Privacy Policy

Version 2.0.0 · Effective Date: August 9, 2026 · Last Updated: August 9, 2026

Arcvita is operated by Keledon LLC, a Delaware limited liability company ("Arcvita," "we," "us," or "our").

Our Commitment to Your Privacy

At Arcvita, we exist to help you understand and improve your health. We know that health data is among the most personal information that exists — your lab results, imaging findings, body composition, sleep patterns, heart rate, medications, and wellness goals paint an intimate picture of who you are. We take that responsibility seriously.

This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Arcvita mobile application, website (arcvita.health), and related services (collectively, the "Service").

1. Information We Collect

1.1 Information You Provide

• Account information: When you sign in with Apple, we receive your Apple ID user identifier and, if you choose to share it, your email address and name. We do not receive your Apple password.
• Lab reports and biomarkers: When you upload lab results (by photo, PDF, or manual entry), we process the test names, values, reference ranges, units, and dates. This may include blood panels, metabolic markers, hormonal data, and other clinical measurements. Uploaded lab documents may also contain identifiers printed on them (such as your name, date of birth, or a medical record number); see Section 4 for how those documents are processed.
• Body composition and imaging reports: If you upload a DEXA scan or a medical imaging report (such as an MRI, CT, ultrasound, or X-ray report), we process the measurements and reported findings contained in them. Imaging reports may include clinically significant findings described by the radiologist.
• Regimen — medications and supplements: Information you enter about medications and supplements you take, including name, dosage, schedule, whether an item is prescription or over-the-counter, and (for medications) the prescribing provider's name.
• Blood pressure: Blood pressure readings you record in the app.
• Health profile: Optional information you provide about yourself, such as health goals, known conditions, allergies, family medical history, sex, date of birth, height, weight, notes, and preferences.

1.2 Information Collected Automatically

• Health and fitness data from Apple HealthKit: With your permission, we read metrics such as sleep duration and efficiency, heart rate variability (HRV), resting heart rate, step count, active minutes, active energy, VO₂ max, and certain vitals (such as respiratory rate and blood-oxygen). We access HealthKit data solely to provide the Service. We do not use HealthKit data for advertising or marketing.
• Wearable device data: If you connect a Whoop, Oura, or other compatible device, we collect recovery scores, strain scores, sleep, HRV, resting heart rate, workout/activity data, and other metrics made available through that device's API with your authorization.
• Usage data: Basic information about how you interact with the app, such as features used, session duration, and diagnostic/crash logs. This helps us improve the Service. Diagnostic logs are designed not to contain your health content.
• Device information: Device type, operating system version, and app version, used for compatibility and troubleshooting.

1.3 Information Generated by the Service

• Arcvita Score and health insights: A composite wellness score and related health insights computed from your health metrics. Some of this computation runs on your device and some runs on our servers to enable trends, backfill, and cross-device access.
• AI coaching conversations: When you interact with the AI health coach, your messages and the AI's responses are stored to maintain conversation continuity.
• Trends and insights: We generate trends, patterns, and correlations from your health data to surface insights.

2. How We Use Your Information

Purpose	Examples
Provide the Service	Computing your Arcvita Score, generating your health insights, displaying biomarker/imaging/body-composition trends, delivering morning briefings
AI health coaching	Processing your health data and messages through our AI partner to generate personalized coaching (see Section 4)
Improve the Service	Analyzing usage patterns to fix bugs, improve features, and develop new capabilities
Communicate with you	Sending push notifications (with your permission), responding to support requests
Ensure security	Detecting and preventing fraud, abuse, or unauthorized access; maintaining audit logs

We do not use your information for:

• Advertising or marketing to third parties
• Building advertising profiles
• Training AI models on your personal health data
• Making eligibility decisions about you (insurance, employment, credit, etc.)

3. How We Store and Protect Your Information

3.1 Hybrid Architecture

Arcvita stores some of your data on your device (using Apple's SwiftData framework, protected by iOS Data Protection when your device is locked) and some in our secure cloud database to enable features like cross-device access, backup, server-side scoring, and trend analysis.

