Privacy Policy

Plain-English summary

• Further Health is a privacy-first, local-first health information and educational tool, offered as a beta in the United States only. It is not a substitute for your clinician.
• We do not sell your personal information or health data, we do not "share" it for cross-context behavioral advertising, and we never give it to advertisers, data brokers, insurers, or employers. The only recipients are the service providers in Section 7.
• Your sensitive health data (lab results, genetic data, medical records, health records from Apple Health, cycle entries, wearable detail) is processed and stored on your own devices, encrypted with AES-256-GCM. Copies that sync between your devices or are backed up are encrypted before they leave the device. Your raw genetic file never syncs and is never included in a cloud backup. Only a pseudonymized subset (direct identifiers removed), plus any photos you attach to a question, reaches our AI service, and only when you use a premium feature.
• Memory is on by default while premium is active for the account owner: the app uses your past conversations and, once you accept these terms (or the current premium consent on iPhone), notes and visit summaries from records you connected from a patient portal to personalize answers. Short, scrubbed excerpts go with a premium request. You can turn either part off at any time in Settings › Memory on iPhone or Settings › Security & Privacy on Mac (Section 6A).
• When you accept our terms or turn on a sensitive feature, we keep an append-only proof-of-consent record (the time, the version you agreed to, a hash of what you saw, your device identifier, your IP address, and the browser or software used to submit it), linked to your account. These consent records contain no health or genetic data.
• You can export, delete, or revoke any data source at any time. Revoking a wearable connection, switching to a different wearable account, or deleting your account triggers the deletion steps below.
• You have rights under the CCPA/CPRA, the Washington My Health My Data Act, Nevada SB 370, GINA (for genetic data), the GDPR/UK GDPR where it applies, and other laws. We honor them regardless of where you live.

This summary is for convenience only. The full Privacy Policy below is the binding document. Effective date: October 15, 2026.

Table of contents

• Section 1. About this Policy
• Section 2. Who we are and how to contact us
• Section 3. Scope
• Section 4. Information we collect
• Section 5. How we use your information and legal bases
• Section 6. Our privacy architecture (on-device and pseudonymized cloud)
• Section 6A. Memory
• Section 6B. Sync and backup between your devices
• Section 7. How we share information and sub-processors
• Section 8. Wearable and connected services
• Section 9. Genetic information (GINA)
• Section 10. Reproductive and sexual-health information
• Section 11. International data transfers
• Section 12. Data security
• Section 13. Data retention and deletion
• Section 14. Your privacy rights
• Section 15. Washington consumer-health-data policy (MHMDA)
• Section 16. Nevada and other consumer-health-data laws
• Section 17. Biometric information
• Section 18. HIPAA status
• Section 19. Health Breach Notification Rule
• Section 20. Children
• Section 21. Cookies and similar technologies
• Section 22. Automated processing and AI
• Section 23. Changes to this Policy
• Section 24. Contact

1. About this Policy

This Privacy Policy explains how Further Health ("Further Health," "we," "us," or "our") collects, uses, stores, shares, and protects personal information when you visit further.health (the "Site") or use the Further Health application or any associated service (together, the "Service").

Further Health is a health information and educational tool. It is not a healthcare provider, and its outputs — including AI-generated discussion of possible explanations, medications, or typical doses — are information to review with your clinician, not a diagnosis or prescription from a licensed professional. Decisions about your health should be made with a licensed healthcare provider. See our Terms of Service and Wellness Disclaimer.

The Service is currently offered as a beta, in the United States only.

By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service. Where we rely on your consent (for example, to process special-category health, genetic, biometric, or reproductive data), you may withdraw it at any time as described in Section 14.

2. Who we are and how to contact us

Further Health is the data controller (or "business," depending on the law that applies to you) of the personal information described in this policy. The operating entity is Further Health LLC.

• Privacy and data-rights requests: privacy@further.health
• General support: support@further.health
• Data Protection Officer: not appointed; privacy inquiries go to privacy@further.health.
• EU representative under GDPR Article 27: the Service is offered only in the United States and is not directed to the European Economic Area, so no EU representative has been appointed.
• UK representative under UK GDPR Article 27: the Service is not directed to the United Kingdom, so no UK representative has been appointed.

We will respond to verified requests within the timeframes required by the law that applies to you (typically 30 days under the GDPR/UK GDPR, 45 days under the CCPA/CPRA, and 30 days under the Washington My Health My Data Act).

3. Scope

This policy covers the Site and the Further Health application when used as a consumer product. If we ever offer the Service to a healthcare provider or organization under a separate business-associate or data-processing agreement, that agreement will govern that relationship.

The Service connects to, or imports files from, third-party services at your direction (for example WHOOP, Oura, Apple Health (including the health records you choose to share from the Health app), Quest Diagnostics, LabCorp, MyChart, consumer genomics services such as 23andMe, AncestryDNA, MyHeritage, and TellMeGen, and calendar providers such as Google Calendar, Apple Calendar, and Microsoft Outlook). Those services have their own privacy policies, which we encourage you to read. This policy explains how Further Health handles data we receive on your behalf — it does not change the practices of those services themselves.

4. Information we collect

We collect only the categories of personal information described below, and only for the purposes described in Section 5. Most sensitive health data is processed and stored on your device (Section 6). When you take a consent action (for example, accepting our terms or turning on a sensitive feature), we also keep a proof-of-consent record that contains no health data (Section 4.13).

4.1 Account information

When you create an Account we collect your email address and an optional display name. We never request a government-issued identifier, Social Security number, or full payment-card number except through a payment processor or platform (see Section 7).

