Privacy Policy

Effective as of July 1, 2024. Last updated July 3, 2026.

This Privacy Policy covers all 360H, Inc.’s services and brands, including the Slothwise mobile apps (iOS/Android), our website (including any in‑app webviews), the use of SMS/RCS, and any other services that we provide. It explains what we collect, how we use and share information, and your choices. App‑specific practices (e.g., device health data, EHR/insurance connections, in‑app camera/microphone, AI features) are called out below.

This summary explains our Privacy Policy in simple terms. The full legal text follows below.

What we collect: We collect what you give us (like your name, email, phone number, zip code, height, weight, and health records you choose to connect). We also collect basic technical data (like your device type and which screens you visit). We only collect what we need to run Slothwise.

Why we collect it: We use your information to power your health dashboard, send you insights, answer your questions, and make Slothwise better for everyone. We do not currently share your information with pharmaceutical, life sciences, or research partners. If we offer a research program in the future, participation will be optional and opt-in, any data shared will be aggregated or de-identified, and we will give you a separate notice and obtain any required consent before any sharing occurs.

Who can see your data: Your data stays between you and Slothwise. We only share it when needed to run the service or when you give us permission:

We may share information if required by law, or as part of a company merger or sale.

What makes Slothwise different:

How we protect your data: We protect your information with administrative, technical, and physical safeguards, including encryption in transit and at rest, application-level encryption of sensitive credentials, database row-level security, access controls, and managed secrets. Only authorized personnel can access personal data, and only when needed. We conduct internal security reviews and follow industry-standard practices; our security program is informed by leading frameworks such as SOC 2 and NIST. Specific controls may evolve over time.

What happens if you delete your account: If you delete your account, we delete or de-identify the personal information associated with it, subject to limited retention for legal compliance, security, fraud prevention, and backup restoration as permitted by law. When we de-identify data, we apply technical, contractual, and organizational measures designed to prevent re-identification, and we do not attempt to re-identify it. Support conversations are kept for a reasonable time after your issue is resolved, then deleted.

You are in control: You can view, fix, or delete your personal information at any time. You can stop marketing emails with one click. You can disconnect wearable, fitness, and calendar accounts in the app whenever you want, and you can stop health records syncing at any time by revoking access with your provider or emailing us. To make a request, email us at founders@slothwise.com.

How we tell you about changes: If we make important changes to this policy, we will notify you (by email, text, or in-app notice).

Our Privacy Commitments

Introduction

Your privacy is important to us. It is 360H, Inc.’s policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including across our website (slothwise.com) and other sites or applications we own and operate. This Privacy Policy applies to all users of Slothwise’s website and services within the United States.

“Personal information” means any information about you which can be used to identify you. This includes information about you as a person (such as name, address, date of birth), your devices, your payment details, health or wellness information you choose to provide, and information about how you use a website or online service.

In the event our site contains links to third-party sites and services, please be aware that those third parties have their own privacy policies. Once you leave our site or are redirected to a third-party service, you are no longer governed by this Privacy Policy. We have no control over, and are not responsible for, the content or policies of external sites. This Privacy Policy does not apply to any of your activities after you leave our site.

By accessing slothwise.com or using Slothwise’s services, you agree to abide by our Terms of Service and this Privacy Policy, and to comply with all applicable laws and regulations. If you do not agree with these terms, you are prohibited from using or accessing Slothwise.

Information We Collect

Information we collect falls into one of two categories: “voluntarily provided” information and “automatically collected” information.

What happens automatically vs. what you choose: When you create an account, we automatically collect basic technical data (like your IP address and device type). Everything else requires your action or permission:

Log Data

When you visit our website, our servers may automatically log certain standard data provided by your web browser. This log data may include details such as your device’s Internet Protocol (IP) address, your browser type and version, the pages you visit on our site, the time and date of your visit, and the time spent on each page. We may also log information about errors you encounter while using the site, including technical details about your device and what you were doing when the error occurred.

Please note that while this information does not identify you by itself, it may be possible to combine it with other data to personally identify individual users. We treat log data as confidential and use it primarily for troubleshooting and improving our service. We collect this data because it is needed to keep our website running, fix technical problems, and protect against security threats.

Device Data

We may collect data about the device you use to access Slothwise, such as your device’s model, operating system, unique device identifiers, and geolocation data (if you have enabled location services for our app or website). The information we gather can depend on your device’s settings and software. We recommend checking your device and software privacy settings to control what information is shared. Geo-location data, if collected, is used to personalize your experience (for example, to find nearby healthcare providers) and will only be collected in accordance with applicable permissions and law. We need this information to make sure Slothwise works correctly on your specific device and to show you health resources near your location when you allow it.

Personal Information

We may ask you to provide certain personal information in order to register for or use Slothwise’s features. For example, when you join our waitlist, create an account, subscribe to a newsletter, or contact us, you may be asked to provide details such as:

You may choose not to provide some of this personal information, but doing so might affect your ability to use certain features of Slothwise. We will only ask for information that is relevant to your interaction with Slothwise (for instance, we won’t ask for personal data that isn’t needed for the particular service or feature). The information above serves as an example and the actual information you might be asked to provide may change.