3.2 Cloud Storage

Some data is stored in our cloud database (hosted on Supabase in the United States). Cloud-stored data may include:

• Biomarker values from uploaded lab reports, and lab report metadata (date, source)
• DEXA body-composition and medical imaging report data
• Blood pressure, wearable, and HealthKit-derived metrics used for trends and scoring
• Medications and supplements (regimen)
• User profile information and your Arcvita Score and computed health insights

Cloud data is:

• Encrypted in transit using TLS
• Protected by Row-Level Security (RLS) — each user can access only their own data
• Authenticated via Sign in with Apple tokens

3.3 Encryption

We use industry-standard encryption to protect your data in transit (TLS) and apply additional encryption to certain sensitive fields. On your device, encryption keys are stored in the iOS Keychain, backed by the Secure Enclave on supported devices. Please note that some health data must be readable by our servers to compute your scores and trends; for that data, protection relies on access controls and Row-Level Security rather than end-to-end encryption.

3.4 Access Controls

• All API requests require authentication
• Service-level API keys are stored server-side and never embedded in the app
• Per-user rate limiting prevents abuse
• AI processing requests and data-deletion events are logged for security auditing

4. Artificial Intelligence and Third-Party Processing

4.1 AI Health Coaching

Arcvita's health coaching and briefing features use artificial intelligence provided by Anthropic (Claude) to analyze your health data and provide personalized insights. Before your first AI interaction, you are asked to review and consent to this data sharing.

When you use AI coaching or receive an AI-generated briefing, the following data may be sent to our AI processing infrastructure:

• Your health metrics (sleep, HRV, activity, recovery, blood pressure)
• Biomarker values, reference ranges, and flags from lab reports
• DEXA body-composition data and relevant imaging findings
• Your medications and supplements (without the prescriber's name)
• Your Arcvita Score and component breakdown
• Your coaching conversation messages

To reduce exposure of your identity, we minimize personal identifiers before sending data to the AI: we do not send your name, we send an age range rather than your exact date of birth, and we remove prescriber names.

What is NOT sent to the AI coach:

• Your name, email address, or Apple ID
• Your exact date of birth (an age range is used instead)
• Your location data or device identifiers
• Your photos or images, other than documents you submit for parsing (see 4.2)

4.2 Document Parsing (Lab Reports, DEXA, Imaging)

When you upload a lab report, DEXA scan, or imaging report for automatic reading, the document itself is transmitted to our AI provider (Anthropic) so its contents can be extracted. Because these are your original documents, they may contain identifiers printed on them (such as your name, date of birth, or a medical record number). To limit retention, we delete the uploaded document from the AI provider's systems after it has been parsed. We are also pursuing a formal data-protection agreement with our AI provider.

4.3 How AI Data Is Protected

• AI requests are routed through our secure proxy server — your device never communicates directly with the AI provider
• The AI provider's API key is stored server-side and never touches your device
• Conversation and document data are processed to provide the Service and are not used to train the AI provider's models
• Per-user rate limiting prevents abuse

4.4 AI Limitations

Arcvita's AI coaching is not a medical service. It provides wellness information and general health coaching based on your data. It does not diagnose conditions, prescribe treatments, or replace professional medical advice. Always consult a qualified healthcare provider for medical concerns.

Arcvita is a direct-to-consumer wellness application. Because we collect information directly from you with your consent — rather than from a health care provider, health plan, or clearinghouse, and because we do not conduct standard health care billing transactions — Arcvita is not a "covered entity" under the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the health information you provide is not "protected health information" governed by HIPAA. Regardless of HIPAA's applicability, we protect your health information as described in this Policy and in accordance with applicable consumer-privacy and consumer-health-data laws.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following limited circumstances:

5.1 Service Providers

Provider	Purpose	Data Shared
Supabase	Cloud database and authentication	Account info, biomarkers, imaging/DEXA data, regimen, health metrics
Anthropic	AI health coaching + document parsing (via our proxy)	Health metrics, biomarkers, imaging/DEXA findings, coaching messages, and uploaded documents for parsing
Apple	Authentication (Sign in with Apple)	Authentication tokens
Cloudflare	Website hosting (arcvita.health)	Website visitor data (IP, pages viewed)

Our service providers are contractually required to protect your data and use it only for the purposes we specify.

5.2 Connected Devices

When you connect a wearable device (Whoop, Oura), data flows from that device to Arcvita. We do not send your Arcvita data back to the device manufacturer unless you explicitly enable such sharing.

