Jetty Privacy Policy

1 Who is responsible for your information?

Jetty Health, Inc. ("Jetty" or "we") is responsible for your personal information in our consumer app, website at https://www.myjettyhealth.com/, and related services and communications. Personal information means information that identifies you or can be linked to you.

Contact us at support@myjettyhealth.com. Jetty has designated a privacy officer accountable for our handling of personal information. You can reach our privacy officer at privacy@myjettyhealth.com. You can ask for an accessible copy of this policy.

Our separate Consumer Health Data Privacy Policy explains Washington health-data practices and rights. More protective legal requirements take priority over this policy.

Jetty is a consumer service. We do not provide it on behalf of your doctor, insurer or employer. This is not a HIPAA privacy notice: information you give a consumer app may have different protections from information held by your doctor. Other health privacy laws still apply.

Reading this policy or using Jetty does not give consent to every use described here. We ask for separate permissions when required.

2 What information does Jetty collect?

What we collect depends on what you share, connect and choose to use. Information comes from you, your device, connected services, our service providers, and the summaries or insights Jetty creates.

3 How does Jetty use this information?

To provide the features you request

We use relevant information to run your account and subscription, answer questions, track health entries, give reminders, prepare for visits, and create reports, summaries and personalized insights. Connected information is used for the purposes explained.

To help you and keep Jetty working

We use necessary information for support, troubleshooting, security, abuse prevention, legal duties and privacy requests. Authorized staff may access relevant conversations or recordings for these tasks.

To improve Jetty

We use product metrics and information combined or changed so people cannot reasonably be identified. When we treat information as de-identified, we take steps to prevent identification, do not try to identify people again, and require recipients to follow appropriate restrictions.

We use de-identified data—information that cannot reasonably be linked back to you—to train and improve models that power Jetty features, such as predicting flare-ups. We keep this data de-identified and do not attempt to re-identify it. We do not use your health conversations to train general-purpose AI models. Using your personal information to generate a response or prediction is different from using it to train a model.

Authorized Jetty team members may review your conversations, including health information linked to you, to find and fix problems and improve Jetty’s responses and features. We ask for your consent when required by law and follow any restrictions that apply to these uses. We do not use your health conversations to train general-purpose AI models.

To contact you

We send account and service messages. Promotional messages follow your choices and any required consent; use the unsubscribe link or contact us to stop them.

4 Who receives your information?

Providers receive information relevant to the job they perform. They do not all receive everything. Providers working for us have agreements covering allowed uses, confidentiality, security and help with your rights, including deletion.

When you share a report or export, the recipient you choose receives it and may keep their own copy. Review the content before sharing.

We may disclose necessary information to advisers, authorities or others for a legally permitted obligation or legal claim. Health confidentiality, consent and international-transfer restrictions still apply. A business sale or merger may involve a lawful transfer of information, with required safeguards, notice and consent. It does not allow incompatible new uses of your health information. If Jetty is sold or merges with another company, your information may be transferred with the safeguards, notice and consent required by law. We will require any buyer or successor receiving your information to agree in writing to honor this Privacy Policy and your existing privacy choices. A change in ownership does not, by itself, permit incompatible new uses of your health information.

5 How does AI use your information?

Jetty may combine your question, relevant past conversations, health entries, connected data and saved memories to respond or find patterns. AI can make mistakes. You can correct stored information or ask us to delete records and related insights.

Jetty does not replace medical advice, diagnosis or treatment. Using it does not create a doctor-patient relationship, and it does not monitor emergencies.

We do not use your health conversations to train general-purpose AI models. Using your personal information to generate a response or prediction is different from using it to train a model.

We use automated tools to personalize your experience and identify patterns in your health information.

6 What can you choose or turn off?

You choose whether to connect health records, wearables or a calendar; share location; enable notifications; upload files; or use voice. A feature may stop working if you withdraw permission for information it needs. Unrelated features remain available.

We ask for your consent to collect and use your health information. If you choose to use voice recognition, we ask separately for permission to create and use your voiceprint. It helps Jetty recognize when you are speaking and distinguish your voice from other speakers in recordings of doctor visits involving multiple people.

Device permissions, such as microphone, are additional controls and do not replace these consents.

What your choices do

Special rules for connected data and recordings

We access only Apple Health categories you allow. We do not sell that data or use it for advertising, marketing or data-broker activities. Required permissions also apply when providers help deliver your chosen health features. Clinical sync may continue in the background until disabled.

Our use and transfer of Google API information follows the Google API Services User Data Policy, including Limited Use requirements. Calendar data supports your requested calendar and appointment features. Limits on human access and further sharing still apply.

