Privacy policy.

Key definitions

Account roles and access

FlarePath supports different roles for managing health information.

Caregiver authority: any Account Holder who provides Personal Data on behalf of a Dependent, or who grants any other user access to the Dependent’s data, warrants that they have legal authority to do so. FlarePath may request proof of authority and/or identity before providing access to Personal Data.

2.1 Account information

We collect:

• Name or display name
• Email address and password (hashed; never stored in plain text)
• Email-based one-time passcode (OTP) tokens used for two-factor verification at login

Purpose: to create and manage your account, authenticate logins, and provide technical support.

2.2 Wellness and input data

We collect:

• Symptom logs, activity data, mood or pain entries, medication schedules, flare-up frequency, sleep quality, or other wellness-related inputs
• PROMIS (Patient-Reported Outcomes Measurement Information System) assessment scores and responses, including pain interference, fatigue, mobility, and global health domains
• Optional caregiver or child profile information that you enter
• Optional wearable or portal data that you connect (e.g., WHOOP, Apple Health)

Purpose: to generate charts, insights, and personal summaries to help you understand patterns in your wellness. You may delete any record you have entered at any time through your account settings or by contacting us.

2.2a Apple Health / HealthKit integration (iOS only)

If you grant permission, FlarePath reads the following data types from Apple HealthKit on your iOS device.

2.2b Visit Companion (appointment recording)

FlarePath includes a Visit Companion feature that allows you to audio-record clinical appointments with your care team. When you use this feature, we collect:

• Audio recording of the appointment (stored encrypted; requires your explicit start action)
• AI-generated transcript of the appointment audio (processed via OpenAI Whisper with BAA)
• Structured summary of the appointment, including key discussion points and follow-up questions
• Clinician permission confirmation (the app prompts you to confirm you have obtained consent from your clinician before recording)

Recording requires your active initiation — the app never records passively in the background. You are responsible for obtaining consent from all parties before recording, as required by applicable law. Audio is processed through BAA-covered AI endpoints only. You may delete any Visit Companion recording and its transcript at any time. Audio recordings are never shared with researchers; only de-identified structured summaries may be included in research data (if you opt in).

2.3 Voice recordings and transcriptions

If you use our voice journal feature, we collect:

• Voice recordings captured via the voice journal feature
• Transcribed text derived from voice recordings (using OpenAI Whisper with a Business Associate Agreement for HIPAA compliance)
• Extracted structured data (e.g., symptoms, pain levels, medications, triggers, mood)

2.4 AI chat interactions

We collect:

• Chat queries and messages you send to the AI assistant
• AI-generated responses and recommendations
• Context about your health data used to personalize responses

Purpose: to provide personalized health insights, answer questions about your data, and improve the AI assistant’s accuracy and helpfulness.

Chat interactions are logged for quality improvement and debugging. De-identified chat data may be used for research purposes if you opt into the Research Databank. AI processing involves third-party language models that comply with HIPAA-aligned security standards.

AI-generated insights are for informational purposes only and do not constitute medical advice. Always consult healthcare professionals for medical decisions.

FlarePath does not make decisions based solely on automated processing, including profiling, which have legal consequences for, or significantly affect, our users. We also do not access, use, or disclose your Health Records to assert any type of claim against you.

Health Reports and doctor reports are not AI-generated. Monthly health recaps and doctor-facing reports are generated directly from your logged data — aggregated, formatted, and presented with no AI interpretation or processing. What you see in these reports is exactly what you entered.

2.5 Connected portal and medical record data (Right of Access)

If you choose to use FlarePath to connect your health provider portals or request copies of your records under the HIPAA Right of Access, you authorize FlarePath to act as your personal health record tool for the limited purpose of retrieving your information and displaying it within your private account.

We collect:

• Copies of medical records you request under your HIPAA Right of Access
• Basic demographics from provider systems (name, age, lab summaries, visit data, etc.)

Purpose: to help you consolidate your own records in one place.