4.2 Connected wearables (WHOOP, Oura, Apple Health)

When you authorize WHOOP or Oura through OAuth, our connection service receives a refresh token that lets the app read the categories of data you authorized. The connection service stores that token and the granted permissions (scopes) encrypted. It does not store your provider account identifier itself; it keeps only a keyed one-way hash of it, so it can recognize your connection and match the provider's notifications to it. Your devices use the resulting access to fetch the data classes you authorize directly from the provider; the wearable readings themselves are stored on your devices, not by the connection service. For example:

• WHOOP — heart rate, heart-rate variability (HRV), sleep stages and performance, recovery, strain, workouts, and skin temperature. We never request profile photos, payment information, or social-graph data.
• Oura — heart rate, HRV, body-temperature deviation, blood-oxygen estimates, respiratory rate, sleep stages and score, readiness, and activity. Our connection service does not store Oura readings; they are stored on your devices (see Section 8.2).
• Apple Health / HealthKit — only the data types you specifically authorize in the iOS permission sheet, read on your iPhone: activity (such as steps, active energy, distance, and flights climbed), heart rate, resting heart rate, HRV, VO₂ max, blood pressure, body weight, body fat, BMI, body temperature, blood oxygen, blood glucose, respiratory rate, sleeping wrist temperature, sleep, and workouts. The app reads this data and never writes to Apple Health. How this data syncs and is backed up is described in Sections 6B and 8.3. Health records from the Health app are described in Section 4.5A. We never sell HealthKit data, never use it for advertising or other use-based data mining, never share it with third parties for advertising, and never disclose it to a third party without your explicit permission.

You can disconnect any wearable from inside the Service at any time. Disconnection asks the provider to revoke our access, permanently erases the stored credentials on our connection service, stops new data, removes that provider's data from your device, and starts the deletion timeline in Section 13. Revocation at the provider is best effort: if the provider does not confirm it, the provider may treat the token as valid until it expires, so you can also revoke access from your account with the provider (Section 8).

Switching to a different wearable account. If you reconnect WHOOP or Oura and sign in to a different account with that provider than the one previously connected, the app asks you to confirm the switch before anything changes. If you confirm, the data imported from the previous account (daily summaries, workouts, and body measurements) is removed from your devices, the removal is applied on your other signed-in devices when they next sync, and the app then imports data from the new account. If you choose "Keep current," the new sign-in is discarded and nothing changes. This works the same on iPhone and Mac. On our connection service, the new account's credentials stay inactive until you confirm; an unconfirmed sign-in expires after fifteen (15) minutes and is deleted within a day. When you confirm, the previous account's stored credentials are permanently erased.

4.3 Laboratory results

You can upload lab reports as PDFs or photographs, or connect a laboratory or health-record provider, to import results. We extract structured values (analyte name, value, unit, reference range, specimen, collection date) and keep the underlying source document. Text is read from the PDF or photo on your device, using Apple's on-device text recognition; the file itself is not uploaded. The original document and the structured values are stored on your device, encrypted at rest.

4.4 Genetic data and polygenic scores

You may upload a raw genetic data file (for example from a consumer genomics service) or a clinical VCF. The file is parsed on your device. The Service computes polygenic scores and carrier/trait observations from the variants it analyzes. The raw file is stored on your device, encrypted at rest, and is never transmitted to our servers, our sub-processors, or any third party. Genetic data is treated with heightened protection under Section 9 (GINA).

4.5 Medical and clinical records

You may import C-CDA documents, FHIR bundles, scanned records, or PDFs of clinical notes, imaging reports, or prescriptions. The Service parses these locally and stores them on your device, encrypted at rest. They sync, encrypted, between your own devices and are included in your encrypted backup as described in Section 6B.

4.5A Health records from Apple Health

On iPhone, you can let the app read the health records you choose to share from the Apple Health app. Records can be imported only on iPhone. The app asks for read-only permission to these record types: allergies, conditions, immunizations, lab results, medications, procedures, vital signs, insurance coverage, and clinical notes. It never writes to Apple Health. For each record it reads the record's FHIR content, the FHIR version and resource type, and the name and web address of the source that provided it. Apple Health asks for your permission before any record type is shared, and you can change that permission at any time in the Health app or iOS Settings.

• Storage. The records are stored encrypted on your iPhone in your Further Health data.
• Sync. Health records from Apple Health are never stored in iCloud. If your sync and backup storage is Further Health cloud storage (Section 6B), they sync, encrypted, to your own signed-in devices (including the Mac app): they are encrypted on your device before upload, so our storage provider and our servers receive only encrypted data. If your storage is iCloud (the default when iCloud Drive is available), they are not synced or backed up at all and stay on your iPhone. They are included in an encrypted copy you choose to make yourself with "Make a copy".
• Records that disappear from Apple Health. If a record no longer appears in Apple Health, the app deletes its copy the next time it fully re-reads Apple Health (when you tap Import, or automatically about once a day while the app is open). If every record from a hospital disappears from Apple Health, the app waits until that hospital has been missing for at least six (6) hours before deleting its records. These deletions also apply on your other synced devices. There is no setting for this; it happens automatically so your copy matches what you share in Apple Health.
• Removing them. You can remove the records imported from Apple Health at any time in Records › Apple Health › "Remove Apple Health records". Only the copies that came from Apple Health are removed; a record your hospital also sent through a direct connection stays. The removal also applies on your other synced devices, and automatic Apple Health import stops until you choose to import again.
• Use. We use these records only to show you your own health information and, if you use premium features, to personalize answers (Section 4.9). They are not added to the Memory search index (Section 6A). We never sell them, never use them for advertising, and never share them with anyone without your explicit permission.

4.6 Menstrual-cycle and reproductive information

If you enable cycle tracking (eligible adults only, strictly opt-in), we collect the cycle and symptom information you log. This is reproductive and sexual-health information and is treated as sensitive consumer health data under Sections 10, 15, and 16. It is stored on your device, encrypted at rest, and is subject to the accelerated deletion timeline in Section 13.

4.7 Calendar (optional)

If you authorize a calendar connection, we read the start time, end time, title, and any keywords you choose, solely to let you correlate events with health signals. We do not read attachments, attendees, or meeting links. Calendar contents are stored on your device.

4.8 Device and log information

When you use the Site or Service, our hosting provider automatically logs information that every web service receives — IP address, user-agent, referrer, and the endpoint requested — for operating, debugging, and protecting the Service. We do not correlate these hosting logs with your health data. Separately, certain consent actions create an identity-linked consent-evidence record described in Section 4.13; that record is deliberately tied to your account, but it too contains only proof-of-consent metadata — no health values, lab results, genetic data, or results of any kind.

When you activate a license on a device, we also record, with the license record, the IP address and request User-Agent of that activation, the app version and build, the operating system, the device model, the device label, the platform, and the device's public key, to protect licenses against misuse.

