Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Nemrut Holdings, LLC ("Cōrta," "we," "us") collects, uses, shares and deletes consumer health data through the Cōrta app and getcorta.app. It is written to meet the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data provisions, and similar state laws. It supplements our Privacy Policy. If they conflict, this policy controls for consumer health data.

Cōrta is intended for use in the United States, on iPhone and the web.

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status, including inferences drawn from other data.

1. Consumer health data we collect

With your permission, the Cōrta app reads four types of data from Apple Health (HealthKit): heart rate variability (HRV), resting heart rate, sleep, and respiratory rate. Access is read-only: Cōrta never writes to Apple Health and doesn't read any other health data.

• Data from Apple Health (only if you connect): heart rate variability (HRV), resting heart rate, sleep, and respiratory rate. This data is read on your device and is not sent to us. The app keeps one daily HRV average for up to 90 days, encrypted, on your device only.
• Entries you log yourself: check-ins (energy, mood, brain fog, anxiety, sleep quality, wind-down calm, puffiness, cravings, alcohol and notes), symptoms, meal timing, exercise, protocol steps, supplements and doses, and lab results such as cortisol and DHEA-S values. Also any health information you type into AI chat.
• Your protocol: the protocol you choose, including a recommended one you keep, or one you build. It can suggest something about your health. The goal you pick during setup (for example burnout recovery) stays on your device; we don't receive it.
• The fact that you connected a health app (a yes/no setting).
• Website reading (only if you allow analytics on getcorta.app): which pages and articles you read and which buttons you click. It isn't linked to an account, but an article's topic can suggest a health interest.

We do not collect precise location, and we do not collect biometric data used to identify you.

2. Sources

We collect consumer health data from you (what you enter in the app or chat) and from your device's health platform (Apple Health), only with your permission. We do not buy health data or get it from data brokers.

3. How we use it

Only to provide the features you ask for:

• show your rhythm, trends and insights in the app;
• sync your own entries to your account so you can use them on other devices, if you sign in;
• answer your questions in AI chat;
• check a chat message you send before subscribing or allowing Cōrta AI for crisis wording, so we can show crisis resources like 988 and 911 (it isn't sent to an AI model, linked to your account or stored);
• recommend a protocol based on the goal you choose (worked out on your device);
• keep the service secure and working, and meet legal obligations.

We do not use consumer health data for advertising or marketing, do not sell it, and do not use it to build profiles for anyone else.

4. Who we share it with

We share consumer health data only with service providers (processors) that act on our instructions under contract, and only for the purposes above:

• Supabase: hosts our database and sign-in. Stores your synced entries (including your protocol), profile and AI chat history. It also runs the crisis-wording check on chat messages you send before subscribing or allowing Cōrta AI. Those messages aren't stored or logged; Supabase keeps only a standard record of each request for about a week: the time, IP address, the approximate location that IP address points to (city and postal code), network provider, device or browser type, and technical details such as the size of the request.
• OpenRouter and the AI model provider it routes to (by default Google Gemini, OpenAI, Anthropic Claude or DeepSeek): receive your AI chat message, your current protocol and your self-entered daily logs to generate a reply. OpenRouter also receives your Cōrta account ID, a random code that doesn't include your name or email, so it can detect abuse. They do not receive Apple Health data.
• PostHog (product analytics, only if you allow analytics): receives usage events linked to your account ID. Never your health readings, the entries you log, your goal, your protocol or your chat messages. On our website it also receives which pages and articles you read and which buttons you click, not linked to an account. We use heatmaps on our website and web app. They record where you click, where your pointer moves and how far you scroll on a page, along with the page address, but not the text on the page and not anything you type or enter. We don't record your screen or sessions. Heatmaps follow your analytics choice: turning analytics off stops them from then on. On our website and web app we also measure page speed (how quickly pages load and respond). These measurements contain no health data and also follow your analytics choice.
• RevenueCat, Stripe and Resend (subscriptions, web payments and email): receive what they need for billing and email, such as your account ID, email address, plan and purchase dates, as described in our Privacy Policy. They never receive your health readings, the entries you log, your protocol or your chat messages.

Data from Apple Health is not shared with anyone, including these providers. We may also disclose data when the law requires it, for example to answer a valid court order.

5. We do not sell consumer health data

We do not sell consumer health data. We will not sell it unless we first get your separate, signed valid authorization as required by law, which you can revoke at any time. We have no plans to sell it.

6. No geofencing

We do not use geofences around health care facilities or any other location, and the app never asks for or collects your device's location. Our hosting provider's standard request records include an approximate location (city and postal code) based on your IP address, as described in section 7.