Here is why we need each piece of information

Here is why we need each piece of information: Your name and email let us create your account and send you health insights. Your phone number is needed if you use our text messaging features (SMS/RCS). Your zip code helps us find healthcare providers and resources near you. Your height and weight are used to calculate health measurements and give you accurate wellness insights.

Messaging Communications (SMS & RCS)

If you choose to communicate with us via text messaging, including SMS or Rich Communication Services (RCS), we will collect and store certain information about these communications. This Messaging Data includes the phone number you use to contact us, the content of the messages you send or receive, the dates and times of the messages, and metadata such as delivery status or read receipts (when available). We use this messaging data only for legitimate purposes such as responding to your inquiries, providing customer support, and improving our service quality. We collect this information because it is needed to deliver your messages, respond to your questions, and keep a record of our conversations so we can provide better support.

Important Notice on SMS/RCS

Please be aware that standard SMS and RCS messages are not encrypted. These channels are not secure for transmitting sensitive personal health information. We strongly advise you not to send any sensitive medical or health information via SMS or standard text messaging. If you need to share personal health details with Slothwise, please use the secure messaging features within our app or website, which are designed to protect your privacy. By using SMS/RCS to communicate with us, you acknowledge that these channels have inherent security limitations.

Sensitive Health Information

You agree not to use SMS, text messaging, or RCS to communicate sensitive health or medical information to Slothwise. 360H, Inc. explicitly disclaims any liability for unauthorized access to or disclosure of sensitive health data that occurs as a result of you sending such information through insecure channels like SMS or standard texting. In other words, if you choose to ignore our recommendation and send health information via SMS/RCS, you do so at your own risk. We encourage all users to utilize our secure in-app communication methods for any medical or sensitive matters.

By initiating communication with us via SMS or RCS (for example, by texting our number or signing up for text updates), you are providing consent to receive communications from us through those channels. This might include responses to your inquiries, important service announcements, or support messages. You can opt out of receiving SMS/RCS messages from us at any time. To opt out, you may reply with the word “STOP” to any message we send, or contact us at our email address provided below requesting to opt out. Upon receiving an opt-out request, we will cease SMS/RCS communications to your number (except for messages confirming your opt-out). No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Please note that standard messaging and data rates charged by your mobile carrier will apply to any SMS/RCS messages exchanged.

Third-Party Messaging Providers

We use third-party service providers to facilitate our SMS and RCS messaging functionality to send and receive text messages on our behalf. These providers may process and store your phone number, message content, and related metadata as necessary to deliver your messages. We select reputable providers that employ strong privacy and security practices, and any use of your data by these providers is solely to enable the messaging service. Nonetheless, these providers have their own privacy policies, and we encourage you to review any relevant provider’s privacy policy if you have concerns. By using Slothwise’s SMS/RCS features, you acknowledge that third-party providers will handle your messaging data for delivery and operational purposes.

Consumer Health Data Privacy Notice

This section applies to consumer health data and is provided to comply with state consumer health data privacy laws, including Washington’s My Health My Data Act. It explains the consumer health data we collect, where it comes from, how we use and share it, and the choices you have.

Categories of consumer health data we may collect include: health records and documents you connect or upload (such as labs, medications, conditions, allergies, immunizations, insurance and claims information, and clinical documents); wearable and activity data you connect (such as steps, heart rate, sleep, and other vital signs); self-tracked wellness data you enter (such as menstrual cycle, weight, nutrition, hydration, body temperature, medication adherence, blood pressure, glucose, and mood); information from photos, documents, or voice input you provide; and the account-specific insights and summaries we generate from this information to provide the service.

Sources of this data: directly from you; from the healthcare providers, insurers, wearables, apps, and services you choose to connect; and from logs generated in the course of providing the service.

How we use it: to provide the features you request, generate account-specific summaries and educational explanations, maintain your account, provide customer support, secure the service, and comply with law.

How we share it: we share consumer health data only with service providers that help us operate the service, such as cloud hosting and storage, messaging and notification delivery, document and image processing, AI processing that returns results to you, error monitoring, and the records, wearable, and calendar integrations you choose to connect. These providers act on our behalf under contract. We do not sell consumer health data, and we do not use or share it for targeted advertising. If we ever wanted to use or share consumer health data for a purpose not described here, we would provide a new notice and obtain any consent required before doing so.

Your rights: subject to applicable law, you may request to access the consumer health data we have collected about you, request that we delete it, obtain a list of the categories of third parties with whom we have shared it, withdraw consent where consent is the basis for our processing, and appeal a denial of any of these requests. To exercise these rights, contact us at founders@slothwise.com, and we will respond as required by applicable law.

Legitimate Reasons for Processing Your Personal Information

We will only collect and use your personal information when we have a legitimate reason to do so. In practice, this means we collect personal data only as needed to provide you with our services, to meet our contractual and legal obligations, or to pursue our legitimate interests in operating and improving Slothwise. We will not collect an excessive amount of information, and we avoid collecting data that is not relevant to the purposes of our interaction with you. Whenever we process your personal information, we ensure that we have a lawful basis to do so (for example, your consent, compliance with a legal obligation, or our legitimate interest in running our business) and that we respect your privacy rights.

