Privacy Policy

1. The Short Version

2. Who We Are and What This Covers

Xanadu Health is a product of Your Data Health, Inc., a Delaware corporation operating in Washington State ("we," "us"). This policy covers two things:

• This website (xanadu.yourdata.health), including the waitlist, in effect now.
• The Xanadu app, our patient-facing personal health record application, effective when the app launches.

This policy is incorporated by reference into our Terms of Service. Where this policy and the Terms overlap, the more protective statement for you controls.

3. This Website and the Waitlist

When you join the waitlist, we collect the email address you give us, and any optional details you choose to add: your name, what kind of person or organization you are, what you are hoping Xanadu does for you, and how you heard about us.

That is all. This website does not collect any health data. We use waitlist information for two things: to contact you about Xanadu's launch and the founding cohort, and to understand who is interested so we build the right product. Nothing else. This site sets no cookies and runs no advertising networks, no tracking pixels, and no analytics. Beyond what you explicitly submit to the waitlist, we collect no data about you or your visit.

4. The Xanadu App: What It Handles

When the app launches, it will handle the following categories of information:

• Account information: if you sign in with an account, the email address you sign in with. The app does not ask for your name; it shows the name your healthcare records already contain.
• Health records you retrieve: the clinical records you direct the app to fetch from your healthcare providers, or on an iPhone from the health records you have already connected in Apple Health, such as medications, lab results, vital signs, conditions, immunizations, allergies, procedures, care plans, goals, and clinical documents.
• Medicare claims you retrieve: if you are a Medicare enrollee and choose to connect Medicare, the claims and coverage information Medicare holds about you, such as the services billed, dates of service, amounts paid, coverage details, and, if you choose to share them, demographic details such as name, date of birth, and sex. You decide whether to connect Medicare and which of these details to share when you approve the connection.
• Wearable and fitness data: if you give permission, the activity and body measurements your devices and apps already store in Apple Health on an iPhone or Health Connect on an Android phone, such as steps, heart rate, heart rate variability, sleep, weight, body fat, blood oxygen, breathing rate, body temperature, blood glucose, active calories, and exercise time. You choose which types to allow on your phone's own permission screen, and you can turn any of them off there at any time.
• Health record files you import: files you already have and choose to open in the app, such as an Epic or MyChart export (sometimes called a "Lucy" file), a C-CDA document (the standard record download many patient portals offer), a FHIR file, or an HL7 v2 message. The app cannot read PDFs, web pages, or spreadsheets, and it tells you when it cannot read a file.
• Health data you add: observations or documents you choose to record yourself.
• App operations data: the minimum technical information needed to run the service securely, such as authentication events and error diagnostics. Diagnostics never include the contents of your health records.

5. Where Your Health Data Lives

Your health records are stored in an encrypted vault. The encryption keys are controlled by you, not by us. In plain terms: we operate the safe-deposit boxes, and you hold the key. Our systems and our staff cannot read the health records in your vault.

You choose where your encrypted vault is stored, on your device or in storage you designate. Whatever you choose, the same rule holds: contents are encrypted before they leave your device, and we cannot read them.

6. How Records Are Retrieved

The app retrieves your records using patient-directed access, the same mechanism required of health systems and Medicare by federal information-blocking and patient-access rules. For most healthcare providers this uses SMART on FHIR, the secure standard that federal health technology rules from the Office of the National Coordinator for Health Information Technology (ONC) require certified electronic health record systems to offer for patient access. You log in to your own provider or portal account, you approve the connection, and the records flow directly into your vault. We request read-only access. The app does not write to, modify, or delete anything in your providers' systems or in Medicare's. The app reads from a connected source only while you are using it: when you first connect, and when the app refreshes that connection. It does not read from your sources while the app is closed.

Medicare. If you connect Medicare, you sign in with your own Medicare account and approve what the app may read. Medicare requires applications like ours to use a small server to complete that sign-in, because an app installed on a phone cannot safely hold the credential Medicare issues to us. That server does one thing: it completes the exchange that gives your device permission to read your Medicare data. Your Medicare data never passes through it. The permission passes through it once, on its way to your device, and is not saved or written to any log. It cannot read your vault. Like any server, it sees your device's internet address, which it uses only to block abuse; our hosting provider's standard request logs record that address and the time of each request, never what the request contained. The permission is kept only on your device, encrypted. You can disconnect Medicare in the app at any time, which deletes the permission from your device. To also cancel the permission on Medicare's side, revoke it through your Medicare account.

Wearable data. The app reads wearable and fitness data from Apple Health or Health Connect on your phone, only for the types you allow. It does not connect to your device maker's servers, and this data does not pass through any server of ours. We use it only to show and organize your own health information in the app. We never use it for advertising and never sell it.