FlarePath acts at your direction when processing your own medical records obtained through your Right of Access. We are not acting as a Business Associate in this capacity, but rather as your personal agent helping you organize your own data. All imported data remains your property and can be deleted or exported at any time. FlarePath does not modify or interpret medical records and is not responsible for their accuracy.

2.6 Technical and usage data

We collect:

• Device type and operating system (e.g., iPhone model, iOS version)
• App version and build number
• Crash logs and error reports (with PHI scrubbing via Sentry)
• Basic feature usage metrics (e.g., screen views, button interactions, feature engagement)
• Session duration and timestamps
• Push notification tokens (used solely to deliver in-app reminders and alerts; never used for marketing)
• Biometric authentication method in use (Face ID or Touch ID on iOS; fingerprint on Android) — we store only a boolean indicating whether biometric auth is enabled, not any biometric data itself

Why we collect it: reliability, debugging, security monitoring, and product improvement.

We do not collect advertising identifiers, third-party advertising analytics, or location data. FlarePath does not currently use location services. A future feature to help users find nearby healthcare providers may request location access — if and when that feature is introduced, it will require your explicit permission and this policy will be updated in advance.

First-party analytics only: feature usage metrics are sent directly to FlarePath’s own backend — we do not use any third-party analytics vendors such as Mixpanel, Amplitude, Google Analytics, or similar services. Your usage data never leaves our infrastructure for analytics purposes.

PHI protection: error logs are scrubbed of protected health information before being sent to our error tracking service (Sentry). Feature usage metrics are de-identified and never include health content.

Push notification content is PHI-free. Notifications never include health information that could be exposed on a lock screen. For example, medication reminders say “It’s time for your scheduled medication” — not the medication name or dosage. Health details are only visible after the app is unlocked and opened.

FlarePath data is never used to train general-purpose AI models. Our AI vendors (including OpenAI) are contractually prohibited from using your data for model training under our Business Associate Agreements.

2.7 Communications and feedback

We collect:

• Your name, email, and message content
• Optional usability or feature feedback

Purpose: to improve app design, troubleshoot issues, and enhance user experience. We may de-identify and aggregate feedback for internal analysis.

We may use quotes from your feedback — without using your name or identifying information — in reports, articles, case studies, or promotional materials to demonstrate the app’s impact. If you do not want us to use quotes from your feedback, please let us know when you submit your feedback or email info@flarepathhealth.com.

2.8 Free-text and notes security guidance

FlarePath allows you to enter free-text notes in voice journals, symptom descriptions, and other fields. While we protect all data with encryption and access controls, we recommend:

• Do not include highly sensitive identifying information in free-text fields (e.g., full names of healthcare providers, specific addresses, Social Security numbers, insurance ID numbers).
• Use general descriptions rather than specific identifiers where possible
• Remember that free-text content may be reviewed by AI for structuring purposes

This guidance helps maintain an additional layer of privacy protection for your most sensitive information.

Infrastructure

FlarePath uses U.S.-based infrastructure, including:

• Supabase — database/auth/storage (SOC 2 Type II certified)
• OpenAI — voice transcription and text processing (Business Associate Agreement in place)
• Sentry — error tracking and monitoring (PHI scrubbed before transmission)
• Expo — mobile app development and push notifications
• Vercel — web hosting and deployment

All service providers that process Protected Health Information (PHI) are covered by Business Associate Agreements (BAAs) to ensure HIPAA-aligned protection of your data.

Security controls

We use administrative, technical, and operational measures, including:

• Encryption in transit: TLS 1.3
• Encryption at rest: AES-256
• Row-Level Security (RLS): database-level access controls ensure every query is automatically filtered by user_id and child_id; no user can access another user’s health data
• Database queries fail-closed (deny by default) if RLS is misconfigured
• Access controls: role-based permissions and multi-factor authentication
• Secure credential storage: device secure storage (iOS Keychain / Android Keystore)
• PHI-free logging: application logs contain only user IDs, child IDs, session IDs, and metadata — never names, DOB, symptoms, medications, or clinical notes
• Error tracking (Sentry): configured with PHI scrubbing — no health data in error messages or breadcrumbs
• Audit trails: comprehensive logging for access and modifications with 7-year retention
• Vulnerability management: periodic assessment and remediation
• Incident response: NIST-aligned procedures with 72-hour breach notification