If you send a bug report or feature request from the app, we receive what you write (up to 5,000 characters; email addresses, phone numbers, and similar identifiers are removed automatically before it is stored), whether it is a bug or a feature request, the platform, the app and operating-system version, the device model, and the app's device identifier. If you have an active premium license, the report is linked to your account and its email address. No logs, screenshots, or health data are attached. We keep reports until your account is deleted.

4.9 Premium AI Analysis inputs

When you use a premium feature (premium chat or a Premium AI Analysis), a pseudonymized subset of your data (with direct identifiers removed) is transmitted to our servers and our cloud large-language-model sub-processor to generate the answer. That subset can include short summaries of your medical records and health records from Apple Health; short excerpts of your clinical notes (including notes from Apple Health), with direct identifiers redacted; excerpts of your earlier conversations (Section 6A); your explicit answer preferences (reading level, length, and language); any photos you attach to a question (Section 4.10); and the other categories described in Section 6 and in the premium consent the app shows before premium is activated. Automated redaction may not remove every name that appears in free-text notes. In Answers & language, Auto saves no preference; absent choices let the AI adapt to the conversation.

4.10 What we do not collect

• We do not collect precise geolocation.
• We do not collect mobile advertising identifiers (IDFA, AAID) and we do not run advertising or marketing trackers.
• We do not collect your contacts or microphone input (dictation is transcribed on your device). We collect only the images you choose to capture or upload in the app. A photo of a lab report is read on your device and is not uploaded. If you attach photos (up to five) to a note on a question, they are stored encrypted on your device and, when you use a premium feature with that question, sent once with the request as a reduced-size image with its metadata (including location) removed. The photo content itself is not redacted, so do not attach photos that show information you do not want to send.
• We do not buy personal information about you from data brokers, credit bureaus, or any third party.

4.11 Data-category, sensitivity, and source table

4.12 Categories under the California Consumer Privacy Act

For California residents, the table below maps what we collect to the categories in Cal. Civ. Code § 1798.140(v) and the "sensitive personal information" subcategories in § 1798.140(ae).

We collect personal information from (i) you directly, (ii) the third-party services you authorize, (iii) the documents and files you upload, and (iv) standard server logs. We do not buy personal information from data brokers.

4.13 Consent and compliance records

When you take a consent action in the Service — for example, accepting the wellness Terms and this Privacy Policy, accepting the genome-entry agreement before you read your genome, turning on "Show sensitive results" in the Genome feature, or agreeing to premium cloud processing of your health data before you activate premium — the application sends a device-signed consent-evidence attestation to our licensing API, and our server keeps one append-only record of that action. We keep these records as evidence that your consent was obtained and that it was freely given, specific, and informed. For most features the record does not gate, unlock, or enable the feature — the feature works from your consent on your device, and the record is separate proof that the consent happened. Two exceptions: before every premium request our server checks that you have accepted our terms or the premium cloud-processing consent and have not withdrawn that consent, so withdrawing it stops premium processing; and the app uses your signed acceptance of these terms (or, on iPhone, of the current premium consent) to decide whether health-records Memory may start on by default (Section 6A).

Each record contains only consent metadata:

• The consent event — the fact that you gave consent, the exact time you consented, and the time our server received the attestation.
• What you agreed to — the version number of the disclosure you accepted and a SHA-256 hash of the exact text you were shown (an integrity proof of the wording you agreed to).
• Device proof — a per-install device identifier (a random UUID), the device's public key, and signature-verification flags confirming the attestation was signed on your device.
• Network and environment — the IP address observed when the attestation was uploaded, a coarse description of the browser or application software that submitted it (the request User-Agent), and the platform, operating-system version, and application version.
• Account linkage — the account, user, and license identifier the record belongs to, which our server derives from your authenticated session (we do not accept these values from the application).

These records contain none of your health data. They include no lab values, no genetic data or DNA, no polygenic scores, no cycle or reproductive data, and no wellness observations or results of any kind — only proof that a consent action occurred. They are linked to your account (not anonymous), and we use them solely as legal and regulatory compliance evidence, never for advertising, profiling, marketing, or any other purpose. This is a distinct record from the hosting logs in Section 4.8 and the Premium AI inputs in Section 4.9: it links your device, IP address, and the time of a consent action to your account, but contains no health data. The legal bases are in Section 5.1, the retention rule is in Section 13, and — because the genome-entry and sensitive-results consent records concern health features — they are also addressed as consumer health data in Section 15.

5. How we use your information and legal bases

We use personal information only to deliver the Service you asked for and for closely related operational purposes:

• Authenticate you, run the application, and synchronize data between the connected services you authorize.
• Generate the observations, trend summaries, pattern descriptions, polygenic scores, and educational references the Service produces. These are informational context for conversations with your licensed clinician. Where an AI answer discusses possible explanations, medications, or typical doses, it is information to confirm with your doctor, not a diagnosis or prescription from a licensed professional.
• Provide premium features, including premium chat and the Premium AI Analysis, when you use them (Section 6), and personalize answers with Memory unless you turn it off (Section 6A).
• Sync your data, encrypted, between your own devices and keep your encrypted backup (Section 6B).
• Respond to your support and privacy requests.
• Maintain the security and integrity of the Service, prevent fraud and abuse, and comply with legal obligations.
• Record and keep proof that you gave consent when you accept our terms or turn on a sensitive feature, so that we can demonstrate the consent was obtained (Section 4.13).
• Conduct internal product analytics on aggregated and de-identified usage data (for example, how many users connected a wearable in a week). We do not use your health data for product analytics. For de-identified data, we maintain the technical safeguards and contractual prohibitions on re-identification that the CCPA requires, and we do not attempt to re-identify it.

We do not use your information for advertising, profiling for marketing, automated decision-making with legal or similarly significant effects, credit scoring, insurance underwriting, or employment decisions.

5.1 Legal bases (GDPR / UK GDPR)

To the extent the GDPR or UK GDPR applies, we rely on the following legal bases:

Where we rely on consent (including explicit consent for special-category data), you may withdraw it at any time without affecting the lawfulness of processing already carried out (Section 14). Withdrawing consent for special-category processing may make parts of the Service unavailable.

6. Our privacy architecture (on-device and pseudonymized cloud)

The Service is built local-first: your sensitive health data lives on your devices. When it leaves a device to sync or back up, it is encrypted first (Section 6B); our servers do not hold it in readable form.

