, features used, error and diagnostic logs, and security events. If you grant location permission, the approximate location where a recording was made, which is used only to label that recording for you.

Communications

The content of support requests, feedback, and emails you send us. If you add a mobile number, we process that number and the delivery status of verification text messages.

3. Health Information You Share With Us

The Services are designed to receive health information. That is their purpose. This section explains exactly what we hold and what we do with it.

Depending on how you use the Services, we may process:

• Audio recordings of conversations with your clinicians that you choose to record.
• Transcripts generated from those recordings, including speech attributed to you and to your clinician.
• Summaries, action items, and follow-up checklists derived from those transcripts.
• Documents you upload, including laboratory results, after-visit summaries, referrals, imaging reports, and similar records, together with the text extracted from them.
• Health concerns and conditions that the Services identify from your visits over time, and their status as reflected in what was said during those visits.
• Questions you ask about your own care, and the answers generated for you.
• Visit metadata such as the date of the appointment, the clinician's name, and the facility, where these are stated in the recording or the documents you provide.

This information is sensitive. We treat it as sensitive personal information under every state privacy law that recognizes that category, and we do not sell it, share it for cross-context behavioral advertising, or use it to build advertising profiles. See Section 12.

4. How We Use Information

We use the information described above to:

• Provide the Services: transcribe your recordings, generate summaries and action items, extract information from documents you upload, and answer your questions about your own care.
• Create and authenticate your account, manage your subscription, and process payments.
• Operate Care Circle sharing according to the permissions you set.
• Send you service-related messages, including verification codes and notifications that processing has finished.
• Provide customer support and respond to your requests.
• Maintain the security, integrity, and reliability of the Services, including detecting and preventing fraud and abuse.
• Diagnose and fix technical problems, and measure and improve performance and reliability.
• Comply with legal obligations and enforce our Terms and Conditions.

What we do not do

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising or targeted advertising.
• We do not use your recordings, transcripts, documents, or health information to train generative artificial intelligence models, whether ours or a third party's.
• We do not use your health information to make decisions about your insurance, credit, or employment, and we do not provide it to anyone for those purposes.

5. Recording, Transcription, and AI Features

The Services use automated speech recognition and artificial intelligence to convert your recordings into text, produce summaries and checklists, read the documents you upload, and answer questions grounded in your own records.

Third-party processing

To do this we send your content to cloud providers that process it on our behalf under contract, currently including Microsoft Azure services for hosting, storage, speech-to-text, document text extraction, and large language model processing. These providers act as our service providers and processors. They are contractually restricted to processing your content for the purpose of delivering the Services to us, and they are not permitted to use it to train their own models.

Your responsibility when recording

Recording laws differ by state. Some require the consent of every person being recorded. You are responsible for obtaining any consent the law requires before you record a conversation. This is addressed further in our Terms and Conditions.

Automated output is not clinical advice

Transcription and AI output can be incomplete or wrong. Summaries, checklists, and answers are provided to help you remember and understand your care. They are not medical advice and are not a substitute for your clinician. Always confirm anything that matters with a qualified professional.

6. Care Circle Sharing

Care Circle lets you give family members or caregivers access to your health information inside the Services. You control it.

• Nobody sees your information unless you invite them.
• You choose each member's role, which determines whether they can only view your visits or can also ask questions and act within your circle.
• You can change a member's role or remove them at any time. Removal takes effect immediately for future access.
• Depending on the permissions you grant, a Care Circle member may be able to record a visit on your behalf.

Understand what sharing means. When you add someone to your Care Circle, they may see recordings, transcripts, summaries, action items, documents, and identified health concerns associated with your account. Share deliberately. Removing a member stops future access but does not un-see what has already been viewed.

If you are a Care Circle member acting in someone else's circle, you must have that person's permission, and you must use their information only to support their care.

7. How We Disclose Information

We disclose personal information only as described here:

• To people you choose. Members of your Care Circle, according to the roles you assign.
• To service providers and processors. Cloud hosting, storage, speech recognition, artificial intelligence processing, document text extraction, payment processing, email and text message delivery, push notification delivery, error monitoring, and customer support tooling. They may use the information only to provide services to us.
• For legal reasons. Where we reasonably believe disclosure is required by law, legal process, or a governmental request, or is necessary to protect the rights, safety, or property of you, us, or others.
• In a business transaction. In connection with a merger, acquisition, financing, or sale of assets, subject to the protections described in this Policy. We will notify you before your information becomes subject to a materially different privacy policy.
• With your direction. Any other disclosure you ask us to make.