Voice processing security

• Voice recordings uploaded to encrypted storage (AES-256 at rest)
• Transcribed via Supabase Edge Functions calling OpenAI Whisper (BAA-covered endpoint)
• Structured using OpenAI models with minimum-necessary principles (IDs and metadata only, not full names/DOB)
• Retained per user preference; you can delete recordings at any time from account settings
• Quality-validated before clinical use
• Users can review, edit, and correct all AI-extracted data before saving
• Never sent to non-BAA-covered services or analytics tools

Environment separation

We maintain strict separation between development, staging, and production environments:

• Development and staging environments use only synthetic or de-identified data
• No real PHI ever used for testing, development, or demos
• Database schema changes deployed via tested migrations with rollback capability
• Sandbox endpoints for AI, payment, and email services in non-production environments
• Separate database projects and credentials for each environment
• Production database credentials never used in development or staging

These controls are designed to align with HIPAA-grade safeguards; FlarePath is not itself a HIPAA-covered entity.

4.0 Our data sharing commitments

FlarePath shares de-identified, aggregated insights or study datasets under explicit consent and formal agreements. All sharing is for approved medical and scientific research purposes only. Research and registry participation is always opt-in.

4.1 Service providers (vendors)

We share information with vendors who provide essential services:

• Supabase — database hosting (PostgreSQL), authentication, and file storage (SOC 2 Type II; BAA in place)
• OpenAI — voice transcription (Whisper) and AI chat/structuring (BAA in place; prohibited from using your data for model training)
• Sentry — error tracking and monitoring (PHI scrubbed before transmission; no health data sent)
• Expo — mobile app development and push notification delivery
• Vercel — web hosting and frontend deployment
• Google Cloud — infrastructure hosting (Business Associate Agreement in place)
• Apple HealthKit — read-only access to health metrics on iOS (data stays on-device until you sync; governed by Apple’s privacy framework in addition to ours)
• iOS Keychain / Android Keystore — device-level secure storage for authentication tokens and session credentials (no data leaves the device through these services)

All service providers that process Protected Health Information (PHI) are covered by Business Associate Agreements (BAAs). These providers process data only as needed to deliver the Service and may not use it for their own purposes.

4.2 With your consent

We share information when you explicitly choose to:

• Export your data
• Share information with a connected service
• Authorize sharing through specific app features
• Opt into research participation (see Section 5 below)

4.3 Legal requirements

We may disclose information when required to comply with valid legal process (e.g., subpoenas, warrants, court orders).

If we are required to disclose your Health Records or other information because we have received a civil or criminal subpoena, court order, search warrant, or other legal demand:

• We will notify you within three (3) business days of receiving such a demand, except where prohibited by applicable law
• This notice gives you an opportunity to object, seek a protective order, or pursue other legal remedies available to you
• We will comply with the law while advocating for your privacy interests to the extent possible

This commitment applies to standard legal process. In cases involving immediate threats to safety, national security matters, or where notification is legally prohibited, we may be unable to provide advance notice.

Government request transparency: since FlarePath was founded, we have received zero government requests for user information. We will update this disclosure annually and notify users if this changes.

What data may be shared

• Patient-reported outcomes (symptom logs, pain levels, activity data)
• Voice recording transcripts (audio files are not shared; only de-identified transcripts)
• De-identified AI chat interactions (queries and insights)
• Clinical records obtained through your Right of Access
• Treatment logs and medication schedules
• Wearable device data (if connected)

Clinical trial participation (Pathway A)

• Uses coded participant identifiers (subject IDs) with controlled re-identification capability
• Requires separate trial-specific informed consent (see Beta User Agreement Section 12A)
• Data retention follows protocol-specific regulatory requirements
• Supports safety monitoring, protocol compliance, and regulatory submissions
• Withdrawal requests processed according to trial-specific requirements; some data may be retained for trial integrity

