Fluent Wellness

Fluent Wellness, LLC ("Fluent", "we", "us", or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use, share, and protect it, and the choices and rights you have. It applies to the Fluent Wellness web application at app.fluentwellness.com, the Fluent Wellness iPhone application, the website at www.fluentwellness.com, and all related services (together, the "Services"). Fluent Wellness, LLC, 999 Corporate Dr, Ste 100, Ladera Ranch, CA 92694, United States, is the entity responsible for your information.

By using the Services you acknowledge that you have read this Privacy Policy. This Policy is part of, and uses terms defined in, our Customer Agreement.

At a Glance

Health information is sensitive, and we treat it that way. We collect it only when you choose to share it, we use it only to provide the Services to you, we never use it for advertising, and we never sell it.
You are in control. You decide what to share, you can delete any document, result, goal, or conversation at any time, and you can delete your whole account from within the Services.
AI processing stays inside our environment. AI models run inside our own cloud environment in the United States. The AI provider does not store your prompts, does not use them to train models, and does not share them with anyone.
Apple Health is read-only and opt-in. The iPhone app reads from the Health app only when you tap Import, only the types you approve, and only saves what you confirm.
No advertising, no tracking, no selling. We do not run advertising, do not use third-party advertising or tracking technologies, and do not sell or share your personal information for advertising.

1. Information We Collect

We collect the following categories of information. We collect it directly from you, automatically when you use the Services, and from the third parties described below.

Information you provide

Account information. Your name and email address, and the identifier assigned to you by our sign-in provider. If you sign in with a third-party account such as Apple or Google, we receive the name and email address (which may be a relay address) that the provider shares with us.
Profile and health information. Information you choose to enter in the Services, such as your age or date of birth, biological sex, height, weight, body type, the foods you typically eat, your fitness activities, medications, supplements, and goals, along with notes you add.
Documents you upload. Lab reports and other health documents, as PDF, JPG, or PNG files, and the structured versions we create from them (see Section 3).
Lab results. Individual results stored as structured records, including test names, values, units, reference ranges, collection dates, and issuing providers, whether created from your uploads or imported from Apple Health.
Information from Apple Health. If you choose to import it in the iPhone app: your date of birth, biological sex, height, and weight, and the lab results your providers have shared with the Health app. See Section 4.
Conversations and AI interactions. The messages you send to your health guide, the responses generated, and the insights, suggestions, and goal drafts generated for you.
Communications. Messages you send us, such as support requests, feedback, and website requests to be notified about a launch, and our records of those communications.
Payment information. If you subscribe on the web, our payment processor collects your payment card details and billing address; we receive a token, the last four digits of the card, the card brand, and your subscription status, but not full card numbers. If you subscribe in the iPhone app, Apple processes the payment and shares your subscription status and transaction identifiers with us, not your payment details.

Information collected automatically

Usage information. Actions you take in the Services, such as uploads, imports, goal changes, and AI requests, and metering of your AI usage against your plan allowances.
Device and technical information. IP address, browser type and version, operating system, device type, app version, language, time zone, referring pages, and similar technical data sent by your browser or device, including in server logs.
Cookies and similar technologies. See Section 6.

Information from third parties

Sign-in provider. Our identity provider confirms your identity and tells us whether your email address is verified.
Payment providers. Our payment processor and Apple tell us about the status of your subscription, renewals, cancellations, and refunds.
Apple Health. As described in Section 4, only when you choose to import.

We do not knowingly collect Social Security numbers, government identifiers, precise geolocation, biometric identifiers, or financial account numbers, and we ask that you do not enter them into the Services.

2. How We Use Information

We use information for the following purposes:

To provide the Services. To create and maintain your account, store and display your content, transcribe and structure the documents you upload, import what you choose from Apple Health, and show your results and trends.
To personalize the Services. To generate insights, suggestions, chat responses, and goal drafts tailored to what you have shared, using the AI processing described in Section 3.
To bill you. To manage plans, subscriptions, trials, renewals, and entitlements.
To support you. To respond to your requests and communicate with you about your account, security, billing, and changes to the Services or our terms.
To secure and operate the Services. To authenticate you, prevent fraud and abuse, enforce usage allowances and rate limits, debug problems, and protect the rights, safety, and property of Fluent, our users, and others.
To improve the Services. To understand how the Services are used in aggregate and to develop and improve features. We do not use your health information or your content to train artificial intelligence models, and we do not use information from Apple Health for any purpose other than providing the Services to you.
To comply with law. To meet legal, regulatory, tax, and accounting obligations and to respond to lawful requests.
With your consent. For any other purpose we describe to you at the time of collection, with your consent.