• Two-tier on-device model. Raw personal health information (full lab values, raw genetic files, medical records, cycle entries, wearable detail) is held in an encrypted on-device store (Tier 1), encrypted at the column level with AES-256-GCM; the key is derived from your passphrase using Argon2id and managed through a key-encrypting-key / data-encrypting-key split. A separate on-device store (Tier 2) holds a pseudonymized copy from which direct identifiers (such as name, date of birth, and contact details) have been removed. Synchronization is one-way (Tier 1 → Tier 2); there is no reverse path.
• Pseudonymized, not anonymized. We describe the Tier 2 / outbound data as pseudonymized. Although direct identifiers are removed, combinations of remaining values could in principle be re-identifiable, so we continue to treat that data as personal data with full safeguards. We do not claim it is anonymous.
• What leaves your device. Apart from encrypted sync and backup (Section 6B), sensitive raw data does not leave your device in directly identifying form (apart from photos you choose to attach to a question, Section 4.10), and health data is sent for processing only when you use a premium feature. The text and values we send pass a deterministic outbound privacy filter and an additional safety check, which strip direct identifiers, before they leave.
• Your genetic file never leaves your device. This is absolute: the genotype file you import is read, processed, and stored only on your own device, and the file itself is never transmitted to us or to anyone else. What can be sent, and only when you run a premium analysis, are results derived from it — a trait or marker name together with a plain-word band such as "above average" or "typical". Your genotype, the individual variants you carry, and any identifier for them are never included. That derived output is pseudonymized, not anonymous: it is sent on a request you make from your account, so we continue to treat it as your personal data with full safeguards. On Mac, if you have premium, the app also sends per-score calibration figures to our servers so a score can be placed against a reference population; Section 9 describes exactly what they contain.
• Consent-evidence attestations. Separately from the automated data flows above, when you take a consent action the application sends a small device-signed attestation to our server so we can keep proof that consent was obtained (Section 4.13). This attestation carries only consent metadata — the time, the version and a hash of the text you agreed to, a per-install device identifier, and your IP address — and never any health, genetic, or result data.
• What our servers keep from a premium request. Our servers hold the context of a premium conversation in memory for up to twelve (12) hours so a follow-up question can continue it; this is not written to disk. During the beta, when beta quality review is switched on, we keep an encrypted, re-pseudonymized copy of premium turns (your question, the context sent, and the answer) for up to ninety (90) days to find and fix errors, and then delete it automatically. Turns that include cycle data are never kept for review. Beta review relies on the same basis as premium processing (your acceptance of our terms or your premium consent); withdrawing your premium consent deletes your kept turns, and deleting your account deletes them too.
• Transport security. Outbound network calls are made over TLS 1.2 or higher.
• Support emails. If you email our support address, the contents (including any health information you choose to include) are processed by our email provider (Section 7). We recommend you not include sensitive health details in support emails unless necessary.

6A. Memory

Memory lets the app use what you have already told it, and notes from records you connected from a patient portal, to make answers more relevant to you.

• What it covers. Memory has two parts, each with its own switch: your past conversations, and the text of notes and visit summaries in records you connected from a patient portal. On iPhone the switches are in Settings › Memory ("Use memory in answers" and "Use health records in answers"); on Mac they are in Settings › Security & Privacy under "Semantic recall" ("Search your conversation memories by meaning" and "Search your clinical document text by meaning"). Health records from Apple Health are not part of Memory. The app also keeps a list of facts it has learned from your conversations ("What Further remembers"), which you can review, edit, and remove in Settings › Memory on iPhone.
• On by default. Each part is on by default only while premium is active for the account owner and you have not withdrawn your premium cloud-processing consent. Conversation memory is on by default once you have accepted our terms or the premium consent. Health-records memory is on by default once you accept Terms of Service version 7 (the version that describes it) or, on iPhone, the current premium consent. If you have never made a choice, no setting is stored; the default applies until you choose. Your on or off choice syncs to your other devices, and the most recent choice applies on all of them. While premium is not active, Memory is off even if you turned it on.
• Managed family profiles are excluded. Memory is never used for a family member's profile that you manage (on Mac).
• How it works. To find relevant passages, the app builds an encrypted search index on the device from your conversations and from the record text described above. The index is kept only on that device: it never syncs to your other devices and is never included in a backup or export. Your genetic data is never indexed.
• What is sent. When you use a premium feature (chat or analysis, on iPhone or Mac), the app may include up to eight short excerpts (each up to 800 characters) found through Memory with each search it runs for the request. Before an excerpt leaves your device, raw genetic content is removed and it passes our deterministic privacy filters, which strip direct identifiers such as contact details and record numbers; our server screens the request again before it reaches our AI provider. These excerpts are pseudonymized, not anonymous: they may still contain health details, so we treat them as your personal data. A name you type in your own words may not always be recognized and removed.
• Recent conversation history. Separately from the Memory switches, and even when they are off, a premium chat can include excerpts of your recent saved conversations (up to 24 excerpts of up to 800 characters each, drawn from your most recent messages; messages where personal identifiers are detected are skipped), and our AI service can search your saved chat history for the same purpose, so answers stay consistent. This uses only conversations that are still saved. To stop it, set chat history to "Don't save new chats" (which also stops older saved chats being used), delete chats, or use "Forget" in Settings › Memory, which excludes everything you said before it.
• Turning it off. You can turn either part off at any time. Turning a part off stops it being used in answers and deletes that part's on-device search index straight away, on this device and, when the choice syncs, on your other devices. It does not delete your conversations, the facts list, or your records; you can delete those separately (on iPhone, Settings › Memory › "Forget everything from our conversations" removes what was learned from conversations, and chat history settings remove conversations). Turning memory back on rebuilds the index from scratch.
• How long it is kept. The on-device index is kept until you turn that part of Memory off, use Forget, or delete the app's data; it is not used while premium is inactive. Your conversations are kept for the period you choose in chat history settings (forever by default, or automatically deleted after 30 days, 90 days, or one year, or not saved at all). Deleting a chat, by hand or automatically, removes its messages but not the facts already learned from it or their index entries; remove those with Forget in Settings › Memory. Our servers do not keep a memory store; excerpts sent with a request are handled as described in Section 6 ("What our servers keep from a premium request").