General research sharing (Pathway B)

• All data fully de-identified using HIPAA Safe Harbor or Expert Determination standards
• 18 PHI identifiers removed (name, address, dates, etc.)
• No re-identification capability exists for this pathway
• Small cohorts aggregated to prevent re-identification
• Researchers must sign Data Use Agreements
• All data exports logged and auditable

Your rights

• You can opt out at any time without affecting your app usage
• Withdrawal prevents future data sharing
• Previously shared de-identified data cannot be withdrawn from completed studies
• You can request deletion of your identifiable data
• Clinical trial participation has separate withdrawal procedures detailed in trial-specific consent

Research transparency

• Active research projects: we will publish descriptions of all active research projects that use FlarePath data within the app. This allows you to understand exactly how your data is being used if you opt into research participation.
• Re-identification consent: if any research initiative requires re-identifying your data (linking de-identified data back to your identity), the study will require an additional, specific opt-in consent from you. General research consent does not authorize re-identification.

Granular sharing preferences

You can control what types of data are shared for research purposes:

• Symptom logs and patient-reported outcomes
• Medication and treatment history
• Voice transcripts (audio recordings are never shared)
• AI chat interactions
• Imported medical records
• Wearable device data (if connected)

You can adjust these preferences at any time in your account settings without affecting your overall research participation status.

Minimum necessary standard

We commit to sharing only the minimum amount of data necessary to accomplish the intended research purpose. Researchers receive only the data elements required for their specific approved study — never your complete health record unless specifically justified and consented.

Understanding de-identified data and ownership

We believe in complete transparency about what happens when data is de-identified:

• Once your data is de-identified (all identifying information removed), it is no longer linked to you
• De-identified data that has been shared with external researchers cannot be retrieved or recalled
• This is an inherent property of de-identification — it protects your privacy by permanently breaking the link to your identity
• Your control point is consent: you decide whether your data enters the de-identified pool
• You can stop future sharing at any time, but this does not affect data already shared

For more information, see the FlarePath Research Databank Proposal and Beta User Agreement (Version 2.7, Section 11a and Section 12).

International participation during Beta

During the Beta testing period, international users may participate in FlarePath without geographic restriction. This helps us understand the global community and build a more inclusive platform.

For international users:

• Your data is stored on U.S.-based infrastructure and governed by U.S. law
• We apply GDPR-aligned principles to all users, regardless of location: data minimization, purpose limitation, right to erasure, right to access, right to rectification, and right to data portability
• Research participation remains opt-in and may be subject to your local regulatory requirements
• Clinical trial participation may be limited by your country’s regulatory framework

Data transfers

When you use FlarePath from outside the United States:

• Your data is transferred to and processed in the United States
• We implement appropriate safeguards including encryption and access controls
• Future versions may implement Standard Contractual Clauses or other transfer mechanisms as required

Country-specific limitations

Post-Beta, international availability will depend on:

• Local data protection law requirements
• Regulatory approvals for research activities
• Availability of local support resources

We will provide advance notice if international access changes after the Beta period.

Age requirements

• Under 13: children under 13 cannot create accounts independently. A parent or guardian must create the account and manage the child’s profile. All caregiver access is set and controlled by the system — the child cannot modify caregiver permissions.
• Ages 13–17: when a patient turns 13, they gain the ability to control which caregivers can see their health data and at what level. See “Teen caregiver access control” below.
• 18 and older: adults may create and manage their own accounts. All caregiver access is automatically revoked at age 18 — the adult must explicitly re-grant access to any caregiver they choose.

Caregiver responsibilities

Caregivers may:

• Create child/dependent profiles
• Enter wellness data, medications, and treatments
• Manage appointments and care team information
• Import/manage information they are legally authorized to access
• Invite additional caregivers to a patient’s profile

We do not knowingly allow minors under 13 to create accounts independently.

If you believe a child’s information was entered without authorization, contact info@flarepathhealth.com for resolution or deletion.