We do not use your information for advertising or marketing to you based on your health information, we do not use it to build profiles for advertising, and we do not make decisions about you that produce legal or similarly significant effects solely by automated means.

3. AI Processing

To provide personalized features, we send relevant information, including content you have shared, your profile, your goals, your conversation history, and your lab results, to Amazon Bedrock, an artificial intelligence service operated by Amazon Web Services, Inc. ("AWS"). Amazon Bedrock runs AI models, including models developed by third parties, on our behalf inside our own AWS environment in the United States to generate responses, summaries, insights, transcriptions, and other output.

Under AWS's terms for this service, AWS does not store or log the prompts we send or the responses the models return, does not use them to train or improve any model, and does not share them with third parties, including the companies that develop the models. We do not use your information to train AI models either. AI output is informational only and may be inaccurate; see the Customer Agreement.

4. Apple Health (iPhone app)

The Fluent Wellness iPhone app can import information from the Health app on your iPhone using Apple's HealthKit framework. This is optional, and it happens only when you tap "Import from Apple Health" in My Data or in Lab Tests.

What we read. From HealthKit: your date of birth, biological sex, height, and weight. From Health Records, where your providers share clinical records with the Health app: your lab results, including test names, values, units, reference ranges, collection dates, and the provider or laboratory name. We request only these types.
Your permission, type by type. Apple asks you to approve each data type separately, and you can change or revoke access at any time in the Health app under Sharing, then Apps and Services. The app is read-only: it never writes to the Health app.
Review before anything is saved. Imported values are shown to you first, and only what you confirm is saved to your Fluent account. Nothing read from the Health app is cached, logged, or stored on your device, and it is never stored in iCloud by Fluent.
How we use it. Once saved, imported information is stored and processed like the other health information you share: on our servers in the United States (Section 5), encrypted at rest, and used solely to provide the Services to you, including the AI processing described in Section 3. We do not use Apple Health data for advertising or marketing, we do not sell it, we do not disclose it to data brokers or advertisers, and we do not use it for any purpose other than providing the Services to you.
Deleting it. You can remove imported lab results in Lab Tests, change or clear imported basics in My Data, and delete your account and everything in it from within the app. Deleting information from Fluent does not change anything in the Health app.

Apple does not receive the information you import into Fluent. The Health app itself is governed by Apple's privacy policy.

5. Where and How Your Information Is Processed

The Services run on Amazon Web Services ("AWS") infrastructure in the United States (the US East, Northern Virginia, region). AWS acts as our service provider and processes your information only on our instructions, under contract terms that require it to protect your information. Within AWS we use:

Amazon S3 to store the documents you upload and the structured versions we create from them;
Amazon DynamoDB and Amazon RDS (PostgreSQL) to store your account, profile, goals, conversations, lab results, entitlements, and usage records;
Amazon Bedrock for AI processing, as described in Section 3;
Amazon SES to send transactional email, such as account verification messages, and to deliver requests you submit through our website (for example, asking to be notified when the iPhone app launches) to our team;
Amazon CloudFront and related networking services to deliver the Services securely and to protect them from abuse.

Your information is encrypted in transit using TLS and at rest using AWS managed encryption. Access to production systems is restricted to authorized personnel and limited to what is needed to operate and support the Services.

We also rely on a small number of other service providers, each of which receives only the information needed for its role:

Auth0 (Okta, Inc.) for sign-in, account authentication, and email verification;
Stripe, Inc. for payments and subscription management on the web;
Apple Inc. for purchases made through the App Store and, if you choose it, Sign in with Apple;
Google LLC, if you choose to sign in with Google.

Where the Services link to third-party websites, such as a laboratory's online store, those sites are governed by their own privacy policies, and we do not receive information about what you do there.

6. Cookies and Similar Technologies

We use cookies and similar technologies only as necessary to operate the Services, for example to keep you signed in, to protect against cross-site request forgery, and to remember settings. These are essential to the Services and cannot be switched off without affecting how the Services work.

