Consumer health data privacy

This notice supplements our Privacy Policy (https://www.getfindings.com/privacy) for United States residents whose consumer health data may be subject to state laws — including Washington's My Health My Data Act (MHMDA), Nevada's consumer health privacy laws, Connecticut's health-data provisions, and similar statutes in other states.

Findings is personal health intelligence software. We help you organize lab results, track biomarkers, log optional daily readings, and follow a profile-based health plan informed by published screening guidance. We do not provide medical diagnosis, treatment, or emergency care.

Findings is software membership. You arrange laboratory draws at any lab worldwide; we do not sell or bundle blood tests, operate laboratories, or provide clinical services.

Depending on how you use Findings, we may collect, process, and store the following categories of consumer health data:

• Laboratory reports and biomarker values you upload (including OCR-extracted values you confirm)
• Health profile information: chronic conditions, surgeries, family history, medications, and related context
• Daily tracker readings (e.g. blood pressure, blood glucose, SpO₂, weight) and custom trackers
• AI chat messages, conversation history, and generated summaries related to your health context
• AI Health Context memories (short factual statements you add or we extract from chat)
• Optional consumer genetics files you choose to import — for educational discussion topics only, not diagnosis
• Retest reminders, notification preferences, and related wellness scheduling metadata

We do not intentionally collect government ID numbers unless you include them in an uploaded document. We do not use continuous GPS tracking.

• Directly from you — registration, profile, uploads, trackers, medications, chat, and settings
• Automatically when you use the Service — OCR, trend calculations, retest scheduling, AI context assembly
• From subprocessors under our instructions — authentication (Supabase), AI inference (Anthropic, OpenAI embeddings), subscription status (RevenueCat)
• Optional future health-platform sync (Apple Health / Google Health Connect) only for tracker types you authorize

We do not sell your consumer health data. We do not share it with third parties for their independent marketing. We do not use your health data to train general-purpose AI foundation models.

We share data with subprocessors who process it on our behalf under contract. The current list is published at https://www.getfindings.com/trust#subprocessors and in our Privacy Policy (Section 8).

Before processing special-category health data from lab uploads or optional genetics imports, we require your explicit consent in the product:

• I confirm this is my own health information (or I have permission to upload it), and I consent to Findings processing it — including sending the file to Anthropic for OCR — to extract biomarker values, as described in the Privacy Policy.
• I confirm this is my own genetic export (or I have permission to upload it), and I consent to Findings processing it to surface educational discussion topics — as described in the Privacy Policy.

• Encrypted in transit and at rest. Original files are sent to Anthropic for OCR, then removed from storage after successful extraction; unfinished uploads are purged within 6 hours. Verify extracted values before relying on trends or AI.
• Encrypted in transit and at rest. Raw files are parsed once and not kept after review. Consumer genotyping can be wrong — confirm with a clinical laboratory before medical decisions.

You may withdraw consent by deleting uploaded data, disabling features, or deleting your account. Withdrawal does not affect the lawfulness of processing before withdrawal.

We disclose consumer health data only as described in our Privacy Policy, including:

• Subprocessors listed below and in Privacy Policy Section 8
• When required by law, court order, or to protect rights, safety, and security
• In a merger or acquisition, subject to equivalent protections and notice where required

We do not sell or share consumer health data for cross-context behavioral advertising.

Depending on your state, you may have the right to:

• Confirm whether we collect, share, or sell your consumer health data (we do not sell)
• Access and obtain a copy of your consumer health data
• Delete your consumer health data
• Correct inaccurate consumer health data
• Withdraw consent for future collection or sharing where consent is the legal basis
• Receive a list of categories of third parties with whom we share consumer health data
• Appeal our denial of a rights request where required by law (e.g. Washington MHMDA)

We retain consumer health data while your account is active and as needed to provide the Service. After account deletion, data is deleted or anonymised subject to backup windows and legal retention requirements. Raw lab files are removed after successful OCR; see Privacy Policy Section 7.

Findings is generally not a HIPAA covered entity or business associate for typical direct-to-consumer use. We implement security safeguards appropriate to health data but do not represent HIPAA certification unless explicitly agreed in a B2B contract. Contact us about a Business Associate Agreement for covered-entity integrations.

The Service is for adults 18 and over. We do not knowingly collect consumer health data from children. Contact us if you believe a child has provided data.

We may update this notice. Material changes will be posted on this page with an updated date. Continued use after the effective date constitutes acceptance where permitted by law.

UNIT01 d.o.o., Vodovodska 75, 11030 Belgrade, Serbia. Data protection contact: Rade Joksimovic. Email: hello@unit01.dev.