← Version history
View current version
This is Version 2 of the Privacy Policy, effective July 30, 2026. This is a historical archive. View the current version.

Privacy Policy

Version 2 · Effective July 30, 2026

Privacy Policy

Egality Health, a product of Insource Ai Inc.

Effective Date: July 29, 2026 Last Updated: July 29, 2026

Egality Health holds health information about you. We have built it so that your health data is never sold, never shared with advertisers, and never used to train artificial intelligence models.

Our disclosures about consumer health data specifically are in a separate document, our Consumer Health Data Privacy Policy, as required by law. Please read both.

1. WHAT THIS POLICY COVERS

This Privacy Policy explains how Insource Ai Inc. ("Insource Ai," "we," "us," "our") collects, uses, shares, and protects personal information in connection with Egality Health, the egalityhealth.com website, our mobile applications, and our communications.

We are the controller of the information described here. Egality Health is a direct-to-consumer service; we do not process your information on behalf of an employer, insurer, or health plan.

This Policy does not apply to third-party websites or services we link to or that you connect, which have their own policies.

For privacy matters, contact privacy@egalityhealth.com.

2. INFORMATION WE COLLECT

2.1 Information You Give Us Directly

Account information, such as your name or display name, email address, and password. We need it to create and secure your account.

Profile information, such as an optional photo, date of birth or age confirmation, time zone, language, and communication preferences. We need it to personalize the Service and confirm eligibility.

Health information, including cycle data, symptoms, measurements, medications, notes, uploaded documents, and anything else you record. We need it to provide the Service to you.

AI inputs, meaning prompts and questions you submit to AI features and the health information referenced in them. We need them to generate the responses you ask for.

Communications, such as support messages, survey responses, and feedback. We need them to respond to you and improve the Service.

Health information is described in detail in our Consumer Health Data Privacy Policy.

We do not collect or store payment card numbers. Payments are handled by Creem, described in Section 4.

2.2 Information We Collect Automatically

Usage data, such as screens viewed, features used, actions taken, and timestamps, so we can understand what works and fix what does not.

Device and technical data, such as IP address, browser type and version, operating system, device identifiers, and screen size, so we can deliver the Service correctly and securely.

Log data, such as access times, error reports, performance metrics, and API request records, so we can operate, debug, and secure the Service.

Approximate location, meaning city or region inferred from IP address, for security, fraud prevention, and applying the correct regional privacy rules.

Cookies and similar technologies, described in our Cookie Policy.

We do not collect precise geolocation, and we do not use geofencing of any kind.

Our analytics are first-party. We measure usage with our own systems rather than sending data to a third-party analytics company. We do not use Google Analytics, Meta Pixel, or any comparable third-party measurement tool.

2.3 Information We Derive

We generate insights, patterns, predictions, and summaries from what you record, for example cycle phase estimates or symptom trends. We treat derived and inferred information as health information and protect it the same way.

2.4 Information From Devices You Connect

If you connect a wearable or health platform, we receive the data categories you authorize at the time of connection. You may disconnect at any time in Settings, which stops future collection. Data already received is handled under this Policy until you delete it.

Oura. If you connect your Oura account, we access your data through Oura's official API under the Oura API Agreement and Oura's Privacy Policy. You acknowledge that Oura may collect usage data about our application's use of the Oura API. We do not sell, license, lease, or transfer your Oura data to any third party, including advertisers or data brokers. If you disconnect your Oura account or delete your account, we stop all processing of your Oura data immediately and delete it from our systems within 72 hours.

2.5 Information We Do Not Want

Please do not enter government identification numbers or financial account numbers into free-text fields, support messages, or AI prompts. Health information is expected and appropriate; these categories are not.

3. WHY WE USE YOUR INFORMATION

3.1 Our Purposes

  • To provide the Service, meaning creating your account, storing what you record, and generating insights and AI responses.
  • To enable payment, by passing the information Creem needs to complete your purchase.
  • To support you, by answering questions, troubleshooting, and sending service notices.
  • To secure the Service, by detecting and preventing fraud, abuse, unauthorized access, and security incidents.
  • To improve the Service, by understanding which features are used and diagnosing problems, using first-party measurement.
  • To communicate with you, by sending service notices and, with your consent, product news.
  • To comply with law, meaning legal, tax, and recordkeeping obligations and responses to valid legal process.

