Consumer Health Data Privacy Policy
Applies to the Lorae website, mobile application, and related services.
Effective Date: 9/14/2026 | Last Updated: 9/14/2026
This Consumer Health Data Privacy Policy ("Health Data Policy") describes how Lorae LLC ("Lorae," "we," "us," or "our") collects, uses, shares, retains, and protects consumer health data through the Lorae website, mobile application, and related services (collectively, the "Services"). It supplements the Lorae Privacy Policy. This Health Data Policy is intended to provide disclosures required by applicable U.S. consumer health data laws. Rights and obligations vary by jurisdiction. This Health Data Policy is not a HIPAA Notice of Privacy Practices issued by a healthcare provider. Where Lorae processes protected health information (PHI) as a business associate of a HIPAA-covered entity, HIPAA and the applicable business associate agreement govern that processing to the extent applicable.
1. What We Mean by Consumer Health Data
"Consumer health data" generally means personal information that is linked or reasonably linkable to a consumer and identifies or reveals, or may be used to identify or infer, information about the consumer's physical or mental health status, condition, treatment, or other health-related characteristics, as defined by applicable law. For Lorae, consumer health data may include information you voluntarily enter, information generated through your use of health- or wellness-related features, and health-related information or inferences derived from that information.
2. Categories of Consumer Health Data We May Collect
Mood check-ins, mood labels, mood scores, emotions, thoughts, behaviors, experiences, and notes associated with those entries.
Habit, fundamentals, sleep, activity, gratitude, journal, goal, action, progress, and reflection information.
Information entered into Toolkit+ and other structured activities, including Thought Records, Behavioral Experiments, Worry Time, Exposure Practice, Hierarchy Planners, Anxiety Cycle, Thinking Patterns, Values & Actions, and other current or future educational or skills-based tools.
Ratings, completion information, clinician-assigned activities, and information associated with your use of Clinician's Corner or a clinician connection.
Information about therapy or healthcare interactions that you choose to enter or make available through Lorae.
Patterns, trends, summaries, correlations, personalized insights, or other health-related information inferred or derived from information processed through the Services.
Technical or usage information that may qualify as consumer health data when linked to use of a health-related feature or used to identify or infer health status.
Lorae does not intend to collect precise GPS location, biometric identifiers, photos, camera or microphone content, contacts or address-book data, financial account information, or government-issued identifiers unless a future feature expressly requires such information and Lorae first provides any notice and obtains any consent required by law. See the Lorae Privacy Policy for a broader description of personal information processed through the Services.
3. Sources of Consumer Health Data
We may collect consumer health data from sources including, but not limited to:
You, when you enter information or use health- or wellness-related features.
Your interactions with the Services, including, but not limited to, information generated when you complete activities, use tracking features, or view progress and patterns.
A clinician or healthcare organization connected to your account, when authorized and consistent with the applicable relationship, product configuration, and law.
Service providers or processors acting on our behalf when necessary to operate, secure, support, or provide requested features of the Services.
Other sources you affirmatively choose to connect or authorize if Lorae offers such integrations in the future.
4. Why We Collect and Use Consumer Health Data
We collect and use consumer health data for purposes disclosed in this Health Data Policy, permitted by law, or separately authorized by you, to:
Provide, operate, maintain, and secure the Services and features you request.
Store and display information you choose to record.
Track and display your history, goals, actions, progress, and completed activities.
Generate requested patterns, trends, correlations, summaries, personalized insights, or other in-app features.
Provide Toolkit+ and other structured educational and skills-based exercises.
Support clinician connections, clinician-assigned activities, and user-controlled sharing through Clinician's Corner or related features.
Provide customer support, troubleshoot technical issues, prevent fraud or misuse, and protect account and service security.
Comply with applicable law and establish, exercise, or defend legal rights.
Create and use deidentified or aggregated information where permitted by law.
Where applicable law requires affirmative consent before collecting or using consumer health data for a particular purpose, we will obtain that consent unless a legal exception applies. We will not collect, use, or share additional categories of consumer health data, or use consumer health data for materially different purposes, when applicable law requires prior disclosure and consent without first providing the required disclosure and obtaining the required consent.
5. Clinician Connections and Client-Controlled Sharing
Lorae may allow you to connect with a clinician or healthcare organization, receive clinician-assigned exercises, and make other information available through Clinician's Corner or related sharing features. Where Lorae represents sharing as client-controlled, you control whether the applicable information is shared through that feature. The information available to a connected clinician depends on the current product configuration, your sharing choice, organization settings, and applicable law. Limited operational information may be processed or displayed when necessary to maintain a connection, administer an assignment, show completion status, maintain security, or comply with law. A clinician's technical ability to access information does not mean that the clinician has reviewed it or will respond to it. Once information has been received by a clinician or healthcare organization, that recipient may maintain it under its own legal, professional, or recordkeeping obligations. Disconnecting or changing sharing settings does not necessarily delete information already received by that recipient.
6. Categories of Consumer Health Data We Share
Depending on how you use Lorae, we may share:
Consumer health data you direct Lorae to make available to a connected clinician or healthcare organization.
Information necessary to administer a clinician connection or clinician-assigned exercises, consistent with the product's current settings, permissions, and applicable law.
Consumer health data processed by vendors that provide necessary hosting, storage, security, authentication, communications, customer support, analytics, artificial-intelligence processing, or other operational services to Lorae, when applicable.
Consumer health data that must be disclosed by law or that may lawfully be disclosed to protect legal rights, safety, security, or the integrity of the Services.
7. Categories of Recipients
Consumer health data may be shared with the following categories of recipients when permitted by law:
Clinicians and healthcare organizations you choose to connect with or that provide services to you through Lorae.