Before recording a visit or another person, tell everyone involved and obtain the permissions the law requires. Microphone permission alone does not authorize recording others or creating their voiceprints.

7 What are analytics, session replay and cookies?

We use Firebase Analytics, Mixpanel and PostHog to understand how people use Jetty and identify problems. These tools may receive account-linked identifiers, app and device details, the screens and features you use, and information about interactions and timing. PostHog may also receive your email address. This information can be linked to your account.

PostHog provides session replay to help us understand navigation and find usability problems. We configure replay to mask text you enter, images and sensitive screen content. Replays may still show taps, scrolling and other activity linked to your account.

Our website does not use advertising pixels.

8 How does optional voice recognition work?

A voiceprint is a digital pattern used to recognize your voice. It is biometric information.

If you opt in, Jetty and Speechmatics use an enrollment recording to create a voiceprint. We use it only to distinguish your voice from other speakers in optional doctor-visit recordings—not for check-ins or ordinary voice chats.

Before collecting, creating or disclosing a voiceprint, we explain its purpose and storage period in writing and obtain the required consent or written permission. Choosing to record a doctor visit does not, by itself, authorize voiceprint enrollment. We do not enroll other people simply because they appear in a recording.

We do not sell, lease, trade or otherwise profit from biometric information. We disclose it only as biometric law allows and obtain any required permission. We do not offer this feature where we cannot meet those rules.

How long we keep voiceprints

Contact us to remove it. We stop future voice matching and permanently delete the voiceprint and identifying copies from our systems and providers within 30 days, or sooner if required. Backup handling must also meet biometric law. We use reasonable care to protect this information, at least as carefully as other confidential information.

This is our public biometric retention and destruction policy. These additional deadlines apply where required:

9 How do we protect your information?

We use encrypted connections, encryption in our core cloud storage, access controls and procedures for security incidents. Staff access for troubleshooting is logged. Encryption still allows Jetty and its providers to process information needed for an authorized task.

No system is completely secure. If a breach requires notice, we notify affected people, regulators and others within the applicable legal deadlines, including health-data breach requirements.

10 How long do we keep information?

We keep information only as long as needed for the stated purpose. The period depends on the feature, your choices and legal requirements. An active account does not mean we keep every record forever.

When you request deletion, we delete covered records and related files and insights, and tell providers and other recipients to delete them as the law requires. Where the law permits a limited record to be kept for legal or security reasons, we restrict its use to that purpose. Stricter health and biometric deletion rules still apply.

Backups are kept out of ordinary use and deleted on the required schedule. If restored, we apply deletion requests again. Washington's special backup rule allows up to six months after we verify a health-data deletion request, when that exception applies. It does not extend the deadline for active systems. Other laws can require earlier deletion.

11 How do you access, correct or delete information?

Email support@myjettyhealth.com. You can ask us to:

• Show you your information and who received it.
• Correct inaccurate information.
• Provide a copy you can move to another service. A health-report export may not contain everything in your account.
• Delete information or your account.
• Stop a use you previously agreed to.

To delete your account in the app, go to Profile > Account Info > Delete account. If you cannot use a control, contact us. You do not need to open a new account or pay to submit a request.

We verify your identity using only what is reasonably needed, usually through your account or an existing contact method. Verification details are used only for verification and related security or compliance. Where allowed, someone you authorize can make a request for you; we may check their authority. We do not require identity verification for opt-outs when the law forbids it.

Some requests have legal limits, such as protecting someone else's information. If we refuse, we explain why and how to appeal or complain. We do not punish you or unlawfully discriminate for exercising your rights. A feature may become unavailable if you withdraw consent for information it needs.

Requests are free as required by law, including at least two US rights requests per year. We explain any lawful fee before charging it. Response times are below; shorter legal deadlines take priority. Verification does not automatically pause the clock.

12 Additional rights in the United States

State laws differ. Depending on the law that applies, you may have rights to access, correct, delete or get a portable copy of your information; withdraw consent; learn who received data; and opt out of sales, targeted advertising or certain profiling. Use Section 11 to make a request.

Sales, advertising and privacy signals

We do not sell or license personal information, including health information, voiceprints or precise location. We do not use or disclose health, biometric, precise-location or Apple Health information for targeted advertising. A legal "sale" can include exchanges for something other than money. California "sharing" means certain advertising uses, not every disclosure to a service provider.

Where required, we honor valid opt-out signals such as Global Privacy Control for the browser or device, and a linked account when required. You can also contact us. Our website does not change its collection or use of information in response to traditional “Do Not Track” browser signals. These are different from Global Privacy Control signals.

