Privacy | Holistagenix

Holistagenix Privacy Policy

Effective date: October 18, 2026 · Holistagenix LLC

This policy explains what the Holistagenix app and website (the "Service") collect, why, who helps us handle it, and the choices you have. It is part of our Terms of Service. The short version: We collect what you choose to tell the app (check-ins, practices, how they felt) and, if you use it, your Vitality Check readings. Camera images stay on your phone. Only the readings are saved. We never sell your information and never use it for advertising. A practitioner sees your information only if you connect with them and confirm. You can download your data or permanently delete your account at any time from Profile.

1. What we collect:

We collect only what the Service needs to work for you. Most of it you enter yourself. Account: your email address, first name, password (stored encrypted by our database provider , never readable by us) and records of your agreement to our Terms and this policy. You provide these when you sign up. Wellness check-ins: the Feel words you choose (such as Steady or Drained), sleep answers, intentions, the practices you start or finish, how a practice felt (Better, About

the same, Worse), pattern-card answers and your goal. You enter these in the app. Vitality Check readings: estimated pulse, heart rate variability and breathing rate, with the date, time of day and a quality flag. These come from your phone's camera and are processed on your phone (Section 3). Preferences: your companion name, home greeting, food and movement preferences, notification time, and practices you've marked "Not for me". Companion messages: what you type to the in-app companion. These are kept on your phone for the day . If you turn on AI replies, they're also sent to OpenAI as described in Section 3. Companion settings and records: whether you've turned AI replies on or off, daily counts of AI replies (never the messages themselves), and, for no more than two days, the date on which a message suggesting someone may be in crisis was recognized, so that AI replies stay off for that day .Practitioner connection: the invitation code (and the phone number or email a practitioner used to invite you), which practitioner you connected to, and the messages, appointments, plans and reports shared in the app. This is only collected

after you confirm a connection. Notifications: your account ID and a device identifier, used to send reminders, and

whether a reminder was delivered. This is only collected if you turn notifications on. Technical information: app version, device type, error reports, and counts of app activity that are not linked for you. What we don't collect: your location, contacts, photos, camera images or video, Apple Health data, or payment information.

2. How we use it:

and what we never do We use your information to: run your account and keep you signed in;

show your Wellness Picture, Snapshot, readings and patterns, compared only with your own past entries; suggest practices and send the reminders you turned on; share with a practitioner, only if you connect and confirm; send account emails such as sign-up confirmation and password reset; keep the Service secure, fix problems and check that it is working; meet legal obligations. We never: sell your information or share it for advertising; use advertising or cross-app tracking; use your wellness information to make decisions about insurance, employment or credit; send your check-ins, readings or companion messages to an AI service, unless you choose to turn on AI replies for the companion (Section 3).

3. The camera:

and what stays on your phone Vitality Check. The app uses the camera only while you take a Vitality Check, with your fingertip over the rear camera and flash. The camera image is processed on your phone to

calculate the reading and then discarded. Camera images and video are never stored by us or sent to our servers. Only the resulting readings are saved to your account. Kept only on your phone: your conversations with the in-app companion for the day; small records that keep the app's wording varied, such as which lines you've already seen;

settings like a remembered tab or an unsent draft. These stay on the device and are removed if you delete the app. When you type a message to the companion, it may be sent to our server to choose a reply , but it is not stored there. Messages that suggest someone may be in crisis are recognized on your phone and answered with emergency and support information. AI replies for the companion (optional). If you agree, the companion uses OpenAI to

write its replies. You're asked first, and you can say no; the companion then keeps using set replies. With each message, we send OpenAI only: your message, up to four of your recent messages, your companion's name, the time of day , and a short summary of your own records from the last 14 days (Feel words, sleep answers, practices and how they felt, and, only when you ask about it, your latest Vitality Check reading). We never send your name, email, account ID , allergies, journal, notes or anything from a practitioner connection.Messages that suggest someone may be in crisis, and questions about medicines, pregnancy , eating disorders or urgent symptoms, are never sent to OpenAI; they're answered with set replies. We ask OpenAI not to store these conversations, but under its API terms OpenAI may keep them for up to 30 days to check for misuse, and it does not use them to train its models. AI replies can be wrong or incomplete. You can turn AI replies off at any time in Profile → Companion.