Multiple caregivers — data visibility

A patient’s profile can be shared with multiple caregivers (for example, two parents, a grandparent, or a school nurse). All caregivers on a patient’s profile have equal access to all of that patient’s health data unless access has been restricted.

For patients under 13: the primary caregiver — the account holder who created the patient profile — controls who has access. Secondary caregivers cannot add or remove other caregivers.

For patients 13 and older: the patient themselves controls each caregiver’s access level (full, limited, or revoked) independently of the primary caregiver.

Sensitive situations (custody, separation): if you are in a situation where you need to restrict another caregiver’s access to a dependent’s health data and are unable to do so through the app, contact info@flarepathhealth.com and we will assist you directly.

Teen caregiver access control (ages 13–17)

When a patient turns 13, FlarePath presents a one-time onboarding screen explaining their new privacy rights. No access changes are made automatically — existing caregiver access remains in place unless the teen explicitly changes it.

Once a teen acknowledges this screen, they can manage each caregiver’s access level individually from Settings → Caregiver Access. Three levels are available:

• Teens can set different access levels for different caregivers (e.g., Full for a parent, Limited for a grandparent)
• Changes take effect immediately and are logged in an audit trail the teen can review
• Caregivers receive an in-app notification when their access level changes, but are not told the previous or new level — only that it changed
• A caregiver whose access is revoked cannot reinstate their own access; only the teen can do so
• All historical data entered before the teen took control remains accessible based on the current access level — there is no retroactive hiding of data

At age 18 — full ownership transition

When a patient turns 18, all caregiver access is automatically set to revoked. The adult patient must explicitly re-grant access to any caregiver they want to continue sharing data with. This transition is checked on login.

8.1 Deceased user data

Because FlarePath users may include individuals with serious or chronic conditions, we have policies for handling data when a user passes away:

• We may retain Health Records and account data after learning of a user’s death
• If retained, we will honor data sharing preferences expressed by the user prior to death
• A Personal Representative or legally authorized family member may request: access to the deceased user’s data, export of records, or deletion of the account and associated data
• Research participation preferences expressed before death will be honored unless a legal representative requests otherwise

To make a request regarding a deceased user’s account, contact info@flarepathhealth.com with appropriate documentation of legal authority.

Mobile app

The FlarePath mobile app does not use cookies. We use secure authentication tokens stored in your device’s secure storage (iOS Keychain / Android Keystore) to maintain your session.

Website

Our website may use the following types of cookies:

• Strictly necessary cookies: required for the website to function (e.g., authentication, security). Cannot be disabled without breaking core functionality. Do not store personally identifiable information.
• Analytics cookies (optional): help us understand how visitors use our website. Collected data is aggregated and de-identified. You can opt out via your browser settings or our cookie consent tool.

Managing cookies: you can disable non-essential cookies through your browser settings. Disabling cookies may affect some website functionality. Cookie preferences do not affect the mobile app.

We do not sell or share your data

FlarePath does not sell your personal information to any third party. FlarePath does not share your personal information for cross-context behavioral advertising. Because we do not engage in these activities, there is nothing to opt out of — but we state this explicitly as required by applicable law.

Right to limit use of sensitive personal information

Health data is classified as sensitive personal information under California (CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Texas (TDPSA) law. FlarePath already limits its use of your health data to providing and improving the Service. If you wish to formally invoke this right, contact privacy@flarepathhealth.com.

Rights available to state residents

Appeal rights

If we deny a rights request, you may appeal by emailing privacy@flarepathhealth.com with “Appeal” in the subject line. We will respond within 45 days. If your appeal is denied, you may contact your state’s Attorney General:

• California: California Privacy Protection Agency — cppa.ca.gov
• Virginia: Virginia Attorney General — ag.virginia.gov
• Colorado: Colorado Attorney General — coag.gov
• Connecticut: Connecticut Attorney General — portal.ct.gov/ag
• Texas: Texas Attorney General — texasattorneygeneral.gov

We will respond to verified rights requests within 45 days. For complex requests, we may extend this by an additional 45 days with notice.