We do not disclose your health information to advertisers, data brokers, insurers, or employers.

8. Cookies and Similar Technologies

We and our providers use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, maintain security, and understand how the Services are used so we can improve them. We do not use advertising cookies or third-party advertising trackers. Your browser may allow you to block or delete cookies, though some features may not work correctly if you do.

9. Data Retention and Deletion

We retain your information for as long as your account is active and for as long as reasonably necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

Deleting individual items

You can delete an individual recording, conversation, or uploaded document from within the Services. When you do, we delete the recording and the material derived from it, including transcripts, summaries, action items, and extracted document text.

Deleting your account

You may ask us to delete your account and the health information associated with it by contacting us at the address in Section 16. We will delete or de-identify it within a reasonable period, except where we are required to retain records for legal, tax, accounting, or security purposes, and except for information already shared with Care Circle members whose own copies or knowledge we cannot retrieve.

Backups and logs may persist for a limited period after deletion before being overwritten in the ordinary course.

10. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, access controls, authentication requirements, audit logging, and least-privilege access for our personnel. We select these measures with the sensitivity of health information in mind.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for protecting the credentials and devices you use to access your account. If we become aware of a breach of security affecting your unsecured health information, we will notify you as required by applicable law, including the Federal Trade Commission's Health Breach Notification Rule.

11. Your Choices and Privacy Rights

Access, correction, export, and deletion

You can review and correct much of your information directly in the Services. You may also request a copy of your information, correction of inaccurate information, or deletion, by contacting us at the address in Section 16. We will verify your request before acting on it, and we will not discriminate against you for exercising these rights.

Permissions on your device

Microphone, camera, notification, and location permissions are controlled in your device settings and can be withdrawn at any time. Withdrawing microphone access will prevent recording.

Communications

You may opt out of marketing email using the unsubscribe link. We will still send you messages necessary to operate your account, such as verification codes, security notices, and billing notifications. For text messages, reply STOP to opt out and HELP for assistance. Message frequency varies; message and data rates may apply.

Consent withdrawal

Where we rely on your consent to process sensitive information, you may withdraw it at any time. Withdrawing consent does not affect processing already carried out, and it may mean we can no longer provide some or all of the Services.

12. United States State Privacy Disclosures

This section supplements the rest of this Policy for residents of states with comprehensive privacy or consumer health data laws, including California, Colorado, Connecticut, Nevada, Virginia, and Washington.

Sensitive and consumer health data

The health information described in Section 3 is sensitive personal information under the California Consumer Privacy Act and comparable laws, and consumer health data under the Washington My Health My Data Act, the Nevada consumer health data law, and similar statutes. We collect and process it only to provide the Services you have asked for, and only with your consent where consent is required.

Sale and sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We do not sell or share the personal information of minors.

Categories

In the preceding twelve months we may have collected the following categories: identifiers; customer records information; commercial information relating to your subscription; internet and network activity; approximate geolocation, if you enable it; audio and electronic information; and sensitive personal information consisting of health information and account credentials. The sources, purposes, and recipients are described in Sections 2, 4, and 7.

Exercising your rights

To exercise a right to know, access, correct, delete, obtain a portable copy, limit the use of sensitive personal information, or appeal a decision we have made, contact us at the address in Section 16. You may use an authorized agent where the law permits. If we deny your request you may appeal by replying to our response, and depending on your state you may also contact your state Attorney General.

13. Children and Minors

The Services are intended for adults. They are not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

An adult may use the Services to organize the care of a minor for whom they are a parent or legal guardian, or may include a minor's information in their own records. If you do so, you are responsible for having the legal authority to provide that information and to make privacy decisions about it.

14. Data Processing in the United States

Clargenta AI LLC is based in the United States, and your information is processed and stored in the United States. The Services are offered only in the United States. If you access them from elsewhere, you do so on your own initiative and are responsible for compliance with local law.

15. Changes to this Policy

We may update this Privacy Policy. We will post the updated version and revise the "Last Updated" date. If a change materially affects how we handle your health information, we will provide prominent notice and, where the law requires it, obtain your consent before the change takes effect.

16. Contact Us