Collection and Use of Information

We may collect personal information from you when you engage in any of the following activities on our website or app:

We may collect, hold, and use the information we gather for the following purposes, and we will not process your personal information in ways that are unrelated to these purposes:

We may combine information you provide to us voluntarily with information that is automatically collected (such as device and log data) and with general information from other trusted sources. For instance, we might incorporate publicly available health guidelines to improve our recommendations, or combine market data with usage patterns to better tailor our service. Any internal analysis that involves user-generated data utilizes anonymized or aggregated data with personal identifiers removed. We do not use aggregated or any other user data for AI model training. Note: Data obtained via Google APIs is governed strictly by the Google API Disclosure in this agreement and is excluded from even this limited analytics use.

We do not currently share your information with pharmaceutical, life sciences, or research partners. If we offer a research program in the future, participation will be optional and opt-in, any data shared will be aggregated or de-identified, and we will provide a separate notice describing the data involved, the categories of recipients, and the purpose, and obtain any required consent before any sharing occurs. You will be able to withdraw at any time. If such a program existed, an aggregate insight would be a group-level statistic (for example, the share of users in an age range who reported a recurring symptom) and would never identify an individual user.

Clinical Trial Notifications. If we offer clinical-trial or research-study notifications in the future, they will be optional informational messages you can turn off, and we will not share your personal information with study sponsors as part of any such notification.

De-identified Research Datasets. We do not currently include your data in research datasets or share it with pharmaceutical, life sciences, or research partners. If we offer such a program in the future, participation will be optional and opt-in, never automatic, and never a condition of using Slothwise. Any data shared would be aggregated or de-identified, we would provide a separate notice describing the data involved, the categories of recipients, and the purpose, and obtain any required consent before any sharing occurs, and you would be able to withdraw at any time, after which your data would be removed from future datasets.

Slothwise is subject to federal and state laws that govern the privacy of health and personal information, including the Federal Trade Commission (FTC) Act and its Health Breach Notification Rule, Washington’s My Health My Data Act, and California’s privacy laws, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act) and, where applicable, the Confidentiality of Medical Information Act, along with other state consumer health data laws. These laws give you concrete, enforceable rights over your health and personal data, and for a direct-to-consumer service they often provide protections as strong as, or stronger than, HIPAA. We treat all health-related data with a high degree of care and security.

Because Slothwise is a direct-to-consumer digital health service, not a hospital, insurer, or clinical provider, we are not classified as a “covered entity” or “business associate” under HIPAA, and the data you provide to us is not “Protected Health Information” (PHI) as HIPAA defines it. This does not mean your data is less protected. Instead, it is governed by the consumer health data and state privacy laws described above, and we hold ourselves to high standards of confidentiality and security, informed by leading security frameworks such as SOC 2 and NIST. Your health data is encrypted, access-controlled, and never sold.

Security of Your Personal Information

We take the security of your personal information seriously. When we collect, process, and store personal information, we protect it within commercially acceptable means to prevent loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction. We protect your information with administrative, technical, and physical safeguards, including encryption in transit (e.g., information flowing between your device and our servers) and at rest (data stored in our databases), application-level encryption of sensitive credentials, database row-level security, access controls, and managed secrets. Only authorized personnel with a legitimate need can access personal data. We conduct internal security reviews and follow industry-standard practices; our security program is informed by leading frameworks such as SOC 2 and NIST. Specific controls may evolve over time.

Despite our efforts to use commercially acceptable means to protect your personal information, we must note that no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. Internet and digital systems come with inherent risks, and while we strive to protect your information, we cannot promise or ensure complete security.

You are responsible for maintaining the security of any account credentials (such as your password) and for exercising caution in how you handle and disclose your personal information. We encourage you to choose a strong, unique password for Slothwise and to keep it confidential. If you suspect any unauthorized access to your account or information, please contact us immediately. Additionally, please avoid making your personal information publicly accessible via our platform (for example, in any user-generated content or public forums, if those exist). By taking these steps and by us maintaining robust security measures, we work together to protect your data.

Data Retention

We retain personal information only for as long as it is needed to fulfill the purposes for which we collected it, and for any period that may be required by law or regulation. Account data (name, email, settings): Kept while your account is active. When you close your account, we begin deleting your personal data from our systems. Some data may persist in encrypted backups for a limited time before being automatically removed.

Health and medical records: When you close your account, we delete or de-identify the personal information associated with it, subject to limited retention for legal compliance, security, fraud prevention, and backup restoration as permitted by law. When we de-identify data, we apply technical, contractual, and organizational measures designed to prevent re-identification, and we do not attempt to re-identify it. De-identified data may be retained for product improvement and aggregate analytics as described in this policy.

Support conversations (email, SMS, chat): Kept until your issue is resolved, plus a reasonable follow-up period. Then deleted.

Analytics data: Stored without personally identifying information and kept to help us improve Slothwise.

Legal holds: If we are part of a legal case, relevant data may be kept longer as required by law.

We will not use your data for any new purpose beyond what is listed in this policy without asking for your permission first.

