Privacy Policy

Our Commitment to Your Privacy

Ethia handles sensitive health information. We take this responsibility seriously. This Privacy Policy explains what data we collect, how we protect it, and how we use it to serve you.

This policy is updated when our data collection or processing practices change. The date of the last update is at the top of this page.

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address (we never ask for your name)
• Password (stored encrypted, never in plain text)
• Primary autoimmune condition(s)

Health Information

To provide our services, we collect health information you choose to share:

• Lab results you upload (PDFs, images, or manual entry)
• Questionnaire responses about your symptoms, treatments, and health history
• Information about medications and biologics you've tried
• Your health goals and concerns

Usage Information

We automatically collect:

• How you interact with our platform (pages visited, features used)
• Device information (browser type, operating system)
• IP address and general location (city/region level)

Signing In With Apple or Google

If you create an account or sign in with Apple or Google, we receive your email address and an account identifier from Apple or Google. Ethia asks Apple for your email address only, never your name. We use what we receive to create your Ethia account and sign you in, and your email address is stored encrypted in our identity vault. Ethia never receives your Apple or Google password, and nothing is posted to your Apple or Google account.

Google Calendar (Optional)

If you choose to connect Google Calendar, Ethia asks for read-only access to your calendar events and for the email address of that Google account. With that access we:

• Look at events from the past 30 days and the next 90 days to find ones that look like medical appointments. This sorting uses simple rules on the event title and location. Your calendar is never sent to our AI services.
• Show you the likely appointments. Only the ones you confirm are saved to Ethia, as a visit with its title, location and date. Everything else is discarded, and events you decline are remembered only so we do not ask about them again.
• Store the access Google gives us in encrypted form. We never add, change or delete anything in your calendar.

You can disconnect Google Calendar at any time from your Visits page, which deletes the access we hold. You can also remove Ethia's access from your Google Account permissions page. Deleting your Ethia account removes the calendar connection and the visits created from it.

How We Use Information From Google

Information we receive from Google is used only to provide the features described above. We do not sell it, use it for advertising, share it except as needed to run these features, or use it to develop or train AI models. Ethia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How We Protect Your Data

Our security measures include:

• Encrypted identity vault: Your email address is encrypted at rest with AES-256 in a dedicated vault, separate from your health data
• Pseudonymized health data: Your health information is linked to an anonymous patient token, so it cannot be tied back to you without the separately-secured vault
• Encryption in transit: All data transmitted to and from Ethia uses TLS 1.2+
• Access logging: Access to identifying data is logged for audit purposes
• Regular security reviews: We regularly assess and improve our security practices

3. How We Use Your Information

To Provide Our Services

• Analyze your lab results using AI to provide educational insights
• Track your health markers over time and identify trends
• Personalize content and recommendations to your condition
• Show you news and recruiting studies shared by your patient organization (interest is always opt-in; your records are never shared with researchers)

To Improve Ethia

• Analyze usage patterns to improve our platform
• Fix bugs and technical issues

We do not use your health data to train AI models, including in de-identified form.

To Communicate With You

• Send important account notifications
• Alert you to new research opportunities that match your profile
• Respond to your questions and support requests

4. How We Share Your Information

Research Opportunities (You Are Always in Control)

We do not sell or share your identifying information or your health records with pharmaceutical companies or research organizations.

If a patient advocacy organization you are connected with shares a research opportunity that may fit your profile, you will see it inside the app. Your information is shared only if you choose to express interest in that specific opportunity, and only then.

Any aggregate insights we provide to a patient organization are de-identified, cannot be traced to an individual, and are shared only with your explicit consent.

Service Providers

We work with trusted service providers who help us operate Ethia:

• Cloud hosting: Our infrastructure is hosted on secure, HIPAA-eligible cloud platforms
• AI processing: Claude, an AI model made by Anthropic, run inside Amazon Web Services (Amazon Bedrock), and Amazon Transcribe for voice check-ins. See "How Ethia Uses AI" below.
• Email services: To send you account notifications

All service providers are contractually bound to protect your data and use it only for the services they provide to us.

