Privacy Policy

A. Who we are

Areluno Health LLC is a California limited liability company operating from California, United States.

Areluno Health LLC

California, United States

Privacy questions can be sent to privacy@arelunohealth.com. Security concerns can be sent to security@arelunohealth.com.

B. Scope

This Privacy Policy applies to:

• arelunohealth.com
• Areluno mobile applications
• Areluno Provider experiences
• support and contact services
• reports, consent, and sharing services
• account and deletion services

Separate agreements and notices may apply to enterprise or organization customers depending on the service and relationship.

C. Information we collect

Depending on the service used, we may collect the following categories:

• account and identity information
• contact information
• profile information
• patient-entered health information
• symptoms and daily entries
• medication information
• appointment information
• reports and exports
• photos, videos, and metadata
• provider relationships and consent choices
• organization and provider information
• support and website communications
• device and diagnostic information
• security and audit information
• offline and synchronization information
• deletion and privacy requests

D. Sources of information

Information may come from:

• you directly
• an authorized provider or organization
• your device while you use the service
• service providers acting for Areluno
• system-generated security and audit records

E. How we use information

We use information to:

• provide and operate Areluno services
• authenticate users
• maintain health records and timelines
• generate reports and exports
• enable user-authorized sharing
• deliver support
• secure the service and prevent abuse or fraud
• comply with law
• improve reliability and accessibility
• communicate about the service

Areluno does not currently sell personal information or personal health information. Areluno does not use personal health information for targeted advertising.

F. Disclosure of information

We may disclose information only as needed for the service and legal obligations, including:

• providers and organizations authorized by the patient or otherwise legally permitted
• infrastructure and service providers under contractual restrictions
• legal authorities where required
• parties in a merger, financing, acquisition, or other corporate transaction with appropriate protections
• others when you direct us to share or when you provide consent

We do not permit provider access to patient information without patient-authorized access or another valid legal basis.

G. Service providers and infrastructure

Areluno may use providers in categories such as:

• hosting and deployment
• cloud database and storage
• authentication
• email delivery
• domain and network services
• business email

Current public-website stack confirms use of Vercel hosting and Resend email delivery for contact handling. Vendor usage may change over time.

H. Data retention and deletion

Information is retained while your account is active and as needed to provide the service. Deletion requests are processed according to the product workflow.

Some limited records may be retained for security, legal compliance, fraud prevention, backup, dispute resolution, or enforcement purposes. Areluno does not guarantee that deletion can erase information already lawfully received, downloaded, retained, or independently maintained by another party.

I. Security

Areluno uses administrative, technical, and organizational safeguards designed to protect information.

No system can guarantee absolute security.

Report suspected security issues to security@arelunohealth.com.

J. Security incidents and required notifications

Areluno will provide notices required by applicable law if a qualifying incident occurs. Consumer health applications may also be subject to federal health-data breach-notification requirements even when HIPAA does not apply.

Please report suspected unauthorized access to security@arelunohealth.com.

K. User choices and rights

Depending on your jurisdiction and the service used, you may request:

• access to information
• correction of information
• deletion of information
• consent management
• provider-access reduction or revocation
• communication preference changes

Rights may vary by jurisdiction and exceptions may apply.

L. Children

Areluno is not intended for children under 13, and users under the age of majority should use Areluno only with the involvement of a parent, guardian, or other legally authorized adult, subject to applicable law.

M. Changes to this policy

We may update this policy as services and obligations evolve. Material changes will be posted and, when appropriate, users will be notified.

HIPAA and services provided to healthcare organizations

HIPAA does not apply to every health application or every type of health information. Whether HIPAA applies to Areluno depends on the service involved and Areluno's relationship with a healthcare organization.

When a person uses Areluno independently as a consumer service, Areluno may not be acting as a HIPAA covered entity or business associate solely because the user enters health information.

If Areluno provides services to a hospital, clinic, health plan, or other HIPAA covered entity and creates, receives, maintains, or transmits protected health information on that entity's behalf, Areluno may act as a business associate for that specific service. In that situation, the applicable organization and Areluno will enter into the agreements required for that relationship, including a Business Associate Agreement where legally required.

HIPAA-regulated enterprise services may be subject to additional privacy, security, retention, access, and incident-response requirements described in separate agreements or notices.

Consumer services and HIPAA-regulated enterprise services may have different privacy notices, contractual terms, retention rules, and operational controls.

Nothing in this Privacy Policy should be interpreted as representing that all Areluno services are subject to HIPAA.

California privacy rights

California law may provide additional protections for medical and health information maintained by certain health applications and services. Applicability can vary by service and relationship.

Areluno offers California request pathways for access, correction, deletion, disclosure information where applicable, consent withdrawal, and complaints via privacy@arelunohealth.com.

California Consumer Privacy Act and CPRA options

Areluno provides California privacy request options whether or not every statutory threshold currently applies, including requests for access, correction, deletion, information about disclosures, and non-discrimination for exercising privacy choices.

If Areluno later engages in conduct legally treated as sale or sharing, Areluno will provide an opt-out method required by law.

Areluno does not currently sell personal information or personal health information.

Areluno does not share personal information for cross-context behavioral advertising.

Contact channels

• Privacy: privacy@arelunohealth.com
• Legal: legal@arelunohealth.com
• Security: security@arelunohealth.com
• Support: support@arelunohealth.com
• General: hello@arelunohealth.com