Privacy Policy

Effective February 16, 2026 · Last updated February 16, 2026

1. Who we are

Summara Health ("Summara," "we," "us," or "our") is a mobile application and web service operated by Thronos Holdings, LLC, a limited liability company organized under the laws of the State of Texas, USA. Our service is available at www.summarahealth.com and via the Summara Health mobile app on the Apple App Store and Google Play. Contact: [email protected].

2. Scope

This Privacy Policy explains what personal information we collect from you, how we use it, who we share it with, and the choices you have. It applies to your use of the Summara Health mobile app and website (the "Service"). By creating an account or using the Service, you agree to the practices described here.

3. Not a HIPAA-covered entity

Summara Health is a consumer wellness and educational tool. We are not a Covered Entity or Business Associate under the U.S. Health Insurance Portability and Accountability Act ("HIPAA") unless we have signed a Business Associate Agreement (BAA) with you or your provider. Content you submit to Summara is treated as personal information, not Protected Health Information (PHI), and is protected under this Privacy Policy — not under HIPAA. See our Medical Disclaimer for more.

4. Information we collect

a. Account information you provide - Email address - Password (stored only as a bcrypt hash — we never see the plaintext) - Optional display name

b. Content you submit - Physician notes, discharge paperwork, laboratory reports, imaging reports, medication names, or other text you paste, type, or record into Summara - Follow-up questions you ask our AI assistant - AI-generated summaries and answers derived from your content

c. Subscription and purchase information - Product identifier of the plan you purchased (pro_monthly or elite_family_monthly) - Purchase receipts and tokens issued by Apple or Google - Subscription status, renewal, and expiration timestamps

d. Technical information collected automatically - Approximate device type and operating system version (via the Apple/Google purchase receipt or platform diagnostics) - Application logs (timestamps, errors, request IDs) - IP address at the time of each API request

We do not collect precise geolocation, contacts, camera, microphone, photos, or health-app data unless a future feature explicitly asks for your permission at the moment it needs that data.

5. How we use your information

• To operate the Service (accounts, authentication, saving your records)
• To generate AI-powered summaries and answers about the content you submit
• To send you the summaries you request and store them on your medical timeline
• To manage subscriptions, restore purchases, and reflect your entitlement
• To detect abuse, debug errors, and improve reliability of the Service
• To communicate service-related messages (e.g., password reset, security notice, or a material change to this policy). We do not use your data to send marketing without your consent.

We do not sell your personal information. We do not use your content to train third-party AI models. Specifically, submissions to our AI provider are made under OpenAI's API terms, which prohibit training on API data by default.

6. Who we share information with

• OpenAI, LLC — we send the text you submit and your follow-up questions to OpenAI's API to generate summaries and answers. OpenAI processes this data as our processor and does not use it to train models under its API terms.
• Apple, Inc. and Google LLC — when you subscribe, purchase receipts and purchase tokens are exchanged with Apple's App Store and Google Play so we can verify your entitlement.
• Emergent — our infrastructure host, which runs the Summara backend and application servers.
• MongoDB, Inc. — our database provider, holding the encrypted account, record, and subscription data described above.
• Legal and safety — we may disclose information to comply with a lawful subpoena, court order, or regulator, or to protect the safety of a user or the public.

We never sell your data. We never share your submitted medical content with advertisers or data brokers.

7. Data retention

• Account data is retained while your account is active and for up to 30 days after deletion to complete backups and rollbacks.
• Records you save (visit summaries, medication explanations, lab and imaging interpretations, chat sessions, translations) are retained until you delete them or your account.
• Purchase receipts and subscription events are retained for at least 7 years as required for tax and financial recordkeeping.
• Application logs are retained for up to 90 days for debugging and security auditing.

You can request deletion of your account and content at any time by writing to [email protected] or by using the in-app Delete account option (when available).

8. Security

We use commercially reasonable technical and organizational safeguards: transport encryption (HTTPS/TLS) for all data in transit; encryption at rest provided by our database host; bcrypt-hashed passwords; JSON Web Token access tokens with short-lived sessions; least-privilege access to our production environment; and audit logging of administrative actions. No method of transmission or storage is 100% secure, however, so we cannot guarantee absolute security.

9. Your rights

Depending on where you live you may have the right to: - Access the personal information we hold about you - Correct information that is inaccurate or incomplete - Request deletion of your account and personal information - Object to or restrict certain uses of your personal information - Receive your information in a portable format (data portability) - Withdraw consent where we rely on consent to process

To exercise any of these rights, email [email protected] from the email address associated with your account. We will respond within 30 days.

California residents (CCPA/CPRA): You have the right to know what categories of personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or "share" for cross-context behavioural advertising), and the right not to be discriminated against for exercising your rights.

EU / UK residents (GDPR/UK-GDPR): Our lawful basis for processing is (a) performance of the contract when you create an account and use the Service, (b) legitimate interests for security and product improvement, and (c) legal obligation for financial recordkeeping. You may lodge a complaint with your supervisory authority.

10. Children's privacy

Summara Health is intended for users 18 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, please contact [email protected] so we can delete it.

11. International transfers

Summara Health is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your country. Where required, we rely on Standard Contractual Clauses to safeguard cross-border transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or in-app notice before they take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

13. Contact

Thronos Holdings, LLC Attn: Privacy [email protected] www.summarahealth.com