Privacy Policy

What personal data do we collect about you?

We collect the below categories of personal data from you when you access the Platform, including through the use of artificial intelligence or machine learning tools or models (“AI/ML”):

• Contact and Account Information: Name, email address, postal address, and phone number. If you create an account with us, we also collect demographic information such as your age, date of birth, and gender, in addition to your account username and password.
• Website Activity: We collect information related to your access to and use of our Platform, including the type of browser you use, access times, pages viewed, your IP address, and the page you viewed before and after visiting our Platform. We may also collect this type of information in visual form when you visit our Platform, including video snippets of your Platform activity.
• Device Information: We collect information about the computer or mobile device you use to access our Platform, including the hardware model, operating system and version, unique device identifiers, and mobile network information.
• Health Related Information: We collect information that may relate to your loved one or patient’s health that you disclose to us offline and online, such as through our consumer-facing websites, communications channels, or otherwise through the Platform as well as from sources you authorize. This may include, but is not limited to, medical records, medical insurance details, treatments for medical conditions, family medical history, medical appointments, diagnoses, and prescriptions.
• Geolocation Information: We may collect the approximate location of your device from your IP address. Additionally, we may collect your precise geolocation with your permission. We may also collect information from your device in accordance with your device settings.
• Employment and Professional Information: Place of employment, credentials, and occupation or professional membership.
• Commercial Information: Information about your product and service preferences and interests, including our products and services.
• Social Media Information: Account names, handles, biographies, and other details that you make available on social media networks.
• Other information that you may provide to us or that we may infer based on the above.

How do we collect personal data?

We collect personal data directly from you in the below contexts. We also collect personal data from you using sources like data analytics providers, social media platforms, and other service providers or third parties, including through the use of AI/ML.

• If you register an account with us or otherwise access the Platform
• In connection with your interactions, inquiries, or other requests
• If you upload or share a photo or other digital content through one of our Platforms, or share content linking to any of our social media accounts
• If you participate in a contest, promotion, or survey
• If you contact us via e-mail or through our customer service, including through the use of online chat tools that we may make available

We and our third-party vendors may use tracking tools like browser cookies, flash cookies, pixels, and web beacons to collect information from you. Please see “How do we use cookies and other tracking technologies?” for more information.

We may also collect data through sources you authorize or direct us to, such as patient portals, health care providers, or other health care organizations or entities that you authorize.

How do we use your personal data?

We may use your personal data in the following ways. We may use AI/ML in whole or in part to help achieve these purposes:

• To provide, operate, maintain, and protect our Platform;
• To analyze and improve our Platform, including developing new products or services;
• To analyze and improve our products and services, including developing new products or services and AI/ML;
• To communicate with you, respond to your inquiries, and to send you information by email, postal mail, telephone, text message, notifications, or other means about our products and services;
• To promote and conduct educational or promotional events, including those that may be in person and to support our marketing and advertising activities;
• To enhance and help us better understand your browsing experience, needs, and preferences and provide consistent, personalized services and experiences across our Platform;
• To protect the security or integrity of the Platform, including to perform security analyses to verify that the Platform is working properly and has not been compromised based on our legitimate interests;
• To protect us, our users, and the public, and comply with applicable law, regulation, or legal process, including to validate user information for fraud and risk detection purposes, resolve disputes and protect the rights of users and third parties, respond to claims and legal process (such as subpoenas and court orders), fulfill our reporting obligations, monitor and enforce compliance with our contracts, including any agreements between you and us, and otherwise detect, prevent, or stop any activity that may be illegal, unethical, or legally actionable; and
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our customers is among the assets transferred.

How do we disclose your personal data?

We never sell your data. We only share it to run and improve the service, or when you tell us to. We disclose your personal data to the following categories of parties. Please note that some of all of these parties listed below may use their own AI/ML to provide services to us or otherwise in their capacity as an independent data controller.

