Consumer Health Data Privacy Policy (draft)
This is a separate, standalone policy about consumer health data specifically, required by Washington State's My Health My Data Act (RCW 19.373) — it does not replace the general Privacy Policy, and the general Privacy Policy does not replace this one. It also describes how Aro treats medical information under California's Confidentiality of Medical Information Act. Draft, pending legal review, describing current practice honestly rather than final binding terms.
Draft — pending legal review. This is not yet a binding policy; treat it as an honest description of current practice, not a legal document.
What consumer health data Aro collects
Medication names, dosages and schedules; confirmations of doses taken; summaries and transcripts of phone calls with the voice companion; SOS button presses and possible impact check-ins, including a location fix only at the moment one of them happens; only with the senior's consent, health readings from their phone's Apple Health or Health Connect (steps, resting heart rate, heart rate, weight, blood pressure, blood glucose and sleep — whichever they choose); and, only with permission for that kind of data, readings from a connected wearable, records from a health provider's patient portal (conditions, allergies, immunizations, medications, lab and vital-sign results), and uploaded lab reports with the values a person confirmed from them. Where a household has no readings of its own, some screens show readings from published research recordings, clearly labelled as such and never as this household's data.
Readings from Apple Health and Health Connect
Aro only reads these readings — it never writes to Apple Health or Health Connect — and only the ones the senior agreed to on the consent screen. Each reading is stored with its time, its source and the name of the device that recorded it, on Aro's servers (not in iCloud). They are shown to the senior's care circle and to no one else. They are never used for advertising or marketing, never sold, never shared with data brokers, and never used for any purpose beyond showing them to the circle. Aro's use and transfer of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.
Wearables, provider records and lab reports
Each is off until someone in the circle gives permission for it in the app; the permission is recorded with who gave it, on which wording, and when, and Aro asks again if the wording changes. Wearables (Oura, Fitbit through Google, Withings) send readings through their official connections. Provider records come read-only through SMART on FHIR from a patient portal the household connects (today only Epic's public test system); Apple Health Records will work the same way if it is switched on, and is not available today. Lab reports are files a caregiver uploads; the original is kept so every value can be traced to it, and values are saved only after a person confirms them. If optional automatic reading is switched on, a lab file is sent to Anthropic's AI model to suggest values for that review, and for no other purpose. Aro shows what each source says and where it came from; it does not interpret results. Connection tokens, provider records, lab files and review drafts are stored encrypted.
Why Aro collects it
Solely to run the product for your own family circle — showing your family what it needs to know, placing companion calls, and raising an alert when something needs attention. Not for advertising or marketing, not for building a profile to sell, and not for any purpose outside your own circle.
Where it comes from
Directly from your household: what a caregiver enters or uploads in the app, what the senior says on a companion call, and — only with consent — the readings on the senior's own phone in Apple Health or Health Connect. With permission for each, also from the wearable companies and health providers your household connects, through their official connections. Nothing is purchased or collected from third-party data brokers.
Who else can see it
The senior's care circle (the people in the family circle) can see it in the Aro app and website. A small number of infrastructure providers process it only to operate Aro — authentication (Clerk), database hosting (Neon), web hosting (Vercel), telephony (Twilio), push notifications (Expo, delivered through Apple and Google), AI providers for the voice companion (Anthropic, and ElevenLabs or AssemblyAI where configured), and, only if automatic lab-report reading is switched on, Anthropic for reading uploaded lab files. None of them may use it for their own purposes. Readings from Apple Health, Health Connect, wearables and provider records are never sent to the AI providers, and a push notification never contains a health reading. Consumer health data is never sold and never shared for advertising.
Your rights
Under Washington's My Health My Data Act you can: know whether Aro holds consumer health data about your household and see it; withdraw consent at any time; and have it deleted. Aro never sells consumer health data, so there is no sale to opt out of. In the app, Settings › Health connections shows what is shared from each phone, turns sharing off, and deletes what was synced — for the person who agreed to share it, or a circle admin. Settings › Privacy does the same for wearables, provider records and lab reports, lets anyone in the circle download everything Aro holds for the household, and lets a circle admin delete all of it. For anything else, or a question about a decision we made on your request, email hello@arohealth.net; those requests are handled by hand.
California residents
Aro treats the medical information it holds — provider records, lab reports, medications and readings — as covered by California's Confidentiality of Medical Information Act, pending legal review of whether it applies. That means Aro does not disclose it to anyone outside the household's care circle and the providers that operate Aro for you, unless the household authorizes it or the law requires it; it is never sold or used for marketing. You can see and download it, and delete it, in Settings › Privacy, or by emailing hello@arohealth.net.
Consent
Nothing is read from Apple Health or Health Connect until the senior agrees in the app, on their own phone (or a helper confirms the senior has agreed), and that agreement is recorded — what was shared, on which wording, and when — before the phone's own permission prompt appears. Wearables, provider records and lab reports each need their own permission in the app, recorded the same way, before anything is connected or uploaded. If the wording changes, Aro asks again. Consent can be withdrawn at any time — in Settings › Health connections for phone readings and in Settings › Privacy for the rest — which stops new data immediately and can delete what was already brought in. For the rest of this data, creating a family circle and adding a senior's information is how consent is given; nothing here is collected passively or without your household's own action.
How long it is kept
Readings synced from a phone are kept while the household uses Aro and are deleted when the senior withdraws consent and chooses to delete them, when they are deleted in Settings › Health connections, or on request. The same holds for wearable readings, provider records and confirmed lab reports, through Settings › Privacy. Some data is deleted automatically: companion call transcripts a year after the call, lab reports nobody confirmed after 180 days (30 days if rejected or unreadable), and records from a provider connection that is no longer active a year after they were last retrieved. The access keys for a connected account are deleted the moment it is disconnected. Aro set these periods on October 21, 2026; like the rest of this page, they are pending legal review. Deleting the household removes everything at once; email hello@arohealth.net for anything else.