Files you import. When you open a health record file in the app, the app reads it on your device and saves the records into your encrypted vault. The file is not uploaded to us. Before adding the records, the app checks that the name and birth date in the file match the records already in your vault. If a file appears to belong to someone else, the app sets it aside instead of mixing it into your records, and you decide what happens next. Your original file stays wherever you keep it; the app does not change or delete it.

7. What We Never Do

• We never sell your data. Not personal information, not health records, not "anonymized" derivatives sold as data products.
• We never share your data with advertisers, data brokers, or analytics companies.
• We never set cookies and never run advertising networks, tracking pixels, or third-party analytics in the app or on this site.
• We never use your identifiable health data to train artificial intelligence models.
• We never condition access to your own data on payment, participation in research, or waiving your rights.

8. Sharing You Direct

Sharing only happens when you initiate it, and every grant is visible and revocable in the app:

• People and apps you choose: if you direct the app to share records with a caregiver, clinician, or another application, we transmit exactly what you selected, to the recipient you selected, and nothing more.
• Research participation: participation in research is off by default. If you opt in to a specific research lease, the named organization receives de-identified data for the stated purpose, under terms shown to you before you accept, as described in our Terms of Service. You can revoke any lease at any time. De-identification lowers the risk of identifying you but does not remove it. Health data can sometimes be re-identified, especially when combined with other information. For that reason we do not keep a standing store of de-identified data, we release only what a specific approved study needs, we prohibit recipients by contract from attempting to re-identify anyone, and we require them to delete the data when the lease ends.
• Service providers: a small number of vendors help us operate the service (for example, hosting infrastructure). They handle only encrypted content or the minimum operational data needed, are bound by contract to use it solely to provide the service to us, and are prohibited from selling it or using it for their own purposes.

9. How We Protect Your Data

• Encryption in transit and at rest, everywhere, with vault contents encrypted end to end under keys you control.
• Privacy by design: data minimization, purpose limitation, and privacy risk assessment before any new data practice, following the principles of the IAPP privacy engineering discipline.
• Access controls and audit logging on every administrative system we operate.
• Our security and compliance program is designed and operated in line with the SOC 2 Trust Services Criteria and the HITRUST CSF control framework. We are not yet certified against these frameworks; independent audits are on our roadmap, and we will update this page as they complete rather than claim them early.

10. HIPAA and Where It Applies

Honest scoping, because this is widely misunderstood:

• Your healthcare providers are covered by HIPAA. Records held in their systems are protected by HIPAA there.
• When you direct a copy of your records into your own vault, that copy is under your control and is generally no longer governed by HIPAA. It is protected instead by this policy, by our contracts with you, and by the consumer health privacy laws described below, several of which are in important ways stronger.
• The Xanadu consumer app is a personal health record service, not a HIPAA covered entity. Where Your Data Health, Inc. separately provides services to HIPAA-covered organizations, we sign business associate agreements and comply with HIPAA in those engagements.

11. If Something Goes Wrong

As a personal health record vendor, we are subject to the FTC Health Breach Notification Rule. If a breach of identifiable health data ever occurs, we will notify you without unreasonable delay and no later than 60 calendar days after we discover it. We will also notify the Federal Trade Commission, and where required the media, within the timelines the rule sets. Under that rule, a breach includes any access or sharing you did not authorize, not only a hack. Because vault contents are encrypted under keys we do not hold, a breach of our infrastructure does not by itself expose your health records; we commit to notifying you honestly about what was and was not affected.

12. Washington Consumer Health Data (My Health My Data Act)

This section serves as our consumer health data privacy policy under Washington's My Health My Data Act (MHMDA) and applies to Washington consumers, alongside similar laws in other states.

Categories of consumer health data

The app handles the health record categories listed in Section 4, solely as directed by you. The website and waitlist collect no consumer health data.

Sources

At your direction: your healthcare providers, Medicare, the apps and devices whose data you allow the app to read through Apple Health or Health Connect, and health record files you import. And you, for anything you record yourself.

Purposes

To provide the service you asked for: retrieving, organizing, securing, and displaying your own health records, and carrying out sharing you explicitly direct. We do not collect, use, or share consumer health data for any other purpose.

Sharing and sale

We do not sell consumer health data, and we do not share it except as you direct (Section 8). No third parties or affiliates receive consumer health data from us for their own purposes.

Your MHMDA rights

You have the right to confirm whether we collect, share, or sell consumer health data about you; to access it, including a list of third parties and affiliates with whom we have shared it; to withdraw consent; and to have it deleted. Exercise any of these by emailing privacy@yourdata.health. We will respond within the statutory timelines. If we decline a request, you may appeal by replying to our decision with the word "appeal," and we will have the appeal reviewed by someone other than the original decision-maker. If your appeal is unsuccessful, you may contact the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.

