6. AI, Profiling, and Model Improvement

6.1 Educational, not diagnostic

The Services provide educational health and wellness guidance, insights, and suggestions. These are for general informational purposes only and are not medical advice, diagnoses, or prescriptions.

6.2 No solely automated high-stakes decisions

We do not make decisions with legal or similarly significant effects solely by automated means. What that means is: our insights are for educational purposes only. They do not make binding or life-affecting decisions about you. You remain in control, and our services are not used to make legal, financial, or medical eligibility determinations.

6.3 Your choices

Where provided by law, you may object to profiling or request human review. Some features may not function without data-driven personalization.

6.4 Use of anonymized/de-identified data by Shae

To improve platform quality and safety for all customers, Shae may use anonymized or de-identified data that is not reasonably linkable to a person to enhance algorithms, models, features, and service reliability. Shae does not use identifiable personal data for its own model training, does not sell data, and does not use data for advertising. For this limited purpose involving non-personal (anonymized/de-identified) data, Shae acts as an independent controller of such non-personal data.

7. Health Platforms (App Store Disclosures)

• Apple HealthKit / Health app: We only read user-authorized data; we do not write to HealthKit; data is used only for in-app features and is not used for advertising or tracking.

• Google Health Connect: We only read user-authorized data; we do not write to Health Connect; usage follows Google Play disclosures; no advertising use.

This app reads health data you authorize (see Annex B) to deliver educational wellness insights. It does not write data back to Apple Health or Google Health Connect and does not use health data for advertising or tracking.

8. Vendors and Subprocessors

We use vendors in categories such as cloud hosting, analytics, communications/support, and security. Vendors are bound by contract to:

• process personal data only on our documented instructions;

• implement appropriate security measures;

• not train AI on your personal data;

• not retain or repurpose personal data for their own purposes; and

• flow down these obligations to their subcontractors.

Storage: Only Microsoft Azure stores personal data on our behalf as our cloud host.

Transparency: We use trusted service providers such as secure cloud hosting, analytics, communications, and security tools to help us operate the Services. These providers process personal data only on our instructions and under contract. Where required by law, we may provide further details about these service providers to regulators or other authorized requestors.

9. Sharing and Disclosure

We do not sell personal data and do not share it with advertisers or for cross-context behavioral advertising. We may disclose personal data:

• to service providers and subprocessors under the safeguards in Section 8;

• to program sponsors only in aggregated/de-identified form, unless you explicitly consent to identifiable sharing;

• to comply with laws, enforce terms, or protect rights, safety, and security;

• in connection with corporate transactions, under continued protections at least as protective as these.

10. Support and Troubleshooting

If you or your program sponsor contact us for technical support, our technology provider Shae may need to temporarily access certain user account data to diagnose and resolve the issue. Such access is:

• on a need-to-know basis only,

• limited to the minimum information necessary to fix the problem, and

• carried out under strict confidentiality and data protection obligations.

Shae does not use support access for any other purpose, and access ends once the issue is resolved.

11. International Transfers

Where personal data is transferred internationally, we use recognized safeguards such as Standard Contractual Clauses and comparable mechanisms under applicable laws, including for the EU, UK, and other regions. In addition to contractual safeguards, we apply technical measures such as encryption and minimization to protect personal data during international transfers.

12. Retention and De-Identification

We retain personal data while your account is active. If you delete your account, we de-identify personal data within 30 days, copies may persist in secure system backups for 90 days. We may retain anonymized data for research and service improvement and will not attempt to re-identify it.

13. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, restrict or object, and port your personal data, and to withdraw consent at any time (without affecting processing already performed). You may also lodge a complaint with your local data protection authority.

Data Access and Portability: You have the right to request a copy of the personal data you have provided to us (for example, your account details, uploaded health-related files, and self-reported entries). Where legally required, we will provide this information in a structured, commonly used, and machine-readable format where technically feasible. This excludes proprietary algorithms, models, and outputs that form part of our intellectual property.

California (CPRA): You have rights to know, delete, and correct; to opt-out of “sale” or “sharing” (we do neither); and to limit use of sensitive personal information (we use it only to provide requested services). We do not sell your data to advertisers or for cross-context behavioral advertising.

U.S. Consumer Health Data Laws (where applicable): We obtain consent where required, minimize collection and use, and comply with restrictions such as limits on geofencing around sensitive health locations.

We also apply protections aligned with the Australian Privacy Principles and, where applicable, HIPAA safeguards for health data.

Submit requests via [email protected] We may verify your identity and will respond within applicable timelines.

14. Security and Breach Notification

We use layered safeguards including encryption in transit and at rest, least-privilege access, segmentation, monitoring, secure development practices, and an incident response program. We will notify applicable authorities and affected users without undue delay, and within any timeframes required by law (for example, within 72 hours under the EU GDPR).

15. Children

The Services are intended for adults 18+. We do not knowingly collect children’s data. If a parent/guardian believes a child has used the Services, they should contact us at [email protected] to request deletion.

16. Cookies and SDKs

We do not use your data for cross-app tracking, targeted advertising, or behavioral advertising. The Services are designed without advertising SDKs and do not share your data with third-party advertisers.

We use only essential and performance SDKs/cookies to operate and improve the Services. We do not use advertising SDKs and do not allow third-party tracking for ads. If you prefer not to share data with us, you can manage this by deleting your account at any time.

17. Changes to this Policy

We may update this Policy periodically. Material changes will be communicated in-app and/or via email before they take effect. The Effective Date above reflects the latest version.

18. Contact

For questions or privacy requests, contact [email protected].