6B. Sync and backup between your devices

• Sync. Your health data syncs between your own signed-in devices. Each device encrypts the data before it is uploaded, using keys derived from a random secret created on your device. That secret is kept in your device keychain and reaches your other devices either through iCloud Keychain (older accounts) or wrapped under a key derived on your device from your account password; our server stores only that wrapped (encrypted) form, so its protection depends on the strength of your password. Our servers and our storage provider store only encrypted data under keyed, opaque names.
• Where it is stored. By default, encrypted sync and backup data is stored in your own iCloud Drive. If iCloud Drive is not available, or you choose it (on Mac, "Switch to Further Health cloud"), it is stored in Further Health cloud storage, which runs on Cloudflare R2. Health records from Apple Health are never stored in iCloud (Section 4.5A). Other data you allow the app to read from Apple Health (such as activity, heart rate, sleep, and workouts) is included, encrypted, in whichever storage you use, including iCloud (Section 8.3).
• What is not synced or backed up. Your raw genetic file never syncs and is never included in an iCloud or Further Health cloud backup; on Mac it is included only in an encrypted backup file you choose to export yourself. The Memory search index never syncs and is never backed up or exported.
• Deletion. When your account is deleted, we delete all of your encrypted data in Further Health cloud storage, including uploads that arrive just after deletion begins, before we delete your account records. When newer copies of your data are stored, earlier encrypted copies are removed automatically after the new copy is saved. We cannot delete data in your own iCloud; if you switch from iCloud to Further Health cloud storage, your existing encrypted iCloud copy stays in your iCloud until you delete it, and you can delete it in your iCloud settings.
• Account recovery. We do not hold a usable copy of your encryption keys. Recovery uses factors you set up on your devices (such as your passphrase and recovery code). If you lose all of them, you may lose access to your encrypted data.
• Export. You can export your data at any time from Settings, as an encrypted file or a readable CSV file.

7. How we share information and sub-processors

We never sell your personal information. We do not share your information with third parties for their own marketing, advertising, profiling, or data-broker purposes, and we never share your data with insurers or employers. We do not "share" personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.

We share limited information only with:

• Service sub-processors and providers that operate the Service under contract (see the directory below).
• The connected services you authorize. When you authorize a service such as WHOOP or Oura, we exchange authentication tokens to receive the data you asked us to receive.
• Legal and safety recipients when required by law (for example, a valid subpoena), when necessary to investigate fraud or protect the rights, property, or safety of any person, or in connection with a business transfer (in which case the successor will be bound by this policy or one at least as protective). For reproductive and sexual-health data, see the heightened protections in Section 10.

When we use sub-processors, we do so under written contracts that require confidentiality, security, and use only for the purposes we instruct. We will publish or notify any change to our sub-processor list at least thirty (30) days before it takes effect, and we will identify the then-current payment processor at the point of purchase. A current list is available on request from privacy@further.health.

7.1 Sub-processor directory

If we ship through another distribution platform, that platform operator may process your account/billing relationship under its own terms; we will update this directory accordingly.

8. Wearable and connected services

Each connection is governed by the third party's own terms and privacy policy as well as this policy.

8.1 WHOOP

When you connect WHOOP, we exchange tokens under WHOOP's API Terms of Use and use WHOOP data only to power wellness features for you. We do not market, sell, license, or lease WHOOP data, and we do not expose it to any third party except as described in Section 7. Our connection service does not store WHOOP readings; it stores WHOOP's change notifications, encrypted, and deletes them after thirty (30) days, or immediately when your account is deleted. To revoke access, visit your WHOOP account at whoop.com.

8.2 Oura

When you connect Oura, we exchange tokens under the Oura Cloud API Agreement. Oura may collect use data related to your use of the Oura API and platform, including data collected through your authorization of the connection, and may use such usage data for its business purposes. We use Oura data only to power wellness features for you; we do not use Oura data in advertisements; we do not directly or indirectly disclose, market, sell, license, or lease Oura data to any third party (including advertisers and data brokers); and we comply with Oura's Brand Guidelines. Our connection service does not store Oura readings; Oura data is stored on your devices. Oura-derived information sent with a premium request is handled like other premium request content (Section 6): held in server memory for up to twelve (12) hours and, during the beta when beta quality review is on, kept encrypted for up to ninety (90) days. With respect to data flowing between Further Health and Oura, each party acts as an independent data controller within the meaning of Article 26 of the GDPR. To revoke access, visit cloud.ouraring.com.

8.3 Apple Health / HealthKit

When you grant the iOS app access to specific HealthKit data types, including health records you choose to share from the Health app (Section 4.5A), the Service reads those types on your iPhone and stores them encrypted in your Further Health data. Health records from Apple Health are never stored in iCloud and sync only through Further Health cloud storage. Other HealthKit data (such as activity, heart rate, sleep, and workouts) syncs and is backed up, encrypted, through the storage you use (Section 6B); if that storage is iCloud, this encrypted data is stored in your own iCloud Drive. We never sell HealthKit data, never use it for advertising or other use-based data mining, never share it with third parties for advertising, and never disclose it to a third party without your explicit permission. You can remove imported Apple Health records in the app, and revoke any HealthKit permission at any time in the Health app or iOS Settings.

8.4 Laboratory and clinical-record providers

When you connect a laboratory or health-record provider, we use a one-time credential or OAuth token to fetch the records you choose. Records are stored on your device and sync, encrypted, between your devices (Section 6B). If the provider later marks a record as entered in error or ruled out, the app deletes its copy, including on your other synced devices. A record the provider simply stops sending is kept until you delete it or disconnect that provider. You can disconnect any provider at any time, and choose to delete the data imported from it.

8.5 Calendar providers

The calendar connection is read-only and limited to the start time, end time, title, and any keywords you specify. We do not read attachments, attendees, or meeting links. You can revoke calendar access at any time.

9. Genetic information (GINA)

We treat genetic information with extra care because it can never be re-issued.