Response times and appeals

To appeal a refusal, reply to us or email support@myjettyhealth.com with "Privacy Appeal." If denied, we explain how to complain online to your state regulator. You may complain to the regulator without first appealing to us.

Where your state provides it, you can request a list of specific third parties that received your data, or personal data more generally, or the required recipient categories. This includes applicable Oregon and Minnesota rights. Minnesota profiling rights can also let you question a result, understand its reason, review and correct the data, request a new evaluation, and learn what could change or prevent the decision.

California

The following categories describe collection and business-purpose disclosures in the past 12 months. Sources and purposes appear in Sections 2 through 7; retention is in Sections 8 and 10.

Each category may also be disclosed at your direction or as Section 4 permits. We do not knowingly sell or share information about people under 16.

You may ask to know categories and specific pieces of information, sources, purposes and recipients; correct or delete information; opt out of sale or sharing; and limit certain uses of sensitive information. Exercise an applicable limit right by contacting us. An optional review consent does not remove that right.

We acknowledge applicable access, correction and deletion requests within 10 business days and review this policy at least annually. Under California's Shine the Light law, you can ask about disclosures for third parties' direct marketing.

Washington and Nevada

Washington health-data rights are in our separate Consumer Health Data Privacy Policy.

For Nevada, Sections 2 through 6 describe health-data categories, purposes, sources and recipients, including health insights and health-related location. We collect and use it through entries, uploads, connected services, app events, recordings, storage, automated analysis and the human access described above. You can review or correct it through record controls or Section 11.

We obtain required consent to collect and share covered health data unless the law permits what is necessary to provide your requested service. When required, sharing consent is separate. We use appropriate provider contracts and do not sell this data.

Nevada consumers can confirm collection, sharing or sale; access health data and required recipient information; withdraw consent; and request deletion through Section 11.

Other health-data protections

Where California, Texas or other medical confidentiality laws apply, we obtain any required authorization before disclosure. This policy does not replace that authorization. Texas electronic-disclosure notice: Jetty shares information electronically with the providers and recipients in Section 4 for the stated purposes, with any authorization Texas law requires.

We do not use prohibited geofencing, such as a virtual boundary around a healthcare facility to track care seekers, collect health data or target health ads. Where Maryland law applies, we collect, use and disclose sensitive information only as strictly necessary for a service you specifically request. We do not sell it. Consent cannot override a legal prohibition.

13 Additional rights in the EEA and UK

Jetty Health, Inc. is the "controller": the company responsible for deciding how and why information is used. For GDPR and UK GDPR purposes, our legal reasons are:

We need basic account details to provide an account. Sensitive information is voluntary, but a feature that needs it cannot work without it. Optional analytics, review and connected sources are not required for unrelated features. Your information is not generally required by law to use Jetty; we will tell you if a legal requirement arises.

Your rights and response times

Subject to legal conditions, you can access, correct, delete or restrict use of information, withdraw consent, and get a portable copy of information you provided. You can ask for direct transfer to another provider when technically possible.

You can object to use based on legitimate interests for reasons specific to you; we stop unless the law permits an overriding reason to continue. You can object to direct marketing, including related profiling, at any time, and we stop that use. You also have protections against significant decisions made entirely by software.

We answer promptly and within one month. For complex or numerous requests, the law may allow two more months; we explain the extension within the first month. If we cannot act, we explain why and your complaint and court options within the applicable deadline.

Complaints

Contact support@myjettyhealth.com. For UK complaints, we acknowledge receipt within 30 days, investigate promptly, keep you informed and tell you the outcome. This does not extend privacy-request deadlines.

You may also complain to your data protection regulator, particularly where you live, work or where a problem occurred. EEA contacts: https://www.edpb.europa.eu/about-edpb/our-members_en. UK Information Commissioner's Office: https://ico.org.uk/make-a-complaint/.

15 Where is information processed?

Jetty uses infrastructure in the United States. Our service providers may also store, process or access information in other countries, where privacy laws may differ from those where you live.

Our signed provider agreements include protections for international transfers of information covered by EEA, UK or Swiss privacy law:

The protection that applies depends on the provider, destination and relevant privacy law.

To learn which safeguards apply to your information or request a copy of applicable contractual safeguards, email privacy@myjettyhealth.com.

16 Who can use Jetty, and how will this policy change?

Jetty is for adults aged 18 and over. We do not knowingly collect information from people under 18 for their own accounts. Contact us if you believe a child has signed up so we can investigate and take appropriate action, including deletion where required. A child's details in an adult's medical or family history do not give permission for unrestricted use of that child's information.

When this policy changes, we update its date. We give advance notice of material changes through the app, email or another suitable channel.