The length of time we keep data depends on the type of information and the reason we collected it. For example:

In some cases, even after you delete your account or we’ve finished providing services to you, we may be required by law to keep certain information for a set time (for example, for financial record-keeping, compliance with tax regulations, or resolving disputes). We may also retain some data if it’s necessary for legal proceedings or to fulfill our legitimate business needs (such as fraud prevention or safety). However, if we do need to retain data for such purposes, we will ensure that any personal information is minimized and secured, and we will only use it for the required purpose.

Beyond any mandatory retention periods, we may keep backup copies of data for a limited time as part of our routine backup procedures (these backups are kept secure). When personal information is no longer necessary for any permitted purpose, we will securely delete it or anonymize it so that it can no longer be associated with you.

Children’s Privacy

Slothwise is intended solely for users who are at least 16 years of age. We do not allow users under 16 years old to create accounts or use the platform. If you are under 16, please do not use our website or services or provide any personal information to us.

Additionally, in compliance with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under the age of 13. We encourage parents and guardians to monitor their children’s Internet usage and to help enforce this policy. If we learn that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as soon as possible. If you believe that a child under 13 may have provided us personal information, please contact us immediately so that we can investigate and remove the data.

Disclosure of Personal Information to Third Parties

We may disclose personal information to third parties in the following circumstances:

Third-Party Service Providers

To give you full transparency, here are the types of third-party tools and services Slothwise currently uses to operate its platform. We may share or store your data with these providers solely for the purposes described in this Privacy Policy:

Artificial Intelligence (AI) Processing: Our application includes features powered by AI, which help provide intelligent responses, insights, or recommendations. To enable these features, we may send certain data to third-party AI service providers for processing. For instance, if you ask a question or input some text for our AI assistant, the content of your query (and relevant context) might be securely transmitted to an AI processing service in order to generate a helpful answer. Similarly, if you upload data (like a document or image) for analysis or transcription, that data may be processed by an AI service specialized in that task. For the avoidance of doubt, Slothwise does not transfer user data obtained via Google Workspace APIs to any third-party AI provider for the purpose of training their models or any other purpose not disclosed in the Google API Disclosure section of this policy.

We share only the information necessary for the AI services to perform their function, and only to generate results for you. Our primary AI routing is configured to use providers on a zero-data-retention basis, and providers are not permitted to use your data to train models that serve other customers. Some providers may briefly retain data under their own terms to operate and secure their services. We do not use your data to train or fine-tune AI or machine learning models. Please be aware that any information you submit for AI processing is handled by these external services under their own privacy and security controls.

AI Memory: In order to make our AI-powered features more personalized and context-aware, our app maintains an “AI memory” of prior interactions or user-provided information. This means that, with your consent, we store relevant pieces of information (for example, previous chat conversation snippets or facts you’ve told the AI about yourself) in a secure manner so that the AI can refer back to it and provide continuity. This memory data is stored either on your device or on our secure servers (protected by encryption) and is used only to personalize the Slothwise experience within your individual account. It is never used to build or improve models that serve other users, is not used for advertising, and is not shared with any unrelated third parties. You can request deletion of your AI interaction data at any time, which will erase the associated memory on our systems.

AI Providers: The AI service providers we work with include industry-leading cloud AI platforms. These may include natural language processors and generative AI models. For transparency, examples of such providers are large language model APIs or cloud AI services from well-known companies (we do not list them here, but we ensure each complies with privacy commitments). If any provider has specific privacy requirements or terms (for example, Google’s AI APIs), we adhere to those. For instance, our use and transfer of information to Google API services will follow Google’s User Data Policy and its “Limited Use” requirements for sensitive data.

Data Hosting: We host our application and store user data on secure cloud infrastructure provided by third-party companies. In practice, this means your personal data (profile information, settings, and any content you upload) is stored in data centers managed by these providers, rather than on our own premises. We use reputable cloud service providers that implement strict security measures (such as encryption and access controls) to safeguard your information. These providers act only under our instructions and do not access your data except to maintain and support the storage and retrieval of the information. All of our servers are located in the United States.

Health/Medical Information: With your explicit consent, our app can connect to your health-related accounts or records in order to provide you with integrated health services. For example, you may choose to link the app to your electronic health records or insurance provider to import your medical history or coverage details. In doing so, we utilize secure third-party integration services that facilitate this connection. This process requires you to authenticate with your healthcare or insurance provider and authorize the data sharing. Once authorized, the third-party integration will retrieve specific health information (such as your lab results, medication history, claims or insurance benefits) and transfer it to our app for your use. We only access and store the health data that you have consented to share, and we use it solely to deliver features you expect (for instance, to show you a unified health record, provide insights or personalized recommendations). When you connect a health records or insurance source, Slothwise retrieves all available records from that source at the time of connection and then periodically re-checks it for new or updated records, so your information stays current without reconnecting. Retrieved records are processed with AI only to generate results for you, as described in the Artificial Intelligence section of this policy. This periodic syncing continues for as long as your account remains active.

We treat all health and medical data with a high level of confidentiality and security. We do not use health information for advertising or marketing purposes, nor do we sell or disclose it to unauthorized parties. You can revoke access at any time by revoking Slothwise’s authorization directly with your healthcare or insurance provider (for example, through their patient portal), or by emailing us at founders@slothwise.com, and we will then cease any further collection from those sources. Deleting your Slothwise account also stops all further collection.