We do not use third-party advertising cookies, cross-site tracking technologies, or advertising identifiers. If we add analytics tools in the future, we will update this Policy before they take effect and will configure them so that your health information and content are not collected.

Because we do not sell or share personal information for advertising and do not track you across other sites, browser signals such as Global Privacy Control and Do Not Track do not change how the Services behave. You can control cookies through your browser settings, though the Services may not work if essential cookies are blocked.

7. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising. We share information only:

With service providers that host, store, secure, authenticate, process payments for, send email for, and run AI processing for the Services, as described in Sections 3 and 5, under contracts that limit their use of your information to providing services to us and require them to protect it;
With Apple or Google to the extent you use their sign-in or purchase services, as described in Section 5;
When required by law, such as in response to a subpoena, court order, or other legal process, or to a government request that we believe in good faith we are required to comply with;
To protect rights, safety, and the Services, including to enforce our agreements, to prevent fraud or abuse, to address security or technical issues, and to protect the rights, property, or safety of Fluent, our users, or others;
In connection with a business transaction, such as a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, in which case your information may be transferred subject to this Policy and applicable law, and we will notify you of any material change in how it is used;
In aggregated or de-identified form that cannot reasonably be used to identify you, for example to report on usage of the Services. We commit to maintaining and using such information only in de-identified form, not to attempt to re-identify it, and to require the same of anyone who receives it; and
With your direction or consent.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, per-user isolation of stored data, least-privilege access controls, authenticated access to every user-specific operation, secure credential storage on the iPhone (the iOS Keychain), and logging and monitoring for security events. Our health-data rules prohibit logging or sending your content to analytics tools. Despite these measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach of security affecting your information, we will notify you and any applicable regulators as required by law.

9. Data Retention

Account data is kept for as long as your account is active.
Content you delete (documents, results, goals, notes, conversations, profile fields) is removed from active systems promptly and from backups on our normal backup cycle, generally within 30 days.
Deleted accounts are removed from active systems when you delete your account, and from backups on the same cycle.
Billing records are kept as long as required for tax, accounting, and audit purposes, generally seven years.
Server logs and security records are kept for a limited period for security, debugging, and abuse prevention.
Website launch requests (your email address) are kept until we have sent the notification you asked for and any follow-up, or until you ask us to remove it.

We may keep information longer where required by law, to resolve disputes, to enforce our agreements, or in de-identified form.

10. Your Choices and Rights

In the Services. You can view and update your profile, delete documents, results, goals, notes, and conversations, download your original documents, manage subscriptions, and delete your account.
Device permissions. You control the iPhone app's access to the Health app, camera, photos, files, and notifications in your device settings.
Email. You can opt out of non-essential email using the link in the message or by contacting us. We will still send account, security, billing, and legal notices while you have an account.
Access, correction, deletion, and portability. You may ask us to confirm whether we process your personal information, to access or correct it, to delete it, or to provide a copy in a portable format, by contacting privacy@fluentwellness.com. We will verify your request using the email address on your account and respond within the time required by applicable law. We will not discriminate against you for exercising your rights.
Authorized agents. Where permitted by law, you may designate an agent to make a request on your behalf; we may require proof of the agent's authority and verify your identity directly.
Appeals. If we decline a request, we will explain why, and you may appeal by replying to our response. If your appeal is denied, you may contact your state attorney general or other applicable regulator.

11. Health Information and Consumer Health Data

We understand that health information is sensitive, and we hold ourselves to a higher standard with it.

Not HIPAA. Fluent is not a healthcare provider, health plan, or healthcare clearinghouse, and is not a "covered entity" or "business associate" under HIPAA. The information you provide to Fluent is therefore not protected health information under HIPAA. We protect it as described in this Policy and our agreements with you.
Collection only with your action. We collect health information only when you enter it, upload it, or import it. We do not infer health conditions about you for any purpose other than generating the informational content you request.
Use. We use health information only to provide, personalize, secure, and support the Services for you, as described in Sections 2 through 5. We do not use it for advertising, marketing, or profiling for advertising, we do not sell it, and we do not disclose it to data brokers, advertisers, employers, or insurers.
Sharing. We share health information only with the service providers described in Section 5, which process it on our behalf, and otherwise only as described in Section 7.
Deletion. You can delete health information in the Services at any time, as described in Section 10, and it is removed as described in Section 9.
No geofencing. We do not use geofencing around healthcare facilities or any other location for any purpose.
Consumer health data laws. Residents of Washington, Nevada, Connecticut, and other states with consumer health data laws have the rights described in Section 10 with respect to their consumer health data, including the right to know what consumer health data we collect and share, to access it, to delete it, to withdraw consent to its collection or sharing, and to receive a list of the third parties with whom it has been shared. You may exercise these rights by contacting privacy@fluentwellness.com. The service providers listed in Section 5 are the only third parties that process your consumer health data, and they do so on our behalf.