• Service providers: We share data with vendors and consultants who help us run and improve the service, such as: auditing and accounting firms, professional services consultants, providers of data hosting, storage, and analytics services, AI providers, and IT and security vendors.
• Social media platforms: Where you choose to interact with us through social media, your interaction with these platforms typically allows the social media company to collect some information about you through cookies and other digital tracking mechanisms that they place on your device. In some cases, the social media company may recognize you through these technologies even when you do not interact with their platform. Please visit the social media companies’ respective privacy policies to better understand their data collection practices and the controls they make available to you.
• Companies involved in advertising: We may work with companies that assist us in advertising our Platform to you and others who may be interested in the Platform.
• Corporate affiliates: We share personal data with our subsidiary companies.
• Business partners: We may work with other companies to provide you with certain product or service offerings.
• Law enforcement, government agencies, or parties in a legal proceeding: We may share personal data with these entities to comply with the law or assist law enforcement. We may also provide your personal data to third parties in the context of a subpoena or similar legal process.
• Third parties in the context of a merger or similar business transaction.

Google user data and Limited Use

Zelo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is processed only to provide user-facing features. It is shared with our AI provider, Anthropic (Claude), solely to operate these features and is never used to train generalized AI/ML models.

Text messages

If you give us your mobile number and agree to receive text messages, we use it only to send you messages about your account and the care you manage with Zelo, and to reply when you text us. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are never shared with or sold to any third party. The service providers that deliver our messages receive your number only to deliver them.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. You can also reach us at the address under “Contact Us” below.

How do we use cookies and other tracking technologies?

We and our third-party vendors use cookies, pixel tags, and other tracking technologies on the Platform in a variety of ways to enhance or personalize your online browsing experience. These tracking technologies help us better understand your needs and preferences and tell us which parts of our Platform you have visited and provide consistent and personalized services and experiences. These tracking technologies gather information over time and across different websites about you, some of which may be personal data as identified above in “What personal data do we collect about you”.

You can set your browser not to accept cookies or to notify you when you are sent a cookie, giving you the opportunity to decide whether or not to accept it. If you do not accept cookies, however, you may not be able to access your account information or utilize certain functionalities on our Platform. Please note that our Platform does not currently recognize “Do Not Track” signals. However, our Platform may recognize certain opt-out preference signals, such as the Global Privacy Control, and will process such signals in accordance with applicable law, potentially including “do not sell”, “do not share”, “limit the use or disclosure of sensitive personal information,” and opt out of targeted advertising requests. You may set such a signal through your browser or browser extension.

Third-Party Links

Third-party links on the Platform may direct you to third-party websites that are not affiliated with us, including social media platforms. We are not responsible for the content or accuracy of third-party websites, or for any other materials, products, or services of third parties.

We are not liable for any harm or damages related to the purchase or use of goods, services, resources, content, or any other transactions made in connection with any third-party websites. Please review carefully the third party’s policies and practices and make sure you understand them before you access their website. Complaints, claims, concerns, or questions regarding third-party products should be directed to the third party.

How do you protect my personal data?

We take reasonable precautions, including implementing physical and electronic safeguards, to help protect the security and privacy of your personal data. This includes encrypting your data in transit and at rest. However, please be aware that no means of transmitting data over the internet is 100% secure. Please take steps to protect your own personal data, such as by selecting a unique and complex password for your account. Zelo has implemented necessary administrative, organizational, and technical measures and safeguards to ensure that your personal data is protected as required by applicable federal and state privacy laws. We comply with all applicable federal and state data breach notification laws, including data breach notification requirements and as outlined in our data breach notification and reporting policy.

Do we collect children’s information?

We will never knowingly request personal data from anyone under the age of 18. Our Platform is not targeted to or intended for use by children. However, if we learn that we have received personal data from a child under the age of 18 without appropriate parental consent, we will delete that information from our database.

How long do we keep your personal data?

We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Platform to you (for example, for as long as you have an account with us);
• Whether there is a legal obligation to which we are subject (for example, we are required to keep records of your transactions for a certain period of time); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

What choices do I have about my personal data?

You can review and change certain personal data related to your use of the Platform (such as your name and contact information) by signing into your account or by contacting us as described in the section entitled, “Contact Us” below.

If you prefer not to receive promotional communications from us, such as information about special offers, you can let us know by contacting our customer service as described in the section entitled, “Contact Us” below. You may also follow the instructions included with the message, such as by following unsubscribe or opt out links. Please note that we may still send you messages in response to your inquiries or about other non-promotional items, such as managing your account or relationship with us.

Do I have any rights to my personal data?

You may have the rights listed below (“Data Subject Rights”) with respect to the personal data that we collect or process about you, however, these rights differ depending on your place of residency, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Please note that we reserve the right to honor your Data Subject Rights to the extent required by applicable law. We may not be required to honor your request if we do not engage in the underlying activity, are not subject to a particular law, or there are applicable exceptions under the relevant law.

