Your health data. Clearly accounted for.

Scope of this notice

“Consumer health data” means personal information that is linked or reasonably linkable to a consumer and identifies the consumer’s past, present, or future physical or mental health status, as defined by applicable state law.

This notice applies to consumer health data processed by Astraeus Intelligence LLC (“Astra”) when that information is not exempt from the applicable state law. Information governed by HIPAA, a properly scoped Business Associate Agreement, or another statutory exemption may instead be handled under that law and agreement.

Categories of consumer health data collected

• Health conditions and care information: symptoms, diagnoses, medical history, medications, treatment, procedures, laboratory or imaging information, risk factors, care plans, and similar clinical details you submit.
• Clinical narratives and records: prompts, case presentations, notes, differentials, assessments, plans, uploaded documents, photographs, images, voice transcripts, and feedback that includes health information.
• Generated health inferences: summaries, ranked differentials, next steps, draft documentation, likely conditions, treatment-related suggestions, and other health-related conclusions generated from submitted information.
• Health-service interaction information: searches, feature interactions, timestamps, and technical or account identifiers when they reveal or can reasonably be linked to seeking or receiving health-related services.
• Identity and account data linked to health information: name, email, user identifier, organization affiliation, IP address, device data, and saved-session information when associated with consumer health data.

Astra does not intentionally collect genetic test results, biometric identifiers used for identification, precise geolocation for health-facility targeting, or reproductive or sexual-health data as standalone product categories. Such information may nevertheless be present if a user chooses to include it in free-form clinical content. Users should submit only information necessary for the requested feature.

Sources of consumer health data

• You, when you type, upload, dictate, photograph, save, or otherwise submit information.
• Your healthcare, educational, or other organization, when it provisions or manages an account or directs processing.
• Your browser or device, through permissions, cookies, local storage, technical requests, and feature interactions.
• Astra’s inferences, when the Service generates clinical or health-related output from submitted information.
• Service providers, when they return model output, search results, authentication information, security signals, or operational metadata.
• Public scientific and clinical sources, when Research retrieves literature or other public information in response to a request.

Purposes for collecting and using consumer health data

• Provide the health-related feature you request, including evidence retrieval, clinical reasoning, generated documentation, and saved conversation history.
• Create health-related summaries, inferences, citations, differentials, and draft outputs for your review.
• Authenticate users, synchronize authorized workspaces, maintain saved content, and apply account permissions.
• Provide support, respond to privacy requests, troubleshoot errors, prevent abuse or fraud, and protect the Service.
• Comply with applicable law, contracts, valid legal process, and obligations to protect rights, safety, and security.

No routine human review

Astra personnel do not routinely inspect stored consumer health data. Content-level access is limited to an express support request, a confirmed security incident that cannot reasonably be addressed with metadata, valid legal process, or a specific contractual duty, and is subject to purpose limitation, least privilege, confidentiality, and logging where supported.

Where state law requires consent, Astra requests consent before collecting or sharing consumer health data unless an exception applies. You may withdraw consent as described below. Withdrawal does not affect processing already completed lawfully and may prevent Astra from providing features that require the data.

Consumer health data sharing and sale

Astra does not sell consumer health data. Astra may share the categories described above with the specific recipients below only for the stated purposes, at your direction, or as otherwise permitted by law.

When you open a citation, export content, or direct Astra to send information elsewhere, the recipient you select receives the data under its own privacy practices. Astra does not collect consumer health data across unaffiliated websites over time for advertising, and does not share consumer health data for cross-context behavioral advertising.

Your consumer health data rights

Subject to applicable law and exceptions, you may:

• Confirm whether Astra is collecting, sharing, or selling your consumer health data.
• Access the consumer health data Astra maintains about you.
• Receive a list of specific third parties or affiliates with which Astra shared or sold your consumer health data, where required.
• Delete consumer health data held by Astra and request deletion from processors or other required recipients.
• Withdraw consent for collection or sharing.
• Appeal Astra’s refusal to act on a request.

Submit a request

Email outreach@astramd.org with “Consumer Health Data Request” in the subject line. Identify the right you want to exercise and the account involved, but do not include health information in ordinary email. We may request information reasonably necessary to authenticate the request.

We will respond within the period required by applicable law, generally within 45 days, subject to a legally permitted extension. If we deny the request, reply with “Consumer Health Data Appeal” and explain why you believe the decision should be reconsidered. An authorized agent may act for you where permitted, subject to verification of authority.

Organization-controlled and HIPAA data

If a healthcare, educational, or other organization controls the account or record, submit the request to that organization. If the data is PHI governed by HIPAA, the organization’s HIPAA notice and Astra’s applicable BAA govern the request. Astra assists the organization as required.

Changes to this notice

We will post changes with a revised effective date. Before collecting a new category of consumer health data or using previously collected data for a materially different purpose, we will provide notice and obtain consent when required. We will not use previously collected consumer health data for a materially different purpose without the consent required by law.

Contact