Consumer Health Data Privacy Policy

This policy supplements the sahmo Privacy Policy for consumer health data protected by applicable US laws, including Washington’s My Health My Data Act and Nevada’s consumer health data law.

Who is responsible

ailloy labs GmbH, Feuerbachstraße 3, 65195 Wiesbaden, Germany. Contact: info@ailloy.io.

Data we collect and its sources

Depending on what is said, recordings, transcripts and analyses may contain information about physical or mental health, conditions, treatments, medication, reproductive or sexual health, or health-related services. This includes information derived from them, the user identifiers linked to them and, where protected by law as health data, the temporary voice characteristics used for speaker separation.

Sources are you, other users who record or upload a conversation or voice message in which you speak or are mentioned, and the automated processing of these recordings.

How we use the data

We use the data to provide the features requested: transcription, speaker separation, analysis, storage and display in the app. We also use necessary information to operate and secure the service. Additional content quality assurance requires a separate consent covering that purpose; details are set out in section 5 of our Privacy Policy.

We do not use the content of recordings, transcripts or analyses for advertising. The limited, optional marketing measurement is described under “Advertising” below. We do not use your health data to train AI models, and our transcription and AI providers may not use it to train theirs.

Who receives the data

Relevant data is processed by the service providers identified in section 7.1 of our Privacy Policy: hosting and database providers, AssemblyAI for transcription and speaker separation, and Anthropic Ireland, Limited, Google or OpenAI Ireland Ltd. for the analyses. Each provider receives the data needed for its role and acts under our contractual instructions. Our error diagnosis provider receives no recording content.

The recording and its results are accessible to the user who recorded or uploaded it. This may be someone other than you.

We may make other disclosures where expressly required or permitted by applicable law. We do not share consumer health data with affiliates for their own purposes.

Advertising

Marketing measurement is off by default. Only if a user agrees in the app, on Android via an optional checkbox and on iOS via the tracking prompt, does Adjust share that user’s install and three usage events (“first recording submitted”, “first analysis viewed” and “account created”) with Meta and TikTok, together with pseudonymous device identifiers. These identifiers may allow the platforms to recognise the device across apps. The events show that the app was used, not what was said. We do not share recordings, transcripts, analyses, email addresses, purchases or amounts.

The user can turn marketing measurement off at any time: on Android with a user account in the app’s account settings, on iOS in the iOS settings under Tracking. This stops future sharing and also serves as the opt-out where this disclosure is considered a sale or sharing under applicable law.

We do not determine which state a user is in; once a user agrees, marketing measurement works the same in every state. We do not use geofencing around healthcare facilities.

Consent and your choices

Before the first recording or upload, the app asks the user for explicit consent to the processing of their own sensitive information, in a separate step when the app is first opened. Disclosures to service providers that are needed to provide the requested features are limited to that purpose. Where separate consent to sharing is required, we obtain it separately.

A user’s consent does not replace yours. If you speak or are mentioned in someone else’s recording, sensitive information about you may only be uploaded with your own explicit consent. Section 6.5 of our Privacy Policy and our Notice for other people in recordings explain this.

You may withdraw consent by contacting info@ailloy.io. Content that requires this consent will then not be processed further. We retain existing data only where a lawful basis remains. Withdrawing consent or deleting an account does not automatically cancel an app-store subscription.

Your rights

Contact info@ailloy.io to request confirmation of processing, access, correction, a portable copy, deletion, withdrawal of consent or cessation of processing where applicable. You may also request a list of recipients with whom your consumer health data was shared and their contact details. You do not need an account; an authorised representative may act where permitted by law. We may request proportionate information to authenticate the request.

We normally respond within one month and without charge. We explain any legally permitted extension or exception. We do not unlawfully discriminate against you for exercising your rights.

To appeal a full or partial refusal of your request, reply to our decision with the subject “Appeal”. We will respond in writing within one month of receiving your appeal, explaining our decision and any action taken. If we deny your appeal, we will also provide the relevant complaint route to your state’s Attorney General. You can submit a complaint using the following links: Washington Attorney General, Nevada Attorney General or Connecticut Attorney General. If another state’s law applies, we will provide the appropriate contact details.

Retention, security and changes

Section 8 of our Privacy Policy explains retention and deletion, and section 8.1 the temporary voice characteristics. Where deletion is required, we address relevant copies and notify recipients as required by law. Access is restricted to people and providers who need it for authorised purposes.

We will notify you of material changes and obtain new consent where required before introducing additional categories, purposes or disclosures. The date of the current version appears above.