• Right to Confirm Processing, Access, and/or Obtain a Copy: If you ask us, we will confirm whether we are processing your personal data. Additionally, upon request, we will provide you with a copy of all personal data you are lawfully entitled to receive, potentially including specific pieces of information, along with certain other details.
• Right to Amend: If you believe your personal data is inaccurate or incomplete, you may request that we correct it.
• Right to Delete: You may request that we delete personal data that we maintain about you.
• Right of Portability: You may request that we move, copy, or transfer the electronic personal data that we hold about you to another organization.
• Right to Revoke Consent and/or Opt Out of Certain Processing Activities: You may ask us to restrict or stop the processing of your personal data. This includes general requests and requests in specific contexts, such as if we process personal data that is considered “sensitive” under applicable U.S. state laws or engage in certain automated decision-making activities.
• Right to Limit Use and Disclosure of Sensitive Personal Data: You may ask us to limit the use and disclosure of sensitive personal data.
• Right to Opt Out of Targeted Advertising or “Sharing”: Targeted advertising is the practice of serving you tailored advertisements based your personal data gathered over time and across other businesses, websites, applications, or services. Some jurisdictions may refer to this activity as “sharing.” We do not currently engage in this practice, but you have the right to opt out of this activity if we do so in the future.
• Right to Opt Out of Sales: We never sell your personal data. Some jurisdictions may consider targeted advertising a “sale” of personal data; we do not engage in that practice either. If this ever changes, we will update this policy and ask for your consent before doing so, and you may opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising Data Subject Rights, but we may charge a reasonable fee as permitted by law in fulfilling these rights, such as if you request multiple copies of your personal data.
• Right to Appeal: If we deny your request to exercise a Data Subject Right, you may have the right to appeal the decision with us. If you would like to appeal a prior decision, please be sure to include information about your prior request so that we may locate our earlier determination.
• Right to Lodge a Complaint: You may submit a complaint to the competent supervisory authority in the country or state in which you live if you have any concerns about our processing of your personal data or if we deny your appeal to review a prior decision about your Data Subject Rights.

If you or your authorized agent would like to exercise a Data Subject Right, you may do so by following the instructions in “Contact Us” below. Please note that you may also login to your account to access and correct your account information at any time.

In order to process your request to exercise a Data Subject Right, we will ask you to verify your identity by confirming your name, e-mail address, phone number, or other identifiable information that we have in our records, such as most recent interaction with us, if applicable.

If you exercise your right to appeal our determination with respect to your Data Subject Rights, and we deny your appeal, you may have the right to submit a complaint to your regulator.

State Regulator Contact Information

California: California Privacy Protection Agency and the California Attorney General

Colorado: Colorado Attorney General

Connecticut: Connecticut Attorney General

Delaware: Department of Justice

Iowa: Iowa Attorney General

Indiana: Indiana Attorney General

Maryland: Consumer Protection Division

Minnesota: Minnesota Attorney General

Montana: Montana Attorney General

Nebraska: Nebraska Attorney General

Nevada: Nevada Attorney General

New Hampshire: New Hampshire Attorney General

New Jersey: Division of Consumer Affairs

Oregon: Oregon Attorney General

Rhode Island: Rhode Island Attorney General

Tennessee: Tennessee Attorney General

Texas: Texas Attorney General

Utah: Utah Attorney General

Virginia: Virginia Attorney General

Cross Border Transfers

Company is headquartered in the United States and uses service providers around the world. As part of our data processing activities, we may transfer your personal data across borders, including into countries whose laws protecting personal data may not be as robust as your home country’s laws. We endeavor to take reasonable steps to have adequate safeguards in place to protect your personal data when it is transferred across borders.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time and notify you in accordance with law, which may include email or other notice posted to the Platform. Any changes to this Privacy Policy will become effective when we notify you of the changes. Your use of the Site or Platform following any such updates will constitute your acceptance of such updates.

Contact Us

For questions about our privacy policy, to make choices about receiving promotional communications, to request to exercise a Data Subject Right, or to update your personal data, you can contact us by email, at legal@zelo.ai, or by writing us at Zelo Health Inc., 2810 North Church Street, PMB 735222, Wilmington, Delaware 19802, United States.