Please note that while our systems follow industry standards to protect your health information, the actual data transfer is done via your chosen third-party integration service. That service may store your data temporarily to facilitate the transfer, under strict privacy safeguards. We ensure that any such service we use commits to protecting your data to standards equivalent to our own. If you have any questions about linking your health accounts, we will provide you with information about the consent process and data that will be accessed at the time of connection.

Wearables & Fitness Data: With your explicit permission, Slothwise can integrate with your wearable devices or fitness accounts (such as smartwatches, fitness trackers, or health apps like Apple Health and Google Fit) to import health-related data. If you choose to link a wearable or fitness service to Slothwise, you will be prompted to authorize the connection. A trusted third-party integration service (acting on our behalf) will then securely retrieve select data from your device or account and transfer it to Slothwise.

Depending on what you authorize, this may include activity and exercise data (e.g. steps count, workouts, heart rate), wellness metrics (like sleep patterns or calories burned), or other health information your device tracks. We only access the specific categories of data that you consent to share, and you can review and manage these permissions at any time. Once connected, wearable and fitness sources sync on an ongoing basis, including in the background, until you disconnect them.

Slothwise uses your wearable data solely to provide and improve our health services to you, for instance, to display your fitness trends, offer personalized insights or reminders, or integrate your device metrics into health reports. We do not use any wearable-derived data for advertising, marketing, or profiling outside of your use of Slothwise, and we do not disclose it to unauthorized parties. Any analysis we perform on this data for product improvement is done on an anonymized or aggregated basis.

The third-party integration service we utilize to connect with your wearables is contractually bound to strict privacy and security standards. They act only as a conduit to fetch and transmit your data; they cannot use your information for any other purpose. We ensure that these partners implement robust safeguards (equivalent to our own) to protect your data during transfer. (For example, data is encrypted in transit, and any temporary storage on their side is handled securely and deleted as soon as it’s no longer needed for the integration.)

Using wearable integrations is entirely optional. If you enable it, you can disconnect your wearable or fitness account at any time via the app settings. Once disconnected, Slothwise will stop collecting new data from that source. (Any previously imported data remains in your Slothwise account, governed by this Privacy Policy, until you delete it or request account deletion.) We will also respect any deletion requests per our retention policy if you no longer want us to hold past wearable data.

We adhere to all applicable platform rules when handling wearable data. For instance, if you connect Apple HealthKit data to Slothwise, we will not use or disclose HealthKit-derived information for advertising or data-mining purposes, in accordance with Apple’s guidelines. Similarly, any data accessed through Google Fit or other Google APIs will be handled per Google’s User Data Policy (including its “Limited Use” requirements for sensitive health data). Our only goal in accessing wearable data is to serve you within the Slothwise app, not any third-party marketing.

Analytics: We use third-party analytics services to collect information about your app usage. This includes technical data (like device type, OS version, and unique identifiers) and engagement data (such as screens viewed and features used). We use this information to understand user behavior and improve our services. These analytics providers process usage data on our behalf and are not permitted to use your data for any other purpose. No personally identifying information (like your name or email) is included in what we share for analytics.

Communications: We may use external service providers to send you communications, such as email newsletters, account alerts, or text messages (SMS/RCS). If you provide an email address or phone number, it will be used only to send you relevant service-related communications or messages you have opted into. These messages might include verification codes, transaction receipts, appointment reminders, or updates about our services. Our third-party messaging providers will have access to your contact information solely for the purpose of delivering these communications and are contractually obligated to protect your data.

Customer Support: When you reach out for support or send us inquiries, we may use a third-party customer support platform to manage and respond to your requests. This means information you provide in a support ticket or chat (such as your email address, name, and the details of your issue) will be collected and stored in our support system. We only use this information to assist you and resolve your issues. The support service provider is bound by confidentiality and may not use your information for any purpose other than helping us support you. If we ever ask you for feedback or to fill out a support form, the data you submit will similarly be handled in a secure, third-party ticketing system. We ensure that any third-party used for customer support adheres to appropriate data protection standards.

Payments: If you make a purchase or payment through the app, we use a trusted third-party payment processor to handle your payment. Your sensitive payment details (such as credit card number or banking information) are transmitted directly to the payment processor over an encrypted connection. We do not store or see your full financial information (for example, we see only limited details like the last four digits of your card for receipt purposes). The payment processor will process your transaction and may store your payment data for future transactions or compliance reasons, in accordance with its own privacy policy. These processors are PCI-DSS compliant, ensuring your payment data is handled securely. We only share the necessary transactional information (such as the purchase amount or order ID) with them to complete the transaction.

Social Media Features: We do not automatically share your data on social media; it only happens when you intentionally tap a share button. Our service may include optional features that allow you to interact with third-party platforms, for example, sharing content to social media. If you choose to share information from the app via the provided tools, then information (such as a referral link, a snapshot or text you select to share) will be transferred to the external platform you choose. We do not automatically share your data on social media; it only happens when you actively tap a share button and confirm a share through your social network. Any information shared to a third-party platform is then subject to that platform’s privacy policy and terms. We recommend reviewing your social media accounts’ privacy settings if you share content from our app.

