Privacy Policy

1. Scope

This Policy covers personal information Uriym handles when you use the Services or communicate with us, including through the patient application and website assistant. It does not govern information you provide directly to an independent clinic, healthcare provider, travel provider, or other third party under that party’s own privacy practices. Where applicable, our Consumer Health Data Privacy Policy and the consents presented during intake or sharing provide additional information about health data.

2. Information We Collect

The information we collect depends on how you use the Services:

• Contact and inquiry information: name, email, optional phone number, treatment interests, preferred destination and timing, messages, and communications preferences.
• Patient care information: requested procedures, health conditions, medications, prior surgeries, height and weight, dental, skin or fertility history, treatment goals, preferences, budget, home location, travel companions, and other information submitted in a care request.
• Photos, videos, and documents: Medical records, photographs, videos, and other files you choose to upload to support a care request. With your authorization, photographs and videos may be shared with clinics you approve during initial request review to evaluate treatment suitability and prepare quotes. Other uploaded medical records and documents are shared with your selected clinic only with separate authorization.
• Coordination information: clinic options and selections, appointment and travel dates, quotes, accepted prices, itineraries, messages, and aftercare communications. Uriym has not selected a payment processor and does not currently collect payment-card information.
• Clinic and business information: names, work contact details, staff roles, profile photographs, practice information, services, pricing, clinic photographs, and correspondence submitted by participating clinics.
• Clinic-submitted patient images: before-and-after photographs, testimonials, and related materials that participating clinics submit for display with the required permissions. These materials are separate from private photographs patients upload as part of their own care requests.
• Technical information: IP addresses in security logs, sign-in information, device or browser information needed to operate the Services, and limited website analytics if you allow them.
• Information from others: scheduling, pricing, treatment-coordination, or other relevant information from clinics, service providers, travel partners, or people involved in your requested arrangements.

The website assistant receives questions you type, which may include health-related information. Uriym removes certain direct identifiers before sending questions to its AI provider, but that process may not remove every identifying or sensitive detail. Do not enter medical records, account credentials, or other information you do not want processed by the assistant.

3. How We Use Personal Information

• Respond to inquiries, create and manage care requests, and provide patient support.
• Understand treatment interests and relevant health information to identify and coordinate requested care options.
• Present clinic options, facilitate patient-authorized communications with clinics, and coordinate appointments, travel, and aftercare logistics.
• Manage quotes, booking records, and service communications.
• Operate the website assistant, maintain and improve the Services, and monitor reliability and security.
• Keep records of consent and transactions, respond to privacy requests, comply with law, and protect the rights and safety of users and Uriym.

Uriym provides navigation and coordination services, not medical care. Independent healthcare providers make clinical decisions, evaluate treatment eligibility, obtain medical informed consent, and provide treatment.

4. Health Information and Patient Authorization

We collect health-related information to understand and coordinate the services you request. This can include conditions, medications, past procedures, treatment goals, and photographs or records you choose to provide. Health information may be sensitive under applicable privacy laws.

We share patient information with clinics only after you authorize the clinic or clinics. After you approve clinics to review your request, they may receive a limited summary of your treatment goals, timing, relevant conditions, medications, and prior surgeries, without your name, contact details, or budget. With your authorization, approved clinics may also receive photographs and videos to evaluate treatment suitability and prepare quotes. These materials may contain identifying features.

We provide instructions intended to limit identifying information in photographs and videos submitted for initial clinic review. Depending on the requested procedure, these instructions may include avoiding faces, identifying features, or unnecessary personal details. We ask patients to review their materials and follow these instructions before uploading them. We also use safeguards designed to limit unnecessary disclosures, although photographs and videos may still contain identifying information.

If you select a clinic and authorize the next step, we may provide your name, contact information, and travel dates to that clinic only. Other uploaded medical records and documents may be shared with your selected clinic through the portal only with separate authorization. Clinics may request additional information or documents through Uriym, but a request does not itself authorize disclosure. These disclosures are made to clinics in Mexico when applicable.

You may withdraw authorization for future sharing by contacting us. Withdrawal does not undo disclosures already made to independent clinics. We present choices for collecting and sharing health information, including separate authorization for clinic sharing where required. Our Consumer Health Data Privacy Policy provides additional disclosures and explains applicable health-data rights.

5. AI-Assisted Features

Our website offers an AI assistant powered by OpenAI. When you enter a question, we filter certain direct identifiers before sending the text to OpenAI for a response. Filtering may not remove all personal or health information. The assistant does not access patient application records, photographs, or documents. Uriym does not store assistant conversations or use them to train its own AI models. OpenAI processes submitted questions to generate responses. Do not submit medical records or information you do not want processed through this feature.

