Consumer Health Data Privacy Policy (draft)
This is a separate, standalone policy about consumer health data specifically, required by Washington State's My Health My Data Act (RCW 19.373) — it does not replace the general Privacy Policy, and the general Privacy Policy does not replace this one. Draft, pending legal review, describing current practice honestly rather than final binding terms.
What consumer health data Aro collects
Medication names, dosages and schedules; confirmations of doses taken; summaries and transcripts of phone calls with the voice companion; fall and SOS safety events, including a location fix only at the moment such an event fires; and, once pendant hardware exists, movement, heart rate and sleep readings from it. Until then, those readings are drawn from published research recordings, clearly labelled as such rather than as this household's own data.
Why Aro collects it
Solely to run the product for your own family circle — showing your family what it needs to know, placing companion calls, and raising an alert when something needs attention. Not for advertising, not for building a profile to sell, and not for any purpose outside your own circle.
Where it comes from
Directly from your household: what a caregiver enters in the app, and what the senior says on a companion call. Nothing is purchased or collected from third-party data brokers.
Who else can see it
A small number of infrastructure providers process this data only to operate Aro — authentication (Clerk), database hosting (Neon), telephony (Twilio), and AI providers for the voice companion (Anthropic, and ElevenLabs or AssemblyAI where configured). None of them may use it for their own purposes. It is never sold, and never shared for advertising.
Your rights, and an honest gap
You can ask us, at hello@arohealth.net, what data Aro holds about your family, or to delete it. Told plainly rather than glossed over: Aro does not yet have a self-service in-app deletion flow — see docs/security.md's known gaps in the codebase this page is generated from — so a deletion request today is handled by hand rather than by a button. Building the self-service flow is planned before this handles data at a larger scale.
Consent
Creating a family circle and adding a senior's information is how consent to this policy is given. Nothing here is collected passively or without your household's own action.