Privacy Policy

Effective August 1, 2026 · Last updated August 1, 2026

Elevare Health, Inc. (“Elevare,” “we,” “us,” or “our”) is a Delaware public benefit corporation that provides a digital maternal health platform, including the Elevare mobile and web application, our virtual clinician experience, our websites (including elevare.health), and related communications programs (collectively, the “Services”). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

Important note about health information. Elevare handles health information under different legal frameworks depending on how you access the Services. When we provide the Services on behalf of a covered entity such as your health plan, employer-sponsored health program administrator, or healthcare provider, we act as a business associate under the Health Insurance Portability and Accountability Act (“HIPAA”), and your protected health information is governed by HIPAA, our Business Associate Agreements, and the applicable entity’s Notice of Privacy Practices. When you use the Services directly as a consumer, your health information is protected by this Privacy Policy and applicable consumer health data laws, including the Washington My Health My Data Act and similar state laws where applicable, and by the FTC Health Breach Notification Rule.

1. Information We Collect

Information you provide to us

• Account and profile information: name, email address, phone number, date of birth, mailing address, language preference, and login credentials.
• Health and wellness information: information you choose to share through the Services, such as pregnancy status and stage, menstrual cycle information, symptoms, health history, medications, care preferences, lactation and postpartum information, mood and mental health screenings, and information you share in conversations with our virtual clinician or care team.
• Communications: messages, feedback, survey responses, images or screenshots you send us, and records of your interactions with our care team, which may include nurses, social workers, and physicians.
• User research and testing information: if you participate in a user testing or feedback program, the feedback, comments, ratings, and materials you submit.

Information collected automatically

• Usage information: features used, session duration, interaction patterns, and in-app activity.
• Device and technical information: device type, operating system, browser type, IP address, app version, and crash logs.
• Cookies and similar technologies: we use cookies and similar tools on our websites for functionality and analytics. We do not use analytics autocapture on screens that display health information. You can manage cookie preferences through your browser settings.

Information from connected sources (with your permission)

• Wearables and connected devices: if you connect a wearable or health device, we collect the data you authorize, such as heart rate, sleep, and activity data.
• Health records: if you authorize a connection to your electronic health records or health information networks, we receive the records you direct to us.
• Your health plan, employer program, or provider: if you access the Services through a sponsoring organization, we may receive eligibility and enrollment information from that organization. We do not share your individual health information with your employer. Employers receive only aggregated, de-identified program information.

2. How We Use Information

We use information to:

• Provide, personalize, and improve the Services, including surfacing early signals that may warrant clinical follow-up by our clinician-on-the-loop care team;
• Coordinate care, including escalation to nurses, social workers, physicians, and your own providers where you have authorized it;
• Communicate with you, including service messages, appointment and care plan reminders, and, where you have opted in, SMS text messages;
• Operate user research and feedback programs you have joined;
• Maintain safety, security, and integrity of the Services, including fraud prevention and audit logging;
• Comply with legal obligations; and
• Conduct research and analytics using de-identified or aggregated data that does not identify you.

AI and model training. We use artificial intelligence to power parts of the Services. We do not use your identifiable health information to train generalized AI models without your explicit consent. Where we use data to improve our systems, we apply de-identification standards and contractual safeguards with our technology providers.

3. SMS Text Messaging Program

If you opt in to receive text messages from Elevare, including our user testing and feedback program, the following terms apply:

• Consent: you will only receive messages after you provide express written consent, such as by submitting a signup form or texting a keyword to our number. Consent to receive texts is not a condition of purchasing any goods or services or of receiving care.
• Message frequency: varies by program. During active testing or care programs, expect approximately 2 to 4 messages per week.
• Fees: message and data rates may apply based on your mobile carrier plan.
• Opt out: reply STOP at any time to stop receiving messages. You may receive one final message confirming your opt-out.
• Help: reply HELP or email support@elevare.health for assistance.
• Carriers: carriers are not liable for delayed or undelivered messages.
• No third-party sharing of SMS consent data: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding vendors and aggregators acting solely on our behalf to deliver messages.

4. How We Share Information

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising. We share information only as follows:

• Care team and providers: with clinicians and care team members involved in your care, and with your external providers when you authorize it.
• Sponsoring organizations: if you access the Services through a health plan or program administrator, we share information as required to administer the program, consistent with HIPAA where applicable. Employers receive only aggregated, de-identified reporting.
• Service providers: vendors that perform services on our behalf, such as cloud hosting, communications delivery, engineering, analytics, and customer support, under contracts that restrict their use of your information and, where required, Business Associate Agreements.
• Legal and safety: when required by law, legal process, or to protect the rights, safety, or property of you, others, or Elevare, including responding to risk of serious harm.
• Corporate transactions: in connection with a merger, financing, acquisition, or sale of assets, subject to confidentiality protections and this Privacy Policy’s commitments.
• With your consent: for any other purpose you expressly authorize.

5. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate information;
• Delete your personal information, including health data;
• Withdraw consent for the collection or sharing of consumer health data at any time;
• Opt out of certain processing, and appeal a decision we make about a rights request;
• Receive a list of third parties with which specified data has been shared, where required by state law.

You can exercise these rights by emailing privacy@elevare.health or through in-app settings. You can view and delete information the virtual clinician remembers about you from within the app. We will verify your request and respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.

Consumer health data (Washington My Health My Data Act and similar laws): where these laws apply, we collect and share consumer health data only with your consent or as necessary to provide services you have requested. Our consumer health data practices are described throughout this Policy, including the categories collected (Section 1), purposes (Section 2), sharing (Section 4), and your rights (this Section).

California residents: you have the rights described above under the CCPA/CPRA, including the right to know, delete, correct, and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined under California law.

6. Data Security and Retention

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, role-based access controls, audit logging, and workforce training. We are pursuing industry-standard security certifications and maintain security programs aligned to healthcare compliance frameworks. No system is perfectly secure, and we cannot guarantee absolute security.

We retain information for as long as needed to provide the Services, comply with legal and clinical record-keeping obligations, resolve disputes, and enforce agreements. When information is no longer needed, we delete or de-identify it.

Breach notification: if a breach of security affects your unsecured health information, we will notify you and applicable regulators as required by HIPAA, the FTC Health Breach Notification Rule, or state law, as applicable.

7. Children

The Services are intended for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact privacy@elevare.health and we will delete it.

8. International Users

The Services are operated from the United States and intended for users located in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

9. Not Medical Care in an Emergency

The Services are not for emergencies. If you are experiencing a medical emergency, call 911 or your local emergency number immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Services or by email, and where required by law we will obtain your consent. The “Last Updated” date reflects the most recent revision.

11. Contact Us

Elevare Health, Inc. · privacy@elevare.health

For HIPAA-related questions when we act as a business associate, please also refer to your health plan’s or provider’s Notice of Privacy Practices.