How Ethia Uses AI

Ethia's answers, lab readings, document readings and summaries are written by Claude, an AI model made by Anthropic, which runs inside Amazon Web Services through Amazon Bedrock. Voice check-ins are turned into text by Amazon Transcribe. Before any of your health data is sent, Ethia asks for your permission, in the app and on the website.

• What is sent: what you type or say to Ethia, and the parts of your health record needed to answer you: conditions, lab results, medications, check-ins and symptoms, appointments and visit notes, and documents and photos you add so they can be read.
• What is not sent: your email address, your password and your name.
• Who receives it: Amazon Web Services, under our HIPAA Business Associate Agreement, which requires Amazon to protect your health data to the same standard we do. The model runs inside Amazon, so Anthropic does not receive your data. Amazon does not store it after answering and does not use it to train AI.
• Why: only to answer you and read your records for you. It is never used for advertising and never sold.

If you do not give permission, Ethia cannot read your record or answer you. You can delete your account and your data at any time; here is how.

Legal Requirements

We may disclose your information if required by law, such as in response to a valid court order or subpoena. We will notify you if legally permitted to do so.

5. Your Rights and Choices

Access Your Data

You can view all the health data you've uploaded and your profile information through your dashboard at any time.

Download Your Data

You can download your whole record at any time from Privacy & data, as a readable file or as data (JSON). For anything else we hold about you, contact us at george@ethia.io.

Delete Your Data

You can delete your account at any time, in the app, on the website or by email. Here is how. Upon deletion:

• Your personal information will be permanently removed from our identity vault
• Your health data and lab results will be deleted
• Your anonymous token will be deactivated
• Deletion is typically completed within 30 days

Note: We may retain certain anonymized, aggregated data that cannot be linked back to you for research and improvement purposes.

Communication Preferences

You can opt out of non-essential emails at any time. Essential account notifications (security alerts, terms changes) cannot be opted out of while you have an active account.

Research and PathwayBio

Ethia does not sell your information and does not share your records with drug companies or researchers.

Ethia holds your health information for you. You can choose to move parts of it to another service. One of these is PathwayBio, a separate service from the same company, where people can choose to take part in paid research.

Connecting PathwayBio is your choice and is off unless you turn it on. If you connect it:

• You choose which kinds of information go to PathwayBio, and for how long.
• PathwayBio receives that information under an ID number. Ethia does not send your name, your birth date or anything you wrote in your own words.
• Each request on PathwayBio is yours to accept or decline. PathwayBio's own privacy notice explains what happens there.
• You can turn the connection off in Ethia at any time. Ethia then stops sending, and PathwayBio removes what it received from Ethia.

If you never connect PathwayBio, nothing about you goes there.

If your patient organization shares a research opportunity that fits your profile, you will see it in the app. Nothing is shared with anyone unless you choose to respond. You can manage research-opportunity notifications in your account settings.

6. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in to your account
• Remember your preferences
• Understand how you use our platform
• Improve our services

We do not use cookies for third-party advertising. You can disable cookies in your browser settings, but some features of Ethia may not work properly.

7. Data Retention

We retain your data for as long as you have an active account. After account deletion:

• Personal information is deleted within 30 days
• Backup copies are purged within 90 days
• Audit logs are retained for 7 years

8. Children's Privacy

Ethia is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

9. International Users

Ethia is primarily operated from the United States. If you access our services from outside the US, your data will be transferred to and processed in the United States in accordance with the protections described in this policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email and/or a prominent notice on our platform. Your continued use of Ethia after changes take effect constitutes acceptance of the updated policy.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, request deletion, and opt out of the sale of personal information.

As noted above, we do not sell personal information. To exercise your other rights, contact us at george@ethia.io.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

Email: george@ethia.io
Company: Ethia / Investigate Health Publishing LLC