Consumer Health Data Privacy Policy

1. Consumer Health Data We Collect

Depending on your interaction with Uriym, we collect information indicating that you are seeking healthcare; treatment interests and goals; health conditions, diagnoses, medications, prior surgeries, symptoms, height and weight, dental, skin and fertility history, and care preferences; medical records, photographs, videos, and documents you upload; and health details included in messages or questions to our website assistant. We do not collect every category from every person.

2. Sources and Uses

We collect health data directly from you through inquiries, the patient application, uploads, messages, and the website assistant. We may also receive health-related information from your communications and care coordination records. We may receive relevant information from clinics you authorize to coordinate with us. We use this information to understand your request, present clinic options, facilitate patient-authorized clinic review, coordinate appointments and travel, support follow-up communications, maintain consent and service records, protect the Services, and comply with law. We do not sell consumer health data or use it for targeted advertising.

3. Consent and Sharing With Clinics

Where required, we obtain consent before collecting consumer health data and separate consent before sharing it. Consent requests identify the relevant data categories, purposes, recipients where applicable, and how to withdraw consent.

After you approve clinics to review your request, they may receive a limited summary of your treatment goals, timing, relevant conditions, medications, and prior surgeries, without your name, contact information, or budget. With your authorization, approved clinics may also receive photographs and videos to evaluate treatment suitability and prepare quotes. These materials may contain identifying features.

We instruct patients to limit identifying information in photographs and videos submitted for initial review and to follow the applicable upload requirements. Uriym uses safeguards designed to limit unnecessary disclosures, but submitted materials may contain identifying features even when patients follow these instructions.

After you select a clinic and authorize the next step, we may share your name, contact details, and travel dates with that clinic. Other uploaded medical records and documents may be shared with your selected clinic through the Uriym portal only with separate authorization. A clinic may request additional records or documents through Uriym, but a request alone does not authorize us to share them. Participating clinics may be in Mexico. You may withdraw consent for future collection or sharing by contacting us; withdrawal does not reverse a prior disclosure to an independent clinic.

4. Other Disclosures and Processing

We use Amazon Web Services to store and host data, and Google Workspace and Resend to handle communications, which may contain health information. OpenAI processes questions submitted to the website assistant after certain direct identifiers are filtered; health details may remain in those questions. The assistant does not access patient application records, photographs, or uploaded documents. PostHog receives limited website analytics only after a visitor allows analytics; Uriym does not intentionally send it health details or typed responses.

We may disclose information to travel or logistics providers only as needed for requested arrangements, or to legal and safety recipients as permitted by law. The categories of consumer health data disclosed depend on the recipient and purpose. Clinics approved for initial review may receive limited summaries of treatment goals, timing, relevant conditions, medications, and prior surgeries, without names, contact information, or budgets. With patient authorization, they may also receive photographs and videos, which may contain identifying features. Selected clinics may receive identifying and coordination information after patient authorization and, with separate authorization, other uploaded medical records and documents through the portal. Infrastructure, hosting, AI, and communications service providers process information necessary to support their services as described above. Other recipients may receive information necessary for requested travel or logistics arrangements or disclosures permitted by law. We do not currently disclose consumer health data to affiliates. We do not use advertising networks or third-party cross-site health tracking. To our knowledge, third parties do not collect consumer health data over time and across other websites or online services when you use Uriym’s Services.

5. Your Rights and Requests

You may request confirmation of whether Uriym collects, shares, or sells your consumer health data; access to the data; information about third parties and affiliates with whom it was shared or sold, including available contact information; withdrawal of consent; and deletion, subject to applicable law. Nevada consumers may also request that Uriym cease collecting, sharing, or selling their consumer health data, subject to statutory exceptions. You may also request correction or review of your information. Send requests to privacy@uriym.com. We may verify your identity. For requests covered by Washington law, we respond within 45 days, with one additional 45-day extension when permitted and communicated within the initial period. For requests covered by Nevada law, we respond without undue delay and within 45 days after authenticating the request, with an additional 45 days where permitted and timely explained. If we deny a request, we will explain the reason and any available appeal process. To appeal, email privacy@uriym.com with “Appeal” in the subject line. For Washington appeals, we respond in writing within 45 days. If we deny the appeal, we provide a way to contact the Washington Attorney General at atg.wa.gov. Uriym also offers access, correction, deletion, and consent-withdrawal requests to users regardless of residence.

6. Security and Retention

We use encryption, restricted access, two-step verification, and logging to protect consumer health data. Unconfirmed care requests are deleted after 30 days. Uploaded photographs and documents, including files associated with confirmed care requests, are retained until deletion or for no more than three years, unless a longer period is required by law or for legal preservation. Confirmed case information is retained as needed for services and lawful recordkeeping.

Routine backups are kept seven days, with deleted data generally purged from backup copies within approximately 15 days. We handle deletion requests and downstream notices as required by applicable law.

7. Changes and Contact

We post changes with a new effective date and notify affected consumers of material changes by email or another direct communication where available. We provide additional notice or obtain consent when required. We do not collect, use, or share new categories of consumer health data or use them for new purposes without the disclosures and consent required by law. Contact privacy@uriym.com or Uriym, Inc., Attn: Privacy, 11040 Bollinger Canyon Road, STE E181, San Ramon, CA 94582, USA. General Privacy Policy: https://uriym.com/privacy.