Privacy Policy

Information We Collect

We collect information necessary to provide our services, including:

• Account Information: Name, email, and authentication credentials.

• Health Data: Medical documents, biomarker readings, timeline events, and self-reported symptoms.

• Usage Data: Interactions with the platform, AI assistant queries, and caregivers activities (logged for audit purposes).

• Device Data: Technical information such as browser type and device identifiers for security and analytics.

How We Use Your Information

We use your data to:

• Provide Core Services: Storing documents, generating health timelines, and facilitating care team messaging.

• Optional AI Processing: When a feature and its deployment controls are enabled, data may be sent to the processors identified in the applicable notice. Review the feature notice before use.

• Improve Services: We use operational telemetry that is designed to exclude health-record content. Health records are not authorized for research or model improvement without a separate opt-in.

• Legal and Security Operations: Meeting applicable obligations and maintaining supported security audit records.

Legal Basis & Consent

We process your personal information to provide the Service, to comply with legal obligations, and with your consent where required. Health data is processed only with your explicit consent or as otherwise permitted by applicable law.

You may withdraw consent at any time through your account settings or by contacting us, but this may limit your ability to use certain features.

Our processing of personal data is also subject to the Singapore Personal Data Protection Act 2012 (PDPA), which sets out obligations for the collection, use, and disclosure of personal data.

Data Sharing & Disclosures

We strictly limit data sharing to:

• Your Care Team: Information is shared only with the specific Caregivers and clinicians you explicitly invite and authorize.

• Service Providers: We use third-party processors such as Cloudflare, Google, and Stripe for disclosed purposes. The operator of each deployment must verify the applicable contracts, regions, retention settings, and any required business-associate agreement before handling regulated health data.

• Legal Requirements: We may disclose information if required by law or to protect the safety of our users.

• Optional Research Data: Research disclosure requires a separate campaign-specific opt-in and an approved release process. De-identification reduces but does not eliminate privacy risk.

We strictly do NOT sell your personal health information or share it for marketing purposes.

Data Retention & Deletion

We retain your personal and health data for as long as needed to provide the Service and to meet legal and regulatory requirements. Retention periods vary based on the type of data and your jurisdiction.

When you delete your account, we will delete or de-identify your data within a reasonable time, except where we must retain it for legal, security, or audit purposes.

International Transfers

Polaris is hosted on global infrastructure. If you use the Service from outside the country where our servers are located, your data may be transferred to and processed in other countries.

We use appropriate safeguards for such transfers as required by applicable law (for example, standard contractual clauses for EEA/UK users).

Data Security

Polaris includes layered security controls that must be validated for each deployment:

• Encryption: TLS protects data in transit. Application-level AES-GCM currently protects selected caches and secrets; other stored data relies on configured infrastructure protections.

• Access Control: Role-based access controls ensure only authorized users can access specific data.

• Infrastructure: The platform uses edge infrastructure and logical isolation controls. Infrastructure capability alone does not establish regulatory compliance.

Children's Privacy

Polaris is not directed to children under 13 (or another age threshold under local law) and we do not knowingly collect their personal data without parental consent.

If you believe a child has provided us data without appropriate consent, contact us so we can take appropriate action.

Your Rights & Choices

You have the right to:

• Access and export your health data.

• Update or correct your personal information.

• Revoke access for Caregivers at any time.

• Delete your account and associated data, subject to retention required by law.

• Request restriction or objection to certain processing, and data portability, where provided by local law.

• Lodge a complaint with your local data protection authority, where applicable.

Depending on your jurisdiction, you may have additional rights under local data protection laws, such as the right to erasure, data portability, restriction of processing, or objection to automated decision-making.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version in Polaris and update any effective date if included. If a change materially affects your rights, we will provide notice as required by law.

Contact Us

For privacy-related inquiries or to exercise your data rights, please contact our Privacy Officer at support@polaris.dpath.ai.