• Your raw genetic data file is parsed locally on your device and is never transmitted to our servers or to any third party. This is the strongest guarantee in this Policy and it has no exceptions: the file itself, the individual variants you carry, and any identifier for them never leave your device.
• What can leave your device is the result, not the data. When — and only when — you run a premium analysis, we send a derived observation: a trait or marker name together with a plain-word band such as "above average", "typical", or "present". Your genotype is never included, and in a premium analysis we do not send a risk score, a percentile, or any magnitude — the band word is the whole result. A small technical quality figure travels with it (how many of the positions a score needs were readable in your file) so the analysis can be honest about its own confidence; it reveals nothing about which variants you carry. This derived output is pseudonymized, not anonymous: you request it from your account and the answer comes back to you, so we continue to treat it as your personal data with the full safeguards in this Policy. The genetic file itself is never transmitted in any circumstance; these derived results are sent only when you ask for a premium analysis.
• Score calibration on Mac. On Mac, if you have premium and have not withdrawn your premium cloud-processing consent, the app sends calibration figures to our servers automatically when it computes your polygenic scores for your own profile (never a managed family member's), so each score can be compared with a reference population. For each eligible score (built from at least 1,000 variants, up to 32 scores per request) it sends: the score's catalog identifier; the score's raw weighted sum; how many variants were used, in total and unsupported; the versions of the analysis pipeline and reference panel; and your nearest reference ancestry group (a broad continental group code) with its calibration quality. No genotypes, variants, positions, or file names are sent, and scores for Alzheimer's disease (APOE), the opt-in cancer scores, and behavioral or psychiatric traits are never sent. Our server returns a coarse result for each score and does not store the figures it receives; it keeps only a record that a request was made, its status, and (if our abuse protection is switched on) a keyed fingerprint per score per day, all deleted when your account is deleted. Withdrawing your premium consent stops this.
• The consent-evidence record we keep when you accept the genome-entry agreement or turn on sensitive results (Section 4.13) contains no genetic data — no variants, genotypes, or polygenic scores — only proof that you consented.
• We never use, sell, transfer, or disclose genetic data to health insurers, life insurers, employers, employment screeners, or anyone making credit, lending, or housing decisions, consistent with the U.S. Genetic Information Nondiscrimination Act (GINA, Pub. L. 110-233) and analogous state and international laws.
• We do not include genetic information in any advertising, analytics, or research dataset.
• Polygenic scores and genetic observations are probabilistic, research-grade, educational wellness information — not a clinical genetic test, not a diagnosis, and not medical advice. They are calibrated to ancestry groups and may be less accurate for some ancestries, and should be confirmed clinically. See the Wellness Disclaimer.
• You can delete your genetic data and the derived findings from inside the Service at any time. On the Mac where you imported it, deleting your genome removes the raw file and its results. On iPhone, Settings › Backup & data › "Remove genetic data" removes your genetic results from that iPhone and from your other synced devices; your raw genetic file is only on the Mac where you imported it. Encrypted cloud backups are updated the next time a backup runs.

10. Reproductive and sexual-health information

We treat reproductive and sexual-health information with heightened sensitivity in light of the post-Dobbs legal landscape, the Washington My Health My Data Act, Nevada SB 370, and similar laws.

• The Service's cycle-tracking and related reproductive features are strictly opt-in (eligible adults only). You can disable them at any time; on disabling, we delete the data on the accelerated schedule in Section 13.
• Reproductive and sexual-health data is processed and stored on your device, encrypted at rest, and is never shared with advertisers, data brokers, insurers, or employers.
• We do not respond to law-enforcement or other third-party requests for reproductive or sexual-health data without lawful process, and we will challenge requests that are facially invalid or that we believe are inconsistent with applicable law. Where law allows, we will notify you of a request before complying so you have an opportunity to object.
• The Service does not infer pregnancy, fertility status, ovulation for contraceptive purposes, or any clinical condition from cycle data. Cycle features are wellness pattern observation only — not contraceptive, not a fertility/TTC tool, not diagnostic, and not an aid in detection.

11. International data transfers

The Service is intended for users in the United States and is not directed to individuals located in the European Economic Area or the United Kingdom; we do not knowingly target them.

The Service is operated from the United States. If you nonetheless access the Service from the EEA, the United Kingdom, Switzerland, or another jurisdiction with data-transfer rules, the limited data we process on our cloud sub-processors may be transferred to and processed in the United States. We rely on the European Commission's Standard Contractual Clauses (SCCs), including (where applicable) Module 2 (Controller to Processor) and Module 3 (Processor to Processor), on equivalent UK and Swiss addenda, and on supplementary technical measures — including encryption in transit and at rest, column-level on-device encryption for health data, pseudonymization, and a deterministic outbound privacy filter — to provide appropriate safeguards. The applicable module is identified in our agreement with each sub-processor. You may request a copy of the relevant transfer mechanism from privacy@further.health.

12. Data security

Security is the foundation of the Service rather than an afterthought.

• Sensitive on-device health data is encrypted column-by-column with AES-256-GCM. The key is derived from your passphrase using Argon2id and split into a key-encrypting key (KEK) and per-record data-encrypting keys (DEKs), so changing your passphrase re-wraps the KEK rather than re-encrypting every record.
• Sensitive raw data — full lab values, medical records, health records from Apple Health — leaves your device only encrypted, for sync and backup (Section 6B). Your raw genetic file is not transmitted (Section 9). Only a pseudonymized subset, after passing a deterministic outbound privacy filter and an additional safety check, is sent to our cloud AI sub-processor, together with any photos you attach to a question (Section 4.10).
• Outbound network calls are made over TLS 1.2 or higher.
• We implement organizational and technical measures consistent with Article 32 of the GDPR (Section 12.1).

No security program is perfect. If you discover a vulnerability, please write to privacy@further.health and we will respond promptly.

12.1 Technical and organizational measures (Article 32 GDPR)

• Pseudonymization and encryption. Column-level AES-256-GCM for sensitive on-device data; Argon2id passphrase-derived key wrapped via a KEK/DEK split; deterministic pseudonymization on outbound calls; TLS 1.2+ for all transport; encryption of backups and exports at rest.
• Confidentiality. Least-privilege engineering access; confidentiality obligations for all contractors and employees and in every sub-processor agreement; multi-factor authentication on administrative consoles; just-in-time privileged access for production systems.
• Integrity. Versioned source control with mandatory review and automated security checks before merge; cryptographic integrity (GCM authentication) tags on every encrypted column to detect tampering; deterministic re-execution of the outbound privacy filter on every call.
• Availability and resilience. Redundant hosting; automated failover for critical surfaces; encrypted database snapshots retained for a rolling window; documented disaster-recovery procedures.
• Restoration after incident. Tested backup-restoration procedures; documented incident-response runbooks; root-cause and remediation reports for every incident.
• Testing and evaluation. Continuous static-analysis and dependency-vulnerability scanning; periodic penetration testing; periodic review of these measures; a vulnerability-disclosure channel.
• Data minimization and purpose limitation. We collect only the categories in Section 4 and use them only for the purposes in Section 5; we do not repurpose personal information without a new lawful basis.
• Sub-processor due diligence. Each sub-processor undergoes a written security and privacy review before onboarding and is monitored for compliance.
• Personnel and training. All personnel with access to personal data complete privacy- and security-awareness training at least annually.
• Logging and monitoring. Audit logs of administrative actions; alerting on anomalous access; logs retained only as long as needed for security and audit.

