Privacy Policy

1. Introduction

Survon, Inc. ("we," "us," or "our") is committed to protecting your privacy and the security of your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use SurvonMD Guardian, our consumer health AI platform, including your dashboard, Aria (our AI assistant), Labs, Family Circle, and Personalized Supplements.

SurvonMD Guardian is developed in partnership with Mayo Clinic, and we adhere to applicable healthcare privacy regulations, including the Health Insurance Portability and Accountability Act (HIPAA) and other relevant data protection laws. Our data processing takes place on servers based in Switzerland.

2. Information We Collect

2.1 Account Information

• Email address (used for magic-link or OTP authentication)
• Phone number (used for authentication and communication)
• Year of birth and gender, to enable age- and gender-specific health insights
• Country / location, to provide region-specific insights and determine the availability of location-dependent features
• Occupation or activity description you choose to share, used to set appropriate baseline expectations for your daily metrics
• Personal health goals, preferences, and platform settings

2.2 Health Profile & Wearable Data

• Data synced from wearables and health apps you connect, such as Apple Health, Google Health Connect, Samsung Health, Fitbit, Garmin, Oura, Strava, Withings, Huawei, Dexcom, and similar sources
• Information you add to your Health Profile: current medications and dosages, known allergies, chronic conditions, and the specific devices you use
• Derived health metrics and your personal 30-day baseline across activity, cardiovascular, respiratory, sleep, and metabolic readings
• Health insights, trend flags, and summaries generated by the platform

2.3 Platform Usage Data

• Your queries and conversation history with Aria
• Feature usage and interaction patterns
• Session duration and frequency of use

2.4 Labs Documents

Labs lets you keep lab results, imaging reports, and other medical documents (PDF, up to 4MB) alongside the rest of your health data.

2.5 Family Circle Data

• The name, relationship, and email address or phone number of each person you invite to your Family Circle
• Your sharing preferences for each connection: whether they receive Full data access or a Weekly digest, and any specific data types you choose to include or exclude
• Records of invitations sent, accepted, and any access changes or removals

2.6 Personalized Supplements Data

• Your health-profile responses and any adjustments you make to a proposed supplements pack
• Subscription, order, and shipment status information
• Contact and shipping information, which we share with our supplement fulfillment partner solely to pack and ship your order (see Section 6.1)

2.7 Protected Health Information (PHI)

Any health information that could identify you, including clinical notes, lab results, imaging, and other identifiers you upload or provide through the platform.

2.8 Technical Information

• Device type, operating system, and browser information
• IP address and location data (limited to country/region)
• Error logs and system performance metrics

3. How We Use Your Information

3.1 Platform Services

• Calculate your personal 30-day health baseline and flag readings that fall outside it
• Power Aria's on-demand summaries and insights
• Analyze Labs documents when you request it
• Enable Family Circle sharing according to the settings you choose
• Generate, personalize, and manage your Personalized Supplements pack
• Maintain your account, preferences, and conversation continuity

3.2 AI Data Analysis & Your Consent

My Data screen includes a control: "Let SurvonMD and Aria analyze my health data." This setting governs whether Aria and related AI features, including Labs analysis and Supplements personalization, may process your health data. You can turn this off at any time; doing so will limit or disable the AI-powered features that depend on it.

3.3 Platform Improvement

• Enhance AI model performance and accuracy
• Develop new features and capabilities
• Conduct quality assurance and safety monitoring
• Perform system maintenance and security updates

3.4 Compliance and Legal

• Maintain audit trails for regulatory compliance
• Respond to legal requests and regulatory inquiries
• Enforce our Terms of Service and platform policies

4. HIPAA Compliance and PHI Protection

4.1 PHI Handling

• PHI is processed only for the purposes described in this Policy
• Access to PHI is limited to authorized personnel and systems
• PHI is encrypted both in transit and at rest
• PHI retention follows healthcare industry standards and applicable legal requirements

4.2 Control Over Your Health Data

Sharing your health data with anyone, including people you invite through Family Circle, happens only when you take that action or give your explicit consent. You control your sharing preferences at all times through My Data and Family Circle settings.