AI responses may be inaccurate and are not medical advice or decisions about your treatment eligibility. Uriym staff and independent clinics make coordination and clinical decisions, respectively.

6. How We Share Personal Information

We disclose personal information only as needed for the purposes described in this Policy, including to:

• Patient-authorized clinics and healthcare providers: the categories and stages described in Section 4. Participating clinics may be located in Mexico.
• Service providers: Amazon Web Services for hosting and storage; Google Workspace and Resend for communications; OpenAI for the website assistant; and PostHog for consent-based website analytics.
• Travel and logistics providers: information reasonably necessary for arrangements you request, when applicable.
• Legal, safety, and business recipients: authorities or advisers when legally required or reasonably necessary to protect rights or safety; and parties to a business transaction, subject to applicable law.
• Other recipients: parties you direct us to contact or otherwise authorize.

Uriym does not sell personal information or share it for cross-context behavioral advertising. We do not use advertising pixels or retargeting tools. Information may be processed in the United States and transferred to clinics in Mexico when you authorize clinic coordination. Other international transfers, if any, will be handled as required by applicable law.

7. Communications and Marketing

We may contact you by email, text, or phone about inquiries, care requests, scheduling, and requested services. Marketing messages are optional and are not a condition of receiving services. You may unsubscribe from marketing emails through the message link or privacy@uriym.com and opt out of marketing texts by replying STOP (HELP for assistance). Service-related messages may continue. Message and data rates may apply.

8. Cookies, Analytics, and Privacy Choices

The public website uses browser storage to remember language and analytics preferences. According to our current implementation, it does not use cookies for website analytics. PostHog analytics run only if you select “Allow”; they receive page visits and limited events, not names, contact details, typed text, or health information. You can change your selection through “Privacy choices” on the website.

The patient application, staff workspace, and clinic portal use sign-in cookies lasting up to eight hours; an optional trusted-browser cookie lasts up to 30 days. Uriym does not use advertising cookies or cross-site advertising trackers. We do not currently respond differently to browser Do Not Track signals. To our knowledge, third parties do not collect information about your online activities over time and across other websites or services through Uriym’s Services.

9. Security

We use administrative and technical safeguards designed to protect personal information, including encrypted connections and storage, restricted access, two-step verification for staff and clinics, and access logging. No system is completely secure. If you believe your information or account has been compromised, contact privacy@uriym.com.

10. Retention and Deletion

We retain information according to its purpose, sensitivity, and applicable legal requirements. Current practices include:

• Unconfirmed care requests are automatically deleted after 30 days.
• Patient photographs and uploaded documents, including files associated with confirmed care requests, are retained until deletion or for no more than three years, unless a longer period is required by law or for legal preservation.
• Technical logs containing IP addresses are generally kept for 14 days.
• Routine backups are kept for seven days; deleted information may remain in backup copies for approximately 15 days.
• Confirmed patient records, messages, website inquiries, and related correspondence are retained as needed to provide requested services, respond to inquiries, and meet applicable legal and recordkeeping obligations. You may request deletion as described in Section 11.

We may retain limited information when reasonably necessary to comply with law, maintain transaction or consent records, prevent fraud, or resolve disputes. Information already disclosed to an independent clinic is subject to that clinic’s practices and applicable law.

11. Your Rights and Choices

All users may contact privacy@uriym.com to request access to, a copy of, correction of, or deletion of personal information Uriym holds, to ask about disclosures of their information, or to withdraw consent where applicable. You may request deletion of uploaded photos and documents and change your website analytics preference through “Privacy choices.”

You may request review or changes by emailing privacy@uriym.com; we will verify your identity when necessary before acting on a request. We do not discriminate against you for exercising privacy rights. We may retain information where permitted or required by law. Withdrawing authorization or deleting information may prevent us from providing requested coordination services. We also honor any additional rights, appeal procedures, and response deadlines required by applicable law.

12. Children’s Privacy

The Services are intended for adults aged 18 or older. We do not knowingly collect personal information from children under 18 through the Services. If you believe a child provided information, contact privacy@uriym.com.

13. Independent Third-Party Services

Independent clinics, travel providers, and other third parties may collect information directly from you under their own privacy policies. Our service providers are identified in Section 6.

14. Changes to This Policy

We may update this Policy as our Services, practices, or legal obligations change. We will post the updated version and effective date. For material changes, we will notify registered users by email or another direct communication where available, and provide additional notice or obtain consent when required by law.

15. Contact Us

Email: privacy@uriym.com

Uriym, Inc. | Attn: Privacy | 11040 Bollinger Canyon Road, STE E181, San Ramon, CA 94582, USA