4. Who helps us run the Service:

We use a small number of companies to host and operate the Service. They may only use your information to provide their service to us, under contracts that require them to protect it. Supabase (database and sign-in): your account and everything you save in the app, stored in the United States. Netlify (hosts the app and website): the requests your device sends to the Service. Resend (sends account emails): your email address and the email's content. OneSignal (sends reminder notifications): your account ID , a device identifier and the reminder text.

Sentry (reports app errors so we can fix them): technical details about the error and

your device. OpenAI (writes companion replies, only if you turn on AI replies): your message, a few recent messages and a short summary of your own recent records, as described in

Section 3. Edamam, USDA FoodData Central and Open Food Facts (food search and barcode lookups): only the food name or barcode you search for , never your account or identity. Twilio (sends practitioner invitations by text message): the phone number the practitioner entered and the invitation message. Apple (app distribution and the device features the app uses): as described in Apple's own privacy policy .We may also share information if the law requires it, to protect someone's safety , or as part of a merger or sale of the business, in which case this policy would continue to apply to it.

5. Sharing with a practitioner:

If a practitioner gives you an invitation code, you can connect your account to theirs. Nothing is shared until you confirm, and the app shows what will be shared before you do. Once connected, your practitioner can see the information the app lists, such as your check-ins and what you share in messages and reports. Journals stay private.

You can disconnect at any time from Profile. After that, your practitioner can no longer see new information. Practitioners are independent of Holistagenix and are responsible for how they handle what you share with them, under the laws and professional rules that apply to them.

6. Your choices and rights:

See and download your data: Profile → Privacy & data → Download my data. Correct your details: edit them in Profile, or email us. Delete your account and data: Profile → Privacy & data → Delete my account. Stop sharing with a practitioner: Profile → Manage connection → Disconnect. Turn the companion's AI replies on or off: Profile → Companion. Turn reminders on or off: Profile → Notifications, or your phone's settings. Turn camera access on or off: your phone's Settings → Holistagenix. Ask a question or make a request: email customerservice@holistagenix.com.

W e will answer requests within 30 days, or sooner where the law requires. We may need to confirm it's really you before acting on a request. We won't treat you differently for using any of these rights.

7. How long we keep it:

We keep your information while your account is open. When you delete your account, we delete your account and everything saved with it from our live systems straight away. Copies in our backups are removed as those backups are replaced, within 30 days. We may keep a minimal record that an account was deleted, and anything the law requires us to keep. Records that a crisis message was recognized are deleted automatically after two days. Daily counts of AI replies are kept with your account and deleted when you delete it. Error reports and app activity counts are kept for a limited time and are not used to identify you.

8. Security and where your data is stored:

Your information is encrypted while it travels between your device and our servers. Our database only lets each account read its own records, unless you have connected with a practitioner , and only a small number of authorized people can access the systems behind the Service. No system is perfectly secure, but we work to protect your information and will tell you, as the law requires, if a breach affects it. Your information is stored in the United States. If you use the Service from another country , your information will be transferred to and processed in the United States.

9. Children:

The Service is for adults 18 and older . We do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its information. If you believe a child has used the Service, email customerservice@holistagenix.com.

10. Consumer health data and state privacy rights:

Some U.S. states, including Washington, Nevada, Connecticut and California, give extra rights over wellness and health-related information. Under those laws, the check-ins, practice answers and Vitality Check readings described in Section 1 may count as consumer health data. We collect it only to provide the Service features you use, as described in Section 2. We share it only with the service providers in Section 4, and with a practitioner if you

connect and confirm. We never sell it.Your rights include knowing what we hold, getting a copy , correcting it, deleting it, and withdrawing your consent by deleting your account. Use the options in Section 6. If we refuse a request, you can appeal by replying to our answer or emailing customerservice@holistagenix.com with "Appeal" in the subject. We will respond within 45 days. If you're not satisfied, you can contact your state attorney general.

11. Changes and contact:

If we make an important change to this policy , we will tell you in the app or by email before it takes effect. We will ask for your agreement first before using your information in a new way , such as sending companion messages to an AI service.Contact: Holistagenix LLC 8983 Okeechobee Blvd, Ste 183, West Palm Beach, FL 33412 customerservice@holistagenix.com · Monday to Friday , 9 a.m. to 5 p.m. Eastern Time, except U.S. federal holidays. We aim to reply within 2 business days.