In addition, we may use third-party services to manage our own social media presence and posts. Those services might collect aggregate data (like clicks or engagement on our posts) but they do not collect personal information from you through our app. If we ever collect feedback or referrals via social media integrations, we will explicitly inform you what data is being collected. Rest assured, simply using our app will not send your personal data to social networks unless you explicitly initiate such an action.

We reserve the right to modify, replace, or discontinue using any of these third-party providers at our sole discretion, without prior notice. Your continued use of our services following any such change constitutes your acceptance of those modifications. We select third parties that have strong reputations for security and privacy. Whenever your data is shared with any third-party provider, we remain responsible for it and ensure that each provider is obligated to handle the data in compliance with applicable privacy laws and only for our intended purposes.

Please note, we do not guarantee the accuracy or completeness of data.

Device Access (Camera/Microphone)

Our app may request access to your device’s camera and/or microphone to enable certain features, for example, allowing you to scan documents, upload photos, or use voice input. We will always ask for your permission before accessing your camera or microphone, in accordance with platform requirements. If you grant permission, the camera may be used to take photos or videos, or the microphone used to capture audio, which you can then upload to the app.

Use of Media: Any images, audio, or videos you capture in-app are treated as user content and are handled securely. The content you choose to upload will be used only for the purposes clearly communicated at the time of capture. For instance, if you take a photo of an insurance card or medical document to upload, we will use that image to extract information (using automated text recognition if needed) and attach it to your records. If you record a voice note or provide audio (for a symptom description or a message), we may use speech-to-text processing to convert it into text. Such processing might be done via our secure servers or a trusted third-party speech recognition service, under the same privacy safeguards described in our AI section.

We do not actively monitor or record from your camera or microphone when you are not actively using a feature that requires it. You have control: you can decline to grant camera/mic access, or if you’ve granted it, you can revoke it at any time in your device settings. Declining or revoking permission will simply disable the features that require the camera or microphone (for example, you won’t be able to upload a photo or use voice dictation), but otherwise the app will remain functional.

Any media or recordings you do provide are stored securely as part of your user content. We treat this content with confidentiality (especially if it contains personal or sensitive information). Unless explicitly stated, we do not share your photos, audio, or recordings with any third parties except those needed to fulfill the service (e.g., an OCR service to read text in an image, which would fall under our AI/third-party service commitments). All such third parties are bound to protect your data and cannot use it for other purposes.

We do not use voice recordings, facial imagery, or similar inputs to create or store biometric identifiers or templates (such as voiceprints or face geometry) for identification purposes. If that ever changes, we will provide a separate notice and obtain any consent required by law.

Google Calendar Integration and Limited Use Policy

To enhance your experience, Slothwise offers an optional feature to integrate with your Google Calendar. This section describes how we access, use, store, and share Google user data in compliance with Google’s policies.

Information We Access: When you grant Slothwise permission to connect to your Google Calendar, we will access the following information on a read-only basis:

We only request read-only access to your calendar. Slothwise cannot and will not create, edit, or delete any events in your Google Calendar.

Purpose of Access: Our sole purpose for accessing your Google Calendar data is to display your existing calendar events within the Slothwise interface. This allows you to see your health appointments and personal schedule in one place to better manage your time. While your calendar is connected, Slothwise syncs your events on a recurring basis so this information stays current; syncing stops when you disconnect your calendar in the app.

Limited Use Disclosure: Slothwise’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We will not allow humans to read your calendar data unless:

AI/ML Model Training Privacy Policy Disclosure for Workspace APIs

Slothwise’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

Usage: We only use Google user data to provide or improve prominent, user-facing features within the Slothwise application. AI/ML Model Training: We do not use your personal information or health data to train or fine-tune artificial intelligence (AI) or machine learning (ML) models. We send your requests to third-party AI providers only to generate results for you, and providers are not permitted to use your data to train models that serve other customers. Google user data is never sent to any AI provider for model training. In-app personalization (such as AI memory and learning your patterns) operates only within your individual account and is not used to build or improve models that serve other users. Additionally, data obtained from Google Workspace APIs is subject to further restrictions under Google’s Limited Use requirements as described in this agreement.

Transfers: We do not transfer Google user data to third parties except for security purposes, compliance with laws, or as part of a merger/acquisition with your explicit consent.

No Advertising: Google user data is never used for serving advertisements, retargeting, or interest-based advertising.

Human Review: Our employees are prohibited from reading Google user data unless you provide explicit consent for specific support issues, it is required for security investigations, or for compliance with applicable laws.

Notifications

With your consent, we may send push notifications or in-app notifications to your device to deliver reminders, alerts, or other relevant messages. You can control these notifications in your device or app settings. We do not send marketing content via push notification without your consent.

Your Choice

Providing personal information to us is voluntary. You are free to refuse any request for personal information, with the understanding that we may be unable to provide you with some of your desired services without it. For example, if you choose not to provide an email address, you will not be able to create an account or receive email notifications like password resets. We will not collect personal data without your consent unless it’s necessary for the operation of our services (under a legitimate interest or legal requirement as described above). By providing personal information, you acknowledge that we will use it as described in this policy. If at any time you want to withdraw your consent for us to hold or use your information, you can do so by contacting us (see the Contact Us section below). Keep in mind that withdrawing consent for certain uses of your data may affect our ability to continue offering you some services (for example, if you withdraw consent for us to use your health data, core features of Slothwise may no longer function).