13. Data retention and deletion

We keep personal information only as long as needed for the purposes in Section 5, plus a short period for legal, security, audit, or accounting purposes.

You can request deletion of any data we hold by writing to privacy@further.health. We will complete verified deletion within thirty (30) days under the Washington My Health My Data Act, within forty-five (45) days under the CCPA/CPRA, and within thirty (30) days under the GDPR/UK GDPR (extendable by two months for complex requests, with notice).

14. Your privacy rights

Subject to the law that applies to you and to identity verification, you have rights to:

• Access the personal information we hold about you (GDPR Art. 15; CCPA § 1798.110).
• Correct inaccurate personal information (GDPR Art. 16; CPRA right to correct).
• Delete personal information (GDPR Art. 17; CCPA § 1798.105; MHMDA RCW 19.373.030; analogous state laws).
• Restrict certain processing or object to processing based on legitimate interests (GDPR Art. 18, 21).
• Data portability — receive a copy in a machine-readable format (GDPR Art. 20; CCPA right to know).
• Withdraw consent at any time, without affecting the lawfulness of prior processing (GDPR Art. 7(3)).
• Opt out of sale or sharing of personal information (CCPA/CPRA § 1798.120). We do not sell or share personal information for cross-context behavioral advertising; this right is preserved by default.
• Limit use of sensitive personal information (CPRA § 1798.121).
• Non-discrimination for exercising any of these rights.
• Appeal a denial (under state laws that provide an appeal right; see Sections 15–16).
• Lodge a complaint with a supervisory authority — your local data-protection authority in the EEA, the UK Information Commissioner's Office, or your state attorney general in the US.

To exercise any right, write to privacy@further.health. We may need to verify your identity. You may use an authorized agent under the CCPA/CPRA; we may require written proof of authorization. We do not charge a fee for verified rights requests. We honor verifiable opt-out signals such as Global Privacy Control (GPC) where applicable.

One limited qualification applies to the consent-evidence records in Section 4.13. Because those records are our proof that your consent was obtained, where the law permits us to keep proof of consent to comply with a legal obligation or to establish, exercise, or defend legal claims (for example, GDPR Article 17(3)(b) and 17(3)(e)), we may retain the minimum necessary rather than fully erase them in response to a deletion request. We honor Washington consumer-health-data deletion rights over the health-feature consent records listed in Section 15.1 as described in Section 15.

Residents of California: in the twelve (12) months preceding this policy, we collected the categories in Section 4 for the purposes in Section 5; we did not sell or share personal information for cross-context behavioral advertising; and we did not knowingly sell or share personal information of consumers under sixteen (16). The Service is offered only to adults aged eighteen (18) or older.

14.1 State-by-state rights summary

Where the law of your residence imposes additional or stronger requirements, we honor those as well.

15. Washington consumer-health-data policy (MHMDA)

This section satisfies our obligation to publish a separate consumer-health-data privacy policy under RCW 19.373.020 of the Washington My Health My Data Act (MHMDA) and applies in addition to the rest of this Privacy Policy. This section, together with the rest of this Policy, is our MHMDA Consumer Health Data Privacy Policy.

15.1 Categories of consumer health data we collect

• Biometric and physiological data, including heart rate, HRV, sleep stages, recovery, strain, respiratory rate, blood-oxygen estimates, and body temperature (from wearables).
• Diagnoses, conditions, medications, immunizations, and other clinical information you import from medical records.
• Laboratory results and reference ranges.
• Genetic data and findings derived from genetic data.
• Reproductive and sexual-health data, including menstrual-cycle information when you enable cycle tracking.
• Mental-health and wellness self-reports.
• Health records you choose to share from Apple Health (Section 4.5A).
• Memory: facts learned from your conversations and excerpts of your conversations and records used to personalize answers (Section 6A).
• Health-related inferences and observations the Service generates from the above.
• Consent and authorization records relating to health features — specifically, proof that you accepted the genome-entry agreement, turned on "Show sensitive results", or agreed to premium cloud processing of your health data before activating premium (Section 4.13). These are proof-of-consent metadata only (time, version, a hash of the text you saw, device identifier, and IP address); they contain no health values, genetic data, or results.

15.2 Sources

We collect consumer health data from you directly, from the third-party services you authorize (Section 8), and from the documents and files you upload.

15.3 How and why we collect and use consumer health data

We collect and use consumer health data only to provide the wellness and educational features you request, as described in Section 5, and we obtain your consent for the collection and (where applicable) sharing of consumer health data separately from other terms.

15.4 Categories of consumer health data shared, and recipients

We share consumer health data only with the sub-processors listed in Section 7, only as necessary to operate the Service for you: in encrypted form for sync and backup storage, and only after pseudonymization for cloud-AI calls. We do not sell consumer health data, and we do not share it for advertising or profiling. We do not collect or use a "geofence" around any facility that provides in-person health-care services.

15.5 Affiliates with whom data is shared

None at present.

15.6 Your MHMDA rights

• Right to confirm whether we collect, share, or sell your consumer health data, and to access it.
• Right to withdraw consent to the collection and sharing of your consumer health data.
• Right to have your consumer health data deleted, including (where technically feasible and lawful) to direct us to ask our sub-processors and affiliates to delete it.
• Right to non-discrimination for exercising any of these rights.
• Right to appeal a denial. We will respond to an appeal in writing within forty-five (45) days, explaining the decision. If your appeal is denied, you may submit a complaint to the Washington State Office of the Attorney General using the consumer-complaint form at atg.wa.gov/file-complaint, or by writing to: Office of the Attorney General, Consumer Protection Division, 800 Fifth Avenue, Suite 2000, Seattle, WA 98104.

