Nevada Consumer Health Data Privacy Policy

1. Data Categories, Purposes, and Processing

Consumer health data includes personally identifiable information used to identify a person's past, present, or future health status. Depending on what you or an authorized person provide, we process:

Medical content can include physical or mental conditions, symptoms, disabilities, medications, tests, treatment, reproductive or sexual health, gender-affirming care, substance-use information, or genetic information appearing in a document. We collect only the content provided or generated through use of the Services; these examples do not require every consumer to submit every type.

Processing uses software, automated speech recognition, document extraction, AI generation, and restricted personnel access when necessary for an authorized support or security function. Microsoft Azure provides our identified hosting, storage, transcription, document-processing, and AI services. Its automated abuse controls may also result in restricted human review of flagged AI content. We do not use consumer health data to train or fine-tune generative AI models.

2. Sources

Data comes from you; Care Circle members or representatives authorized to act for you; your device and interactions with Lenaya; the medical conversations and documents you supply; and transcripts, summaries, answers, and other information derived from those sources. A clinician named in an uploaded record is not automatically a direct electronic source to Lenaya.

3. Data Shared and Recipient Categories

The relevant categories in Section 1 may be disclosed as follows:

• People you authorize: records and derived information within the Care Circle permissions or other sharing authority you grant, to support your care.
• Processors for hosting, storage, transcription, document processing, and AI: the content and identifiers necessary to provide those features under contract and our instructions.
• Support, security, monitoring, and communications processors: information necessary to deliver messages, solve an authorized support issue, investigate an error, or protect the Services. Health content is included only when necessary for that function.
• Legally required or otherwise legally permitted recipients: information within the scope permitted or required by applicable law, subject to medical-confidentiality restrictions. A government request alone is not sufficient authority.
• Qualifying business-transaction recipients: information included in a lawful transaction subject to continuing privacy obligations and any required consent or authorization.

Some disclosures to processors or in qualifying transactions are excluded from Nevada's definition of sharing. Describing them here does not enlarge the statutory exclusions.

We do not share consumer health data with corporate affiliates. We do not sell it, disclose it for targeted advertising, build advertising profiles from it, or provide it to data brokers or to insurers or employers for their independent use or decision-making.

4. Consent and Withdrawal

We obtain the affirmative, voluntary consent required for collection and sharing, or rely on an applicable exception, including processing necessary for a service you requested where permitted. Where required, sharing consent is separate from collection consent and is obtained before sharing.

The consent request explains the categories of data, purpose and use, recipient categories for sharing, and how to withdraw consent. New categories, recipients, or purposes are disclosed and consent is obtained before processing where Nevada law requires it.

Remove a Care Circle member to stop future access through Lenaya. For other withdrawal requests, email support@lenayahealth.com and identify the collection or sharing you want stopped. You can also request deletion. Withdrawal affects future activity covered by the permission and may prevent features that need the information from operating; it does not undo completed lawful processing or automatically erase existing records.

5. Requests to Confirm, Identify Recipients, Stop Processing, or Delete

Where Nevada law applies, you may request that we:

• Confirm whether we collect, share, or sell consumer health data concerning you.
• Provide the list of third parties with whom we have shared or sold that data. We do not sell it, but you may still request applicable sharing information.
• Cease collection, sharing, or sale of your consumer health data as provided by law.
• Delete your consumer health data.

Email support@lenayahealth.com, preferably from your account address, and describe your request. You may use "Nevada Health Data Request" as the subject, but a special subject line is not required. Available in-app deletion and sharing controls can also be used. If those controls do not meet your need or you cannot access the account, email us. We provide a secure verification process and may request only information reasonably necessary to authenticate identity or authority.

We respond without undue delay. Nevada generally allows forty-five days after authentication for a response, with a further forty-five-day extension when permitted and reasonably necessary. Our general policy is to respond within forty-five days after receipt unless a permitted extension or a different applicable deadline governs. We do not delay authentication to avoid our obligations. We notify you of a permitted extension and explain why.

For covered deletion requests, we delete the requested data from our records and network and notify relevant downstream recipients within thirty days after authentication. Nevada requires notified affiliates, processors, contractors, and other third parties to meet their own applicable deletion deadline, generally thirty days after notification, subject to lawful backup provisions.

Our ordinary process removes most health content promptly, with some derived data and routine encrypted backups clearing within about three weeks. We reapply deletions if recovery reintroduces records. A longer statutory allowance for backups does not replace this shorter ordinary schedule. Any retention exception must have a specific lawful basis and be limited to its purpose.

Copies or shared views controlled by Lenaya remain subject to deletion. We cannot erase a person's memory or retrieve a copy independently saved outside the Services; this does not remove any legally required recipient-notification obligation.

We provide information without charge for at least two requests each year and for additional requests that are not manifestly unfounded, excessive, or repetitive. A fee for an exceptional request must be reasonable and permitted by law. We explain any refusal, authentication problem, or lawful fee. We do not unlawfully discriminate against consumers exercising their rights.

6. Reviewing and Correcting Information

You can review your records and use available editing features in the Services. You can also request a copy or correction by emailing support@lenayahealth.com and identifying the inaccurate information. We verify the request and explain what we can correct. Changes within Lenaya do not alter the clinician's original records.

7. Appeals

Reply to a refusal or email support@lenayahealth.com with "Nevada Health Data Appeal" and explain why you disagree. We send a written decision and reasons within forty-five days after receiving the appeal. If we deny the appeal, we provide contact information for the Nevada Attorney General. You may also use the Attorney General's contact page.

8. Collection Across Websites and Services

We do not authorize third parties to collect consumer health data through Lenaya over time and across different, unrelated websites or online services for their independent tracking or profiling purposes. We do not use third-party advertising trackers. Providers may process information on our behalf for the limited functions described in this Policy; that permission does not authorize independent cross-site health tracking.

9. Changes to This Policy

We post updates and revise the Last Updated date. Before a material change to our health-data practices takes effect, we provide prominent notice through the Services or by email. We obtain new consent or authorization where required before collecting additional data categories, sharing with additional recipients, or using data for new purposes. A policy update by itself does not replace required consent.

10. Contact

Clargenta AI LLC — Lenaya Health
Email: support@lenayahealth.com
Website: https://staging.lenayahealth.com

For broader account, security, and retention information, see our Privacy Policy.