Consumer health data privacy policy
Last updated October 11, 2026
Draft, pending approval. This text is being reviewed before ILAI accounts open.
Who this policy is from
This policy is from ILAI, for ILAI accounts for individuals. It is written to meet consumer health data laws such as Washington’s My Health My Data Act, and it applies to every member wherever they live. More detail is in the privacy notice for ILAI accounts.
The health data we collect
- lab results and the reports they came from;
- medications, prescriptions and protocols, including doses;
- Apple Health readings such as heart rate, sleep, activity, weight, blood oxygen and, if you wear a sensor, glucose;
- meals and meal photos;
- check-in body photos;
- symptoms, notes and messages;
- sexual health entries;
- the explanations, estimates and summaries ILAI writes from these.
Where it comes from
From you: what you type, photograph or upload. From Apple Health on your iPhone, only for the types you allow. From the lab reports you import.
Why we collect it and how we use it
ILAI uses your health data only to keep your record and to explain it to you: your briefs, your answers, your charts and the summaries you choose to make for an appointment. If you join a healthcare practice that uses ILAI and agree to share with it, your care team sees it too. We also use what is needed to secure the service and to meet legal obligations.
Your consent
Before ILAI collects any of it, you give your explicit consent in the app, separately from the terms. You can withdraw it at any time in the app. Withdrawing it means ILAI can no longer process your information, so your account is closed and your record deleted.
Who processes it, and who we share it with
- Oracle Cloud Infrastructure hosts the server and the database.
- Anthropic (Claude) writes ILAI’s explanations and answers from the parts of your record a request needs. Your data is not used to train AI models.
- Apple delivers push notifications, if you allow them.
- Your care team, only if you are with a practice that uses ILAI and you have agreed to share with it.
- Anyone you choose: a summary you print or send is shared by you.
Stripe (payments) and Resend (account email) handle your account and billing details, not your health record. We share health data otherwise only where the law requires it.
What we never do
We never sell your health data, never use it for advertising, never use it to train AI, and never use location to target you.
Your rights
- See it. Confirm whether we hold your health data, and see it. Your record is in the app, and you can download it as a standard health-data file (FHIR).
- Know who has it. Ask us for the list of processors and third parties that have received it.
- Delete it. Use Delete my account in the app, or ask us.
- Withdraw consent. In the app at any time.
To make a request, email [email protected] from the address on your account. We answer within 45 days. If we decline a request, you can appeal by replying to our answer; if your appeal is declined, you can contact your state attorney general.
How long we keep it
While your account is open. If your trial or membership ends without a paid plan, your record is kept for one year, with an email 30 days before it is deleted.
Changes
If this policy changes, we will update the text and the date at the top, and ask you to accept the new version in the app before your health data is used in a new way.