12. California Privacy Rights

This Section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to Fluent.

Categories of personal information. In the preceding 12 months we have collected the following categories of personal information described in the CCPA: identifiers (name, email address, account identifiers, IP address); customer records information (billing information held by our payment processor); commercial information (subscription and transaction history); internet or network activity (usage of the Services, device and log information); inferences drawn from the information you provide, solely in the form of the informational content the Services generate for you; and sensitive personal information, specifically personal information concerning your health, and account log-in credentials held by our identity provider. We collect these categories from the sources, and use them for the purposes, described in Sections 1 and 2.

Disclosure. We disclose personal information in each category above to the service providers described in Section 5 for the business purposes described in Section 2. We have not sold personal information, and we have not shared personal information for cross-context behavioral advertising, in the preceding 12 months, and we do not do so. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Sensitive personal information. We use sensitive personal information only to provide the Services you request, to maintain security, and as otherwise permitted by the CCPA without a right to limit. We do not use or disclose it to infer characteristics about you for advertising or for any purpose other than providing the Services.

Your rights. Subject to applicable exceptions, you have the right to request that we disclose what personal information we collect, use, disclose, and sell or share; the right to request deletion of your personal information; the right to request correction of inaccurate personal information; the right to request a portable copy of your personal information; the right to opt out of sale or sharing (we do not sell or share); the right to limit the use of sensitive personal information (we already limit it as described above); and the right not to be discriminated against for exercising these rights. You may exercise your rights as described in Section 10, by emailing privacy@fluentwellness.com, or from within the Services. We will verify your request by matching the information you provide to the information on your account and may ask for additional information.

Retention. We retain each category of personal information as described in Section 9.

Shine the Light. California Civil Code Section 1798.83 permits California residents to request certain information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

13. Other United States State Privacy Rights

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws may have the right, to the extent those laws apply to Fluent, to confirm whether we process their personal data, to access, correct, delete, and obtain a copy of it, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in targeted advertising, sales of personal data, or such profiling. Where those laws require consent to process sensitive data, including health data, we obtain it through your affirmative act of entering, uploading, or importing that information. You may exercise these rights, and appeal any decision, as described in Section 10.

14. Users Outside the United States

We operate the Services from the United States, and the Services are intended for people located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your location, and by using the Services you consent to that transfer and processing.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and we process your personal data, the following also applies: we process your personal data on the basis of performing our contract with you, your explicit consent for health data (which you may withdraw at any time by deleting the relevant information or your account), our legitimate interests in securing, operating, and improving the Services, and compliance with legal obligations. You have the rights to access, rectify, erase, restrict, and port your personal data, to object to certain processing, and to lodge a complaint with your local supervisory authority. Transfers to the United States rely on standard contractual clauses or other lawful mechanisms where required.

15. Children's Privacy

The Services are intended for adults and are not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, contact us at privacy@fluentwellness.com and we will delete it.

16. Third-Party Links and Services

The Services may link to or integrate with third-party websites and services, such as laboratory online stores, sign-in providers, app stores, and the Health app. Those third parties have their own privacy policies, and we are not responsible for their practices. Review their policies before providing information to them.

17. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Services or by email before they take effect, and we will update the "last updated" date at the top of this page. Your continued use of the Services after a change takes effect constitutes acknowledgment of the updated Policy. Where a change requires your consent under applicable law, we will ask for it.

18. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your information, contact us at privacy@fluentwellness.com, or by mail at Fluent Wellness, LLC, Attn: Privacy, 999 Corporate Dr, Ste 100, Ladera Ranch, CA 92694, United States.