3.2 Legal Bases for Users in the European Economic Area, United Kingdom, and Switzerland

  • Creating and operating your account and delivering the Service: contract, Article 6(1)(b).
  • Billing: contract, Article 6(1)(b).
  • Security, fraud prevention, and protecting our systems: legitimate interests, Article 6(1)(f).
  • First-party product analytics: consent, Article 6(1)(a).
  • Non-essential cookies and marketing communications: consent, Article 6(1)(a).
  • Processing health data, which is special category data: explicit consent, Article 9(2)(a).
  • Tax and accounting recordkeeping: legal obligation, Article 6(1)(c).

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that already occurred. Where we rely on legitimate interests, you may object at any time as described in Section 7.

3.3 What We Do Not Do

  • We do not sell your personal information or your health information.
  • We do not share your personal information for cross-context behavioral advertising, and we run no advertising, retargeting, or measurement pixels of any kind.
  • We do not use your content, including your health information, to train artificial intelligence models.
  • We do not share health information with data brokers or advertising technology providers.
  • We do not use automated processing to make decisions producing legal or similarly significant effects about you.

4. WHO WE SHARE INFORMATION WITH

4.1 Service Providers

These vendors process information only on our documented instructions, under written contract, and may not use it for their own purposes.

Anthropic PBC, in the United States, provides the artificial intelligence models powering AI features. It receives prompts and content you submit to AI features, which may include health information.

Google LLC, in the United States, provides database hosting through Cloud SQL, application hosting through Cloud Run, and authentication through Firebase Auth. It receives account data and content encrypted at rest, along with your email address and authentication identifiers.

Vercel Inc., in the United States, provides web application hosting and delivery. It receives technical and log data, and content in transit.

Resend, Inc., in the United States, provides transactional email delivery. It receives your email address and message content.

Armitage Labs OU, trading as Creem, in Estonia in the European Union, acts as merchant of record and payment processor. It receives your name, email address, billing details, payment card data, and transaction records.

We do not add a vendor that receives health information without updating this Policy and our Consumer Health Data Privacy Policy first.

4.2 Others We May Share With

  • At your direction, if you connect an integration or ask us to share something.
  • Professional advisors, meaning lawyers, auditors, and accountants, bound by confidentiality.
  • In a business transaction, if we are involved in a merger, acquisition, financing, or sale of assets, information may transfer. We will notify you before any transfer of health information takes effect.
  • For legal reasons, to comply with valid legal process, or to protect the rights, safety, and property of Insource Ai, our users, or the public.

4.3 Government and Law Enforcement Requests

We review every request for legal validity and scope. We require a subpoena, court order, or warrant appropriate to the information sought, and we object to requests that are overbroad or legally deficient. Unless legally prohibited, we notify you before disclosing your information so that you have an opportunity to object.

Reproductive and sexual health information. We will not voluntarily disclose reproductive or sexual health information to law enforcement or to any private party.

5. ARTIFICIAL INTELLIGENCE AND YOUR DATA

5.1 What Happens When You Use an AI Feature

When you use an AI feature, the content you submit, including your prompt and any health information you or the feature reference, is transmitted to Anthropic PBC, which processes it to generate a response and returns that response to us for display to you.

You may use Egality Health without using AI features. Your consent to AI processing of health data is obtained separately, as described in our Consumer Health Data Privacy Policy, and you may withdraw it at any time in Settings.

5.2 What Anthropic May and May Not Do

Under Anthropic's commercial terms: Anthropic does not use your inputs or outputs to train its models. Anthropic processes your information only to generate the response requested. Anthropic retains API inputs and outputs for up to 7 days for operational and safety purposes, after which they are deleted.

5.3 What We Do to Reduce Exposure

We transmit only the information necessary to fulfill your request. We do not transmit your name or email address with AI requests; requests are associated with an internal identifier.

5.4 AI Output

Artificial intelligence output can be inaccurate. We do not warrant it. It is not medical advice. See Sections 7 and 8 of our Terms of Service.

