ReportGuide Privacy Policy

We believe your health information deserves careful handling. ReportGuide is designed to help people better understand medical reports while treating personal information responsibly.

Our guiding principle is:

This policy describes our intended and actual information-handling practices. We will update it when our services or practices change.

Depending on the features you use, ReportGuide may collect the following categories of information.

A. Information You Provide

• Medical reports: Laboratory results, imaging reports, pathology reports, and other medical documents you choose to upload.
• Information in your reports: Names, dates of birth, patient identifiers, test results, diagnoses, physician names, and other information appearing in uploaded documents.
• Questions and messages: Questions you ask our AI assistant and other information you voluntarily provide.
• Account information: Such as your email address, name, or authentication information if account registration is offered.
• Communications: Information you provide when contacting our support team.

Please avoid uploading information that is unnecessary for the service you want to receive.

B. Technical and Usage Information

We may collect technical information necessary to operate and secure ReportGuide, such as browser type, device information, IP address, access times, error logs, and feature usage.

Analytics and tracking technologies, if used, will be subject to applicable law and the disclosures and choices provided to users.

C. Payment Information

If paid services are introduced, payment information may be processed by a payment service provider. The information collected and stored will depend on the payment method and provider.

We may use information for the following purposes:

• To analyze uploaded medical reports and generate plain-English explanations.
• To provide summaries and answer questions about uploaded reports.
• To operate, maintain, and improve ReportGuide.
• To authenticate users and maintain account security, where applicable.
• To detect fraud, abuse, technical problems, and security incidents.
• To respond to support requests.
• To process payments, if applicable.
• To comply with legal obligations and enforce our Terms of Use.

We will not use information for purposes materially different from those described in this policy without providing additional notice or obtaining consent where required.

ReportGuide uses artificial intelligence to generate explanations and responses based on information submitted by users.

To provide these features, uploaded reports, relevant text, and user questions may be processed by third-party AI model providers or other technology service providers.

The providers, their data-handling terms, and the settings used for processing may change over time. Before submitting sensitive information, users should review any applicable in-product disclosures concerning these providers.

AI model training: We do not make a blanket promise in this policy that information submitted to ReportGuide is never used for model training. The treatment of submitted information depends on the providers, applicable contractual terms, and technical settings used by ReportGuide. We will disclose material practices as required by law and will not make privacy representations that are inconsistent with our actual practices.

We do not authorize service providers to use personal information for unrelated purposes except as permitted by applicable agreements and law.

We may disclose information in the following circumstances:

A. Service Providers

We may share information with vendors that help operate ReportGuide, including hosting providers, AI model providers, document-processing services, authentication providers, customer-support tools, and payment processors.

These providers receive information as necessary for their assigned functions, subject to applicable contractual requirements and law.

B. Legal Requirements and Safety

We may disclose information when reasonably necessary to comply with a valid legal obligation, respond to lawful requests, protect the rights and safety of users or others, investigate fraud, or enforce our agreements.

C. Business Transfers

Information may be transferred in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to applicable legal requirements and appropriate safeguards.

D. With Your Direction or Consent

We may disclose information when you direct us to do so or provide consent where required.

We retain information only for as long as reasonably necessary for the purposes described in this policy, including providing the service, maintaining security, resolving disputes, and meeting legal obligations.

Retention periods may vary by information type and feature. For example, uploaded reports, generated explanations, account records, and security logs may be subject to different retention practices.

Where the service provides a deletion feature or where a valid deletion request applies, you may request deletion of eligible information by contacting contact@sunrivaai.com. We will explain or carry out deletion in accordance with our actual capabilities and applicable law.

Some information may remain in backups or be retained where legally required or permitted. We will not represent that information is immediately or completely erased unless that can be verified.

Before launch, Sunriva will establish and publish retention and deletion practices consistent with its actual systems.

We use, or intend to implement before accepting sensitive information, reasonable administrative, technical, and organizational safeguards appropriate to the information processed.

Depending on the service architecture, these safeguards may include access controls, encryption, secure hosting, monitoring, and restricted access to sensitive information.

No method of electronic storage or transmission is completely secure. We cannot guarantee absolute security, but we will take reasonable measures appropriate to the risks.

If a security incident triggers a legal notification obligation, we will provide notifications as required by applicable law.

Depending on your location and applicable law, you may have rights to:

• Request access to personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of eligible information.
• Withdraw consent where processing relies on consent.
• Request information about certain processing or disclosures.
• Exercise applicable rights concerning sensitive personal data.
• Appeal a decision concerning a privacy request, where required by law.

To submit a request, email contact@sunrivaai.com with the subject line “ReportGuide Privacy Request.” We may need to verify your identity before responding.

We will respond within the time required by applicable law. Some requests may be limited by legal obligations, security requirements, or the rights of others.

ReportGuide is not intended for children under 13 without appropriate parental or guardian involvement and compliance with applicable law. If we learn that we have collected personal information from a child in circumstances where collection was not permitted, we will take appropriate steps to address it.

If ReportGuide is made available to minors or used by parents or guardians on behalf of minors, additional safeguards and disclosures may be necessary.

ReportGuide is designed to provide educational explanations of medical reports. It is not a healthcare provider and is not necessarily a HIPAA-covered entity or business associate.

Whether HIPAA or another health privacy law applies depends on the parties, services, and actual data flows. Other laws, including the Federal Trade Commission Act, the FTC Health Breach Notification Rule, and applicable state privacy laws, may apply even when HIPAA does not.

We will not claim HIPAA compliance unless the relevant legal and technical requirements have been evaluated and verified.

ReportGuide may contain links to third-party websites or integrate with third-party services. Their privacy practices are governed by their own policies. We encourage you to review those policies before providing information to those services.

We may update this Privacy Policy to reflect changes in our services, technology, legal requirements, or information-handling practices.

We will post the updated policy with a revised “Last Updated” date. Where required by law, we will provide additional notice or obtain consent before implementing material changes.