13. Other Privacy Laws

Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act, other state privacy laws, or the EU/UK General Data Protection Regulation. We honor the strongest applicable version of these rights for everyone rather than gating them by geography: access, correction, deletion, portability, and freedom from discrimination for exercising them, as described in Section 14. For GDPR purposes, Your Data Health, Inc. is the controller for account and waitlist data, and processes health records solely on your instructions; where GDPR applies, our lawful bases are performance of our contract with you and your explicit consent for health data.

14. Your Rights and How to Use Them

Every right below is free, available at any time, and never results in worse treatment:

• Access: ask what we hold about you and get a copy.
• Export: take your data with you in portable, standard formats, including FHIR for clinical records.
• Correction: fix anything that is wrong in the data we hold about you.
• Deletion: delete your account and data, from within the app or by email. We complete deletion within 30 days.
• Withdraw consent: revoke any sharing grant or research lease at any time, effective from that date.
• Authorized agents: you may designate someone to exercise these rights for you; we will verify the designation to protect you.

Send any request to privacy@yourdata.health. We will verify your identity (to protect you, using the minimum information necessary), respond within 30 days or the shorter period a law requires, and explain ourselves plainly if any part of a request cannot be fulfilled. See also Your Rights for a plain-language summary of these commitments.

15. Government and Legal Requests

Our position follows the Electronic Frontier Foundation's guidance on protecting user data:

• We disclose data only when legally compelled by valid process, and only the minimum the process actually requires.
• We challenge requests that are overbroad, improper, or lack valid legal basis.
• We notify you of any request for your data before complying, unless a court order legally prohibits notice, in which case we notify you as soon as the prohibition lifts.
• Because vault contents are encrypted under keys you control, in most cases we are technically incapable of producing readable health records, and we will say exactly that to any requester.

16. Children

The service is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact privacy@yourdata.health and we will delete it.

17. Retention and Deletion

Waitlist data is kept until launch outreach completes or you ask us to delete it, whichever comes first. Account data is kept while your account is active. When you delete your account, we delete your data within 30 days, and any active sharing grants and research leases terminate immediately. Encrypted vault contents you stored in your own designated storage are yours and remain wherever you put them.

When you end a connection. If you disconnect a healthcare provider or Medicare, revoke our access through that source, or turn off the app's access in Apple Health or Health Connect, the app stops retrieving new records from it immediately. Records already retrieved stay in your vault, under your control, until you delete them. We keep no separate copy of them to delete, because they were never readable to us.

Inactive accounts. We do not close accounts or delete your data because you have stopped using the app. An unused connection to a provider or to Medicare simply lapses on that source's own schedule, and you can reconnect at any time. If we ever decide to close inactive accounts, that is a material change under Section 19: we will give at least 30 days' notice first and a chance to export everything.

18. If Our Company Changes Hands

If Your Data Health, Inc. is acquired, merges with another company, sells substantially all of its assets, or goes through bankruptcy or dissolution, the following applies:

• This policy goes with your data. Any successor must honor this policy for data collected under it, including the promises in Section 7. Your data is never sold on its own as an asset.
• You will be told first. We will notify you in the app, and by email if we have your email address, at least 30 days before any of your information is transferred, and tell you who the new company is.
• You can leave before it happens. Before any transfer you can export everything and delete your account, free, as described in Section 14.
• Your vault stays yours. Your health records are encrypted under keys you hold. A new owner would receive only what we can access. We cannot read your vault, so a new owner would receive no readable copy of your health records either.
• Any change to these terms is a material change under Section 19, with the same notice.

19. Changes to This Policy

We will give at least 30 days' notice before material changes take effect, by a notice in the app and on this page, and by email if we have your email address. The version number and date at the top of this page always show when it last changed, and the version history at the end lists every change. We will never use a policy change to retroactively claim rights over data collected under an earlier promise.

20. Contact

Privacy questions and rights requests: privacy@yourdata.health
Legal: legal@yourdata.health
Your Data Health, Inc., a Delaware corporation operating in Washington State.

Version History

Every change to this policy is listed here, newest first, so you can see what changed and when.

• Version 0.2, September 16, 2026 (pre-launch draft). Added Medicare as a source and explained how the Medicare sign-in server works and what it never stores. Added wearable and fitness data from Apple Health and Health Connect, and health record files you import. Explained why providers use SMART on FHIR and how often the app reads your sources. Added the risk that de-identified data can be re-identified. Added what happens when you end a connection, to inactive accounts, and if our company changes hands. Stated the 60-day limit for breach notice. Clarified that notices go by email only when we have your email address. Sections renumbered from 19 to 20.
• Version 0.1, August 8, 2026 (pre-launch draft). First full privacy policy covering this website, the waitlist, and the Xanadu app.

Pre-launch draft, version 0.2 · last updated September 16, 2026 · Your Data Health, Inc. · Terms of Service · Your Data Rights