If you ask us to delete or withdraw consent for the health-feature consent-evidence records listed in Section 15.1 and described in Section 4.13, we will honor that request to the extent the My Health My Data Act requires. Because those records are our proof that consent was obtained, where a law separately requires us to keep proof of consent we may retain only the minimum necessary and will delete or de-identify the rest; withdrawing consent also stops the corresponding feature from creating new consent records.

15.7 How to exercise these rights

Email privacy@further.health with the subject line "Washington consumer health data" and tell us which right you wish to exercise. We will respond within thirty (30) days (extendable by fifteen (15) days when reasonably necessary, with notice).

16. Nevada and other consumer-health-data laws

For residents of Nevada, this section addresses Nevada SB 370 (NRS Chapter 603A, consumer health data). We do not sell your consumer health data, and we will honor a verified request to opt out of any sale and to confirm our collection of your consumer health data. We do not use a geofence around an in-person health-care facility to identify or track consumers or to send health-related advertising. To exercise a Nevada right, email privacy@further.health with the subject line "Nevada consumer health data." We honor comparable consumer-health-data protections in other states (such as Connecticut's consumer-health-data amendments) as described in Sections 14–15.

17. Biometric information

Several U.S. state laws regulate biometric information separately, including the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/1 et seq.), the Texas Capture or Use of Biometric Identifier Act (CUBI, Tex. Bus. & Com. Code § 503.001), and Washington's biometric statute (RCW 19.375).

• We do not collect, use, store, or disclose any biometric identifier (such as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry) for identification of individuals, and we do not generate any such identifier from photographs or voice recordings.
• Wearable physiological data (heart rate, HRV, sleep, respiratory rate, blood-oxygen estimates, temperature) and laboratory analyte values are used solely for the wellness purposes in Section 5. We do not use them to identify or authenticate any person.
• Genetic data is treated separately under Section 9 (GINA) and is never used for identification.
• Where state law requires written consent before collecting a regulated biometric identifier, we obtain it at the point of collection; where no regulated identifier is collected, we still apply the Section 12 safeguards to all physiological data.

18. HIPAA status

Further Health is not a HIPAA Covered Entity, and we do not act as a Business Associate of any Covered Entity in our consumer service. The information you provide is generally not regulated as "protected health information" under HIPAA. That HIPAA does not apply does not mean your information is unprotected — it is protected by this Policy, by the Section 12 security measures, and by other laws (the FTC Act, the Washington My Health My Data Act, the GDPR, and others). If we ever offer the Service under a Business Associate Agreement to a provider or organization, we will do so under a separate written agreement.

19. Health Breach Notification Rule

The Service holds personal-health-record-related information. If we discover a breach of unsecured individually identifiable health information, we will notify affected individuals without unreasonable delay and no later than sixty (60) calendar days after discovery. For breaches affecting 500 or more individuals, we will notify the U.S. Federal Trade Commission and prominent media within the same period; for breaches affecting fewer than 500 individuals, we will notify the FTC as the Rule requires — in each case in accordance with the FTC Health Breach Notification Rule (16 C.F.R. Part 318) and any other applicable law, subject to any law-enforcement delay request. We will also comply with applicable state breach-notification laws.

20. Children

The Service is intended for adults aged eighteen (18) or older. We do not knowingly collect or process personal information from anyone under 18. We comply with the U.S. Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501-6506), the GDPR's Article 8 provisions, and analogous laws. If you believe a minor has provided us with personal information, write to privacy@further.health and we will delete it promptly and confirm in writing.

21. Cookies and similar technologies

The Site does not run advertising or analytics cookies. The Site uses your browser's local storage only to remember your theme preference (light or dark mode). The Service uses session tokens that are strictly necessary to keep you signed in and that we do not use for tracking. We do not implement cross-context behavioral advertising.

Our hosting provider writes standard server access logs as described in Section 4.8. These are not cookies and are used only for the limited operational purposes in that section. We do not sell or share personal information for cross-context behavioral advertising, so the Service has no such opt-out to interpret; we nonetheless honor any verifiable opt-out request received through Global Privacy Control (GPC), the "Do Not Track" (DNT) header, or by direct email.

22. Automated processing and AI

The Service uses statistical, algorithmic, and machine-learning techniques, including (for Premium AI Analysis) a large language model, to organize your data and surface patterns. Further Health does not use these outputs to make automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22(1) of the GDPR (such as decisions about employment, insurance, or credit). Outputs are presented to you for your own use in conversations with your licensed clinician, who remains the decision-maker for any clinical action. Where outputs are AI-generated, they are identified as such. AI outputs may be incomplete or contain errors; where they discuss possible conditions, medications, or typical doses, they are information to confirm with your clinician, not a diagnosis or prescription from a licensed professional. See the Wellness Disclaimer. The Service is not a substitute for a licensed clinician.

23. Changes to this Policy

What changed in this version (October 15, 2026): Memory and recent conversation history (Section 6A); health records from Apple Health, including how records that disappear from Apple Health are deleted (Section 4.5A); encrypted sync and backup, where it is stored (including Apple Health activity data in iCloud), and Cloudflare, Neon, Upstash, and Resend in our sub-processor list (Sections 6B, 7.1, and 8.3); switching wearable accounts and how our connection service stores wearable credentials (Sections 4.2 and 13); what our servers keep from a premium request (Section 6); photos attached to a question note and clinical-note excerpts sent with premium requests (Sections 4.9 and 4.10); score calibration on Mac (Section 9); removing genetic data on iPhone (Section 9); feedback reports and license-activation details (Section 4.8); consent-record retention (Section 13); and removal of the retired meal and nutrition-label photo feature. Because these changes affect how health data is used, we ask you to accept this version before you continue.

We may update this Privacy Policy from time to time. The "Effective date" at the top reflects the most recent change. Material changes will be communicated through the Service or by email at least thirty (30) days before they take effect, and where required by law (or where the change materially affects special-category processing or your consent) we will obtain your renewed consent. Your continued use of the Service after a non-material change constitutes acceptance of the updated policy.

24. Contact

For privacy questions, data-rights requests, or to report a security concern:

• Privacy / data rights: privacy@further.health
• Support: support@further.health
• Operating entity: Further Health LLC

See the companion Terms of Service and Wellness Disclaimer.