5.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request. We will notify you of such requests when legally permitted to do so.

5.4 Business Transfers

If Arcvita is involved in a merger, acquisition, reorganization (including a corporate spin-out), or sale of assets, your information may be transferred as part of that transaction. We will notify you via the app or email before your information becomes subject to a different privacy policy.

5.5 With Your Consent

We may share your information in other ways if you specifically direct us to do so.

6. Your Rights and Choices

6.1 Access and Export

You can view all of your health data within the app. You may export your data as a JSON file from Profile → Privacy & Data, or by contacting us at privacy@arcvita.health.

6.2 Deletion

You can delete your data at any time:

• Local data: Signing out of the app clears local data from your device
• Cloud data: Use the "Delete All Data" option in Profile → Privacy & Data, or contact us at privacy@arcvita.health
• We will delete your data within 30 days of your request

Consent and legal records. When you delete your account, we retain a limited record of which versions of our legal agreements you accepted and when, as evidence of compliance. These records do not contain your health data, and your identity is disassociated from them where feasible. If you require complete erasure, contact privacy@arcvita.health and we will honor verified erasure requests except where retention is required by law.

6.3 HealthKit Permissions

You can revoke Arcvita's access to HealthKit at any time via the Apple Health app (Settings → Privacy & Security → Health → Arcvita). Revoking access stops new data collection but does not delete previously collected data from Arcvita.

6.4 AI Coaching Consent

You can decline AI coaching during the initial consent flow. You may withdraw consent at any time from Profile → Privacy & Data; withdrawing consent stops further sharing of your data with the AI provider.

6.5 Push Notifications

You can manage notification preferences in your device's Settings app.

7. Data Retention

Data Type	Retention Period
Account information	Until you delete your account
Biomarkers and lab reports	Until you delete your account or request deletion
DEXA, imaging, blood pressure, regimen	Until you delete your account or request deletion
Health metrics (cloud)	Until you delete your account or request deletion
Coaching conversations	Until you delete them or delete your account
Uploaded documents sent for AI parsing	Deleted from the AI provider after parsing; source documents in our storage until you delete them
Usage/diagnostic data	12 months

After deletion, data may persist in encrypted backups for up to 30 days before being permanently purged.

8. Minimum Age (18+)

The Arcvita Service is intended solely for adults aged 18 and older. Arcvita is not directed to, and we do not knowingly collect personal information from, anyone under the age of 18. By using the Service, you represent that you are at least 18 years old. If we learn that we have collected personal information from a person under 18, we will delete that information promptly. If you believe a person under 18 has provided us with personal information, please contact us at privacy@arcvita.health.

9. U.S. State Privacy Rights

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know, delete, correct, and opt out of sale/sharing of personal information (we do not sell or share your personal information for cross-context behavioral advertising), and the right to non-discrimination. To exercise these rights, contact privacy@arcvita.health.

9.2 Consumer Health Data

Arcvita processes consumer health data as defined by applicable state laws (including Washington's My Health My Data Act, Nevada, Connecticut, and others). We:

• Collect consumer health data — including biomarkers, imaging and body-composition data, blood pressure, medications, and reproductive/family-history information you choose to provide — only with your consent
• Do not sell consumer health data
• Do not use consumer health data for advertising or marketing purposes
• Provide you with the ability to delete your consumer health data

10. United States Only

The Arcvita Service is intended for use only by residents of the United States, and our data-handling practices are designed around U.S. federal and state law. The Service is not offered to, or directed at, individuals in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions outside the United States, and we do not currently support the rights frameworks of those jurisdictions (such as the EU/UK General Data Protection Regulation). If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law; your information will be transferred to, stored, and processed in the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by other means before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance.

12. Contact Us

13. Apple HealthKit Disclosure

In accordance with Apple's requirements for apps that access HealthKit data:

• Arcvita does not use HealthKit data for advertising or similar services, including third-party advertising, advertising-based data mining, or information brokering.
• HealthKit data is not shared with third parties without your explicit consent, except as necessary to provide the core functionality of the Service.
• Arcvita does not disclose HealthKit data to the App Tracking Transparency framework.

This Privacy Policy (Version 2.0.0) is effective as of August 9, 2026 and applies to all users of the Arcvita Service.