Information from Third Parties

If we receive personal information about you from a third-party source, we will treat that information in accordance with this Privacy Policy. For instance, if someone refers you to Slothwise or provides us with your data as part of a partnership, we will protect it just as we do information you give us directly. If you are a third party providing personal information about someone else (for example, if you are a healthcare provider or a family member submitting someone’s information with their permission), you represent and warrant that you have that person’s consent to provide their personal information to us. We will rely on you to have obtained the necessary permission and to inform them of this policy. If we find that personal data has been provided to us by a third party without the proper consent, we will delete it or seek the individual’s consent as appropriate.

Marketing Permission

If you have agreed to receive marketing communications from us (for example, if you opted in to a newsletter or promotional updates), you can change your mind at any time. We will always provide a way for you to opt out or unsubscribe from marketing emails. This is typically done by clicking the “unsubscribe” link at the bottom of our emails or by adjusting your account preferences. You can also contact us directly (see Contact Us below) to request that we stop sending you marketing messages. Please note that transactional or service-related communications (such as account notifications, password resets, or customer support responses) are not considered marketing, and you will continue to receive those as long as you have an active account, since they are necessary for providing our service to you.

Rights and Choices

We believe in providing you with meaningful control over your personal information. Depending on your state of residence, you may have the following legal rights regarding your data:

How to Exercise Your Rights: To exercise any of these rights, please submit a verifiable request to us at founders@slothwise.com. We will respond to your request within the timeframes required by applicable law. To protect your privacy, we will need to verify your identity before processing your request.

Communications via SMS or RCS: As discussed in earlier sections, if you reach out to us via SMS or RCS, we collect your phone number and message content solely to address your inquiry or deliver the service you requested. We do not use SMS/RCS information for marketing unless you explicitly opt in via those channels. Standard text messaging charges from your carrier may apply to messages you send or receive. If at any point you no longer wish to receive text communications from us, you can opt out by replying “STOP” to any message we send. You may also contact us at our email address to request removal of your number from our text messaging list. Once opted out, you will no longer receive SMS/RCS messages except where required for authentication or legal purposes. (Please note: Even after you opt out of general SMS, if you initiate a new text conversation with us (for example, a new support request), that will be treated as a new consent to communicate via SMS for that interaction. You would need to opt out again if you want to stop those responses.)

Non-Discrimination: We will not discriminate against you for exercising any of your rights over your personal information. This means that if you choose to exercise rights such as accessing your data or opting out of certain processing, we will not deny you our services or provide you a lesser experience solely because of that choice. For example, we will not refuse service, charge you a different price, or provide a different quality of service just because you exercised your privacy rights. The only exception would be if your personal information is essential to providing a certain service or feature. In that case, if you withhold that information, we may be unable to offer that feature (but we will not otherwise punish or penalize you). We treat all users equally, regardless of their privacy choices, to the extent possible under the functionality of our services.

Notification of Data Breaches

We comply with all laws applicable to us regarding any data breach. A data breach is any unauthorized access to or disclosure of personal information. If such an unfortunate incident occurs and it affects your personal data, we will notify you and the appropriate authorities as required by law. In plain terms, if we discover a security breach that compromises your personal information, we will act promptly to contain the breach, assess the scope, and inform affected users in accordance with legal requirements. We may notify you via email, through the Slothwise app/website, or other direct communication methods. We will also take any steps required by law to remedy the situation and prevent future occurrences. Because Slothwise handles health-related information and is subject to the FTC’s Health Breach Notification Rule, in the event of a breach of unsecured health information we will provide any notifications to affected individuals, the FTC, and, where applicable, the media as required by that rule and other applicable laws.

Complaints

If you believe that we have breached this Privacy Policy or violated any applicable data protection law, we want to address your concerns. Please contact us using the details in the Contact Us section below and provide a thorough description of your complaint. Specifically, let us know what you think went wrong, for example, which part of our policy you believe we haven’t followed, or what law you think we might have breached, along with relevant details about the situation. We take all complaints seriously. Once we receive your complaint, we will investigate it promptly and impartially. You will receive a response in writing, outlining the results of our investigation and any steps we will take to address your concerns or rectify any errors. Our goal is to ensure your satisfaction and confidence in how we handle your personal information.

If you are not satisfied with our response to your complaint, or you believe we are not complying with our legal obligations, you also have the right to lodge a complaint with a regulatory authority. For example, if you are a resident of California and have a complaint under the California Consumer Privacy Act (CCPA) or other privacy laws, you may contact the California Attorney General’s Office. For other jurisdictions, there may be a data protection authority or similar regulator you can reach out to. We would, however, appreciate the chance to address your concerns first, so we kindly ask that you contact us to attempt to resolve the issue before involving regulators, if possible.