5. Data Security and Protection

5.1 Technical Safeguards

• End-to-end encryption for data in transit and enterprise-grade encryption at rest
• Servers hosted in Switzerland with robust infrastructure
• Multi-factor authentication and access controls
• Regular security audits and vulnerability assessments

5.2 Administrative Safeguards

• Role-based access permissions
• Regular employee training on data protection
• Incident response procedures
• Comprehensive audit logging

5.3 Physical Safeguards

• Secure data center facilities with restricted physical access
• Environmental controls and monitoring

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We share information with trusted service providers who help us operate the platform, including providers of:

• AI and large language model services that power Aria
• Cloud hosting and infrastructure services
• Payment processing for your Guardian subscription and Personalized Supplements orders
• Our supplement fulfillment partner, who packs and ships your Personalized Supplements order and receives the shipping and order information necessary to do so
• Mapping and location services used to support location-dependent features
• Wearable device and health app integrations you choose to connect

All service providers are bound by data protection agreements and, where applicable, HIPAA compliance requirements.

6.2 Mayo Clinic Partnership

As our development and investment partner, Mayo Clinic may have limited access to aggregated, de-identified data for quality assurance, clinical validation, and platform improvement purposes.

6.3 Family Circle

When you invite someone to your Family Circle, the health data you choose to share (Full data or a Weekly digest, and any data types you select) becomes visible to that person once they accept your invitation. You can revoke access at any time, and removal takes effect immediately. We are not responsible for how a person you have invited subsequently uses information you chose to share with them.

6.4 Legal Requirements

We may disclose information when required by law, regulation, or legal process, including:

• Compliance with court orders or government requests
• Protection of our legal rights and interests
• Prevention of fraud or illegal activity
• Emergency situations involving patient safety

7. International Data Transfers

Our primary data processing occurs within Switzerland. When data must be transferred internationally for platform operations, we use appropriate safeguards, including Standard Contractual Clauses (SCCs), applicable adequacy decisions, and additional security measures as required.

8. Data Retention

8.1 Account Data

Retained while your account is active. Following account closure, data is securely deleted within 90 days unless legal requirements mandate longer retention.

8.2 Labs Documents

Your original documents live only on your device and are not retained on our servers. When you run an analysis, the extracted text and AI-generated summary or results are retained as described in Section 8.4.

8.3 Query and Usage Data

Conversation and query logs are retained to maintain continuity and platform functionality, and are not used for purposes beyond providing the service. Platform usage analytics may be retained for up to two years.

8.4 Health & Analysis Data

Extracted document text and AI-generated summaries or analysis results may be retained for up to two years. De-identified data may be retained longer for research and platform-development purposes.

8.5 Family Circle

Your list of connections and sharing settings are retained while your account is active. When you remove someone's access, we stop sharing with them immediately; records of past invitations may be retained for account administration.

9. Your Rights and Choices

9.1 Access and Control (My Data)

• View a summary of the records we hold for you, by category
• Download all of your data as a CSV export
• Permanently delete all of your stored data from Survon's servers
• Turn AI data analysis on or off at any time (see Section 3.2)

9.2 Family Circle Controls

• Invite or remove family members, caregivers, a trainer, or your doctor at any time
• Choose Full data or Weekly digest access, and further limit which data types are shared
• Revoke access instantly; removed connections can be re-invited later

9.3 Account and Communication Preferences

• Correct or update inaccurate information
• Delete your account and associated data (subject to legal requirements)
• Opt out of non-essential communications and manage notification settings

9.4 HIPAA Rights (Where Applicable)

If you are a covered entity or a patient whose PHI is processed through our platform, you may have additional rights under HIPAA, including the right to request restrictions on the use and disclosure of your PHI.

10. Cookies and Tracking Technologies

We use essential cookies and similar technologies to maintain your session and authentication, remember your platform preferences, and help ensure security and prevent fraud. We do not use third-party advertising trackers. You can control cookie settings through your browser, though disabling essential cookies may affect platform functionality.

11. Children's Privacy

SurvonMD is intended for consumers 18 years of age and older. We do not knowingly collect personal information from individuals under 18 years of age without appropriate parental consent and authorization.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify users of material changes through email notifications, a prominent notice on our platform, and by updating the "Last Updated" date above. Continued use of the platform following notice of changes constitutes acceptance of the updated policy.

13. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: hello@survonmd.com

14. Regulatory Information

14.1 HIPAA Covered Entities

If you are a HIPAA covered entity and believe a Business Associate Agreement applies to your use of the platform, please contact us to discuss.

14.2 International Users

Users outside the United States should ensure their use of the platform complies with local data protection regulations, including GDPR for users in Europe.