7. How long we keep it

• Apple Health data: on your device only, with up to 90 daily HRV averages. Deleted when you sign out, delete your account, reset the app, use Clear HRV history, or uninstall.
• Synced entries: until you delete them, use Reset all data while signed in, or delete your account. When you sign out in the iPhone app, Cōrta removes your entries, your profile (including your name and email), your Cōrta AI chat, your protocol choice and the Apple Health readings Cōrta saved from that phone. Your data in the Apple Health app itself isn't changed. Anything already synced stays in your account, and you get it back when you sign in again. Just before signing out, the app tries to sync your latest changes. If anything still hasn't synced, for example because you're offline or because you haven't allowed your entries or Cōrta AI chats to sync, the app asks you first. If you continue, it's deleted from the phone and can't be recovered. In the web app, signing out removes your Cōrta data from that browser, and anything that hasn't synced may be lost.
• AI chat history: kept in the app on your device and, if you've allowed Cōrta AI and are signed in, in your account. You can't delete single messages. Reset all data erases it from this device and your account, and Delete account erases it from our servers.
• Records of your consent choices: When you allow, decline or withdraw consent for a use of your health data, we keep a record: your account ID, which consent it was, the version of the wording you saw, your choice, the date and time, and whether you were on iPhone or the web. It never contains your health information. We keep these records while your account exists. If you delete your account, we keep only a minimal version, linked to coded (hashed) forms of your account ID and email address instead of the readable ones, for 3 years, so we can show that we asked for and honored your choices, as the law allows. Then we delete it.
• Messages checked only for crisis wording (sent before you subscribe or allow Cōrta AI): not kept. They're checked and discarded. Supabase's standard record of each request is kept for about a week: the time, IP address, the approximate location that IP address points to (city and postal code), network provider, device or browser type, and technical details such as the size of the request, never the message.
• Analytics events in PostHog (only if you allowed analytics): Turning analytics off applies to future events; events already sent are deleted on a rolling schedule, or sooner if you ask us at privacy@getcorta.app.
• Backups: our database backups are kept for up to 7 days, so copies of deleted data in backups are removed within 7 days after deletion.
• Consent choices saved on your device: saved on your device with the date and the version of the wording you saw, never your health information. If you sign out, your choices for Apple Health, health entries and Cōrta AI stay on that device for your account and are used again only if you sign back in. Your analytics choice is removed from the device when you sign out and restored from your account when you sign back in. Choices you make while signed out stay on the device until you sign in, change them, uninstall the app or clear this site's data in your browser. Deleting your account removes them from the device once our servers confirm the deletion. Uninstalling the app, or for the web app clearing this site's data in your browser, removes them.

8. Your rights

Depending on where you live, you have the right to:

• know and access the consumer health data we collect and share, including a list of the third parties and processors we share it with (see section 4);
• withdraw consent to collection or sharing at any time;
• delete your consumer health data. We delete it from our systems and from Supabase, which hosts them, except the record of your privacy choices described in section 7; copies in database backups are removed within 7 days. OpenRouter and the AI providers keep the messages they already received under their own retention terms (see section 4). Analytics events already sent to PostHog are deleted on a rolling schedule, or sooner if you ask us at privacy@getcorta.app;
• appeal if we decline your request.

We won't discriminate against you for using these rights. Withdrawing consent may turn off features that need the data. For example, AI chat can't answer without your message.

9. How to use your rights

• In the app: Profile → Privacy choices (turn any choice on or off), Profile → Account → Delete account (delete your account and everything synced, except the record of your privacy choices described in section 7), Profile → Reset all data (erases your logs, labs, chat and settings on this device; if you're signed in, Cōrta also removes the synced copies of those entries and messages from your account the next time it syncs, but keeps your account and profile). To stop Apple Health reads, turn off access in iPhone Settings > Health > Data Access & Devices.
• Each device separately: your choices are saved on each device. Turning a choice off on one iPhone doesn't change it on another, so withdraw on each device you use, or delete your account to remove everything synced, except the record of your privacy choices described in section 7.
• By email: privacy@getcorta.app, subject "Consumer health data request", from the email address on your account.
• By mail: Nemrut Holdings, LLC, 30 N Gould St Ste N, Sheridan, WY 82801.

We'll verify your request and respond within 45 days. We may extend that by 45 more days where the law allows, and we'll tell you if we do. If we decline, you can appeal by replying to our decision with "Appeal" in the subject. We'll answer the appeal within 45 days. If you're not satisfied, you can contact your state attorney general. (Washington: atg.wa.gov/file-complaint.)

An authorized agent may make a request for you where the law allows, with proof of authority.

10. Changes

If we change how we collect, use or share consumer health data, we'll update this page and its date. Before we use or share it in a materially different way, we'll ask for your consent again.

11. Contact

Nemrut Holdings, LLC, 30 N Gould St Ste N, Sheridan, WY 82801 · privacy@getcorta.app