Unsubscribe (Opting out of Emails)

If you have subscribed to any optional communications from us, such as newsletters, promotional emails, or other updates, you can unsubscribe at any time. To stop receiving such emails, you can click the “unsubscribe” link that is typically included at the bottom of each marketing or promotional email. Alternatively, you may contact us directly (see Contact Us below) and request to be removed from our mailing list. When contacting us, please provide the email address you want unsubscribed and identify the communications you no longer wish to receive. We may need to ask for additional information to verify your identity (to ensure the request is legitimate). Please note that after you unsubscribe, it may take a short time to process your request, during which you might still receive communications already in production. Also, even if you opt out of marketing messages, we will still send you transactional or service-related communications as needed (for example, we might still send account alerts, billing notices, or support responses, as these are not promotional).

California Residents

If you are a resident of California, you have specific privacy rights under the California Consumer Privacy Act (CCPA) (and as amended by the California Privacy Rights Act, or CPRA). These include:

To exercise any of your California privacy rights, you (or your authorized representative) can send us a request as described in the Contact Us section. Please specify which right you intend to exercise (e.g., access request, deletion request) and provide enough information for us to verify your identity (we may need to ask for additional proof of identity to ensure we are protecting your data from unauthorized access). We will respond to your request within the timeframe required by law (generally within 45 days, with the possibility of a 45-day extension, which we would communicate to you if needed).

Business Transfers

In the unlikely event that 360H, Inc. goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your personal information may be among the assets transferred. For example, if another company acquires Slothwise or if we merge with another organization, user information (including personal data) would likely be transferred so that the service can continue to operate. By providing your personal information to us, you acknowledge that such transfers may occur. In any such transfer of ownership, the successor company will assume the rights and obligations regarding your personal information as described in this Privacy Policy. The new owner may continue to use your personal information in the same manner that we do, as outlined here, to the extent permitted by applicable law. If a business transfer occurs, we will make reasonable efforts to notify you and ensure that the successor entity is aware of and agrees to uphold the commitments we’ve made in this Privacy Policy.

Limits of Our Policy

Our website and app may contain links to external websites or services that are not operated by us. Please be aware that this Privacy Policy applies only to Slothwise (services managed by 360H, Inc.). We have no control over the content or privacy practices of third-party sites or services that you might access through external links from our platform. For example, if we link to a health resource or an article on another site, and you click that link, any information you provide to that external site or how that site collects information about you is governed by their privacy policy, not ours. We cannot accept responsibility or liability for the privacy and security practices of these other websites or applications. We encourage you to review the privacy policies of any third-party sites or services you visit, especially if you navigate to them from our platform, so that you can understand how they collect and use your information.

Changes to This Policy

At our discretion, we may update or change this Privacy Policy from time to time to reflect changes in our business practices, to accommodate new features or services, or to address new legal requirements. If we make changes, we will post the updated policy on this page (accessible through the same URL), and we will update the “last updated” date at the top of the policy. Changes to the Privacy Policy become effective immediately upon being posted here, unless stated otherwise.

If the changes are significant, or if required by law, we will also provide a more prominent notice or seek your consent when appropriate. For example, we will notify you (by email, text message, or in-app notice) before a major change takes effect. In certain cases (especially if a change would allow us to use your personal information in a materially different way than we previously told you), we will either ask for your explicit consent or give you a chance to opt in or out of the new use, as applicable, before the change becomes effective.

We encourage you to periodically review this Privacy Policy to stay informed about how we are protecting your information. Your continued use of Slothwise after any changes to this Privacy Policy will signify your acceptance of those changes.

Cookies and Tracking Technologies

Slothwise uses essential cookies along with limited, privacy-protective analytics and error monitoring to keep our site working, understand how it is used, and fix problems. Cookies are small text files that are stored on your device (computer or mobile) via your web browser. We use cookies for the following purposes:

We do not use advertising or tracking pixels, and we do not share your information with advertising platforms or use it for cross-context behavioral (targeted) advertising.

By using Slothwise, you consent to our use of cookies as described in this policy. However, we respect that you have choices. You can manage or disable cookies through your browser settings. Each browser is a little different, but look for options to manage “cookies” or “tracking” in your browser’s privacy or security settings. Please note that if you disable cookies, some features of our site may not function properly (for example, you might not be able to stay logged in).

Slothwise’s website currently does not respond to “Do Not Track” (DNT) signals. DNT is a setting you can configure in some web browsers to request that websites not track your activities across different sites. Because there is not yet a common understanding of how to interpret the DNT signal, our systems may not recognize or react to it. That said, we do not engage in cross-site tracking of users, nor do we allow third parties to collect personally identifiable information about your online activities over time and across different websites through our platform. In summary, while we use cookies to enhance your experience on our own site, we do not track your browsing outside of Slothwise and third parties are not given license to do so via our site.

Relationship to Terms of Service

If any provision of our Terms of Service conflicts with this Privacy Policy, this Privacy Policy will control with respect to the collection, use, and protection of your personal information.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

360H, Inc. 299 Fremont St, Unit 3003 San Francisco, CA 94105, USA Email: founders@slothwise.com

We are committed to addressing your inquiries promptly and responsibly. Whether you need help understanding something in this policy, want to exercise one of your rights, or have a concern about how we handle privacy, please reach out. We appreciate the opportunity to communicate with you and will do our best to resolve any issues to your satisfaction.