6. HOW LONG WE KEEP INFORMATION

  • Account information: for the life of your account, then 30 days after closure.
  • Health information you record: for the life of your account; exportable for 30 days after closure; deleted from active systems within 30 days after that period, and from routine backups within 90 days thereafter.
  • Derived and inferred health information: deleted on the same schedule as the underlying health information.
  • AI prompts and outputs: retained by Anthropic for up to 7 days; our own request logs kept for 30 days.
  • Usage and log data: 12 months.
  • Support communications: 24 months after the conversation closes.
  • Billing and transaction records: 7 years, for tax and accounting requirements.
  • Marketing contact data: until you unsubscribe, then a suppression-list entry only.
  • Security and audit logs: 12 months.

You may delete your health information at any time without closing your account, in Settings, then Privacy, then Delete Health Data.

7. YOUR RIGHTS AND CHOICES

7.1 Rights Available to Everyone

  • Access your information: Settings, then Privacy, or email privacy@egalityhealth.com.
  • Correct inaccurate information: in-product settings, or email us.
  • Export your data: Settings, then Privacy, then Export.
  • Delete your health data: Settings, then Privacy, then Delete Health Data.
  • Delete your account and all data: Settings, then Account, then Delete Account.
  • Withdraw consent to AI processing: Settings, then Privacy.
  • Opt out of marketing: the unsubscribe link in any email, or email us.
  • Manage cookies: our cookie settings page.

7.2 Additional Rights Under Certain Laws

Depending on where you live, you may also have the right to object to or restrict processing; opt out of the sale or sharing of personal information and of targeted advertising; limit the use of sensitive personal information; not be discriminated against for exercising a privacy right; appeal a decision; and lodge a complaint with a supervisory authority.

7.3 Global Privacy Control

We honor Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of personal information and of targeted advertising for that browser.

7.4 How We Handle Requests

Submit requests in Settings, then Privacy, or by emailing privacy@egalityhealth.com. We verify your identity before acting. We respond within 45 days.

7.5 Authorized Agents

You may use an authorized agent. We will ask for written permission signed by you and will verify your identity directly.

7.6 Appeals

If we decline your request, you may appeal by emailing privacy@egalityhealth.com with "Privacy Appeal" in the subject line.

8. HOW WE PROTECT INFORMATION

We maintain safeguards designed to protect personal information, including encryption in transit using TLS 1.2 or higher, encryption at rest, row-level access isolation, access controls, multi-factor authentication on all internal systems, logging and monitoring, vendor security review, and written incident response procedures reviewed at least annually.

9. INTERNATIONAL DATA TRANSFERS

We are based in the United States and process and store information there. When we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses.

10. AGE REQUIREMENT

Egality Health is for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18.

11. CHANGES TO THIS POLICY

We update this Policy as our practices or the law change. For material changes, we give at least 30 days notice. For any change affecting how we collect, use, or share health data, we obtain your affirmative consent before the change applies to you.

12. HOW TO CONTACT US

Insource Ai Inc. [Street Address, City, State ZIP]

APPENDIX A. NOTICE FOR CALIFORNIA RESIDENTS

This Appendix supplements the Policy for California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

A.3 Sale and Sharing

We do not sell personal information and have not sold personal information in the past 12 months. We do not share personal information for cross-context behavioral advertising.

A.5 Your California Rights

You have the right to know, delete, correct, opt out of sale and sharing, limit the use of sensitive personal information, be free from discrimination for exercising a privacy right, and appeal a denial. Exercise these rights in Settings, then Privacy, or by emailing privacy@egalityhealth.com.

APPENDIX B. NOTICE FOR THE EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SWITZERLAND

Controller: Insource Ai Inc., [Street Address, City, State ZIP].

Your rights: You have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent, and the right not to be subject to solely automated decision-making.

Complaints: You may lodge a complaint with your local supervisory authority.

APPENDIX C. ADDITIONAL STATE NOTICES

Residents of states with comprehensive privacy laws have rights to confirm processing and access data, correct inaccuracies, delete data, obtain a portable copy, opt out of targeted advertising, sale, and profiling, and appeal a denial.

Health data is sensitive data under these laws and requires your opt-in consent before processing. We obtain that consent separately, as described in our Consumer Health Data Privacy Policy.