Cloud hosting, data-storage, security, authentication, communications, customer-support, analytics, artificial-intelligence, and other processors that support operation of Lorae, when applicable.
Professional advisers, regulators, law-enforcement authorities, courts, or other recipients when disclosure is required or permitted by law.
A successor or transaction counterparty in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to applicable consumer health data restrictions.
Specific affiliates with which Lorae shares consumer health data: None.
Where required by law, Lorae enters into contracts with processors that limit processing to documented instructions and require appropriate privacy and security protections.
8. Artificial Intelligence and Automated Processing
Certain Lorae features may use artificial intelligence or other automated systems to generate requested patterns, summaries, insights, or responses. If a feature sends consumer health data to an external artificial-intelligence provider, Lorae will provide the disclosures and obtain the consent required by applicable law before that processing occurs.
Lorae does not use identifiable user-entered consumer health data to train external general-purpose artificial-intelligence models unless Lorae provides appropriate notice and obtains any consent required by law. Any statement about a particular provider's retention, model-training, or security practices will reflect Lorae's current contract, configuration, and verified provider practices. Automated outputs are informational features and are not diagnoses, clinical risk assessments, medical conclusions, or substitutes for professional judgment or care.
9. Sale, Targeted Advertising, and Third-Party Collection
Lorae does not sell consumer health data. Lorae does not use consumer health data for targeted advertising. Lorae does not knowingly permit third parties to collect consumer health data over time and across unaffiliated websites or online services for targeted advertising. Operational providers may process limited information on Lorae's behalf for functions such as hosting, security, diagnostics, support, or permitted analytics, subject to applicable contracts and law. If Lorae ever proposes to engage in an activity that constitutes a sale of consumer health data under applicable law, we will obtain the separate authorization or consent required by law before doing so and provide all required disclosures.
10. Your Consumer Health Data Rights
Depending on where you live and the law that applies, you may have the right to:
Confirm whether Lorae is collecting, sharing, or selling consumer health data about you.
Access consumer health data about you.
Receive information about third parties or affiliates with whom your consumer health data has been shared or sold, where required.
Withdraw consent to future collection or sharing of consumer health data, subject to legal exceptions.
Request deletion of consumer health data.
Correct inaccurate consumer health data where applicable law provides that right.
Obtain a copy or portable version of consumer health data where applicable.
Appeal Lorae's refusal to act on a request where applicable.
Exercise applicable rights without unlawful discrimination.
11. How to Exercise Your Rights
You may submit a consumer health data request through privacy controls available in the Services, if provided, or by contacting support@loraeapp.com. You do not need to create a new account solely to submit a request, although we may ask you to use an existing account or provide information reasonably necessary to authenticate your identity.
We will respond within the time required by applicable law. Where applicable law provides an appeal right, a denial will explain how to appeal. Unless another method is provided in the denial, you may submit an appeal to support@loraeapp.com with the subject line 'Privacy Appeal.' If an appeal is denied, we will provide information about contacting the appropriate regulator when required by law. We will not unlawfully discriminate against you for exercising applicable consumer health data rights.
12. Deletion
When applicable law requires deletion, we will delete qualifying consumer health data from our records and direct applicable processors, contractors, affiliates, and other recipients to honor the deletion request, subject to legal exceptions. You may request account deletion using the in-app account-deletion process, if available, or by contacting support@loraeapp.com. Consumer health data stored in archived or backup systems may be deleted on a delayed schedule where applicable law permits. Information already received and maintained by a clinician or healthcare organization may be subject to that recipient's independent legal and professional recordkeeping obligations. A request to Lorae does not necessarily require an independent healthcare provider to delete its own records.
13. Consent and Withdrawal
Where required, Lorae will obtain affirmative, voluntary consent before collecting or sharing consumer health data unless the processing is necessary to provide a product or service you requested or another legal exception applies. Where required, consent to share consumer health data will be separate and distinct from consent to collect it. You may withdraw applicable consent prospectively through available product controls or by contacting support@loraeapp.com. Withdrawal may affect Lorae's ability to provide features that require the relevant data. Consent to a sale of consumer health data, if ever applicable, would be obtained separately as required by law.
14. Data Retention
We retain consumer health data for as long as reasonably necessary to provide the Services, maintain your account, satisfy the purposes described in this Health Data Policy, comply with legal and contractual obligations, maintain appropriate security and audit records, resolve disputes, and enforce agreements. When an account is deleted, Lorae will delete or deidentify associated consumer health data unless retention is required or permitted by law, necessary for security or fraud prevention, subject to a healthcare organization's recordkeeping obligations, or otherwise subject to a valid exception. Lorae will not state a fixed deletion period unless that period reflects the production system and applicable legal requirements.
15. Security
Lorae maintains administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of consumer health data and to restrict access to personnel, contractors, and processors with a legitimate need for access. No system or transmission method can be guaranteed to be completely secure. Public statements about encryption, access controls, audit logging, certifications, retention periods, or other technical safeguards will reflect Lorae's actual production implementation.
16. Geofencing
Lorae does not use geofencing around mental-health, reproductive-health, or other healthcare facilities for the purpose of identifying, tracking, collecting data from, or sending health-related messages or advertisements to consumers where prohibited by applicable law.
17. Consumer Health Data and HIPAA
Consumer health data laws and HIPAA are separate legal frameworks. Some information processed by Lorae may be PHI governed by HIPAA when Lorae acts as a business associate of a HIPAA-covered entity. Other health-related information may not be subject to HIPAA but may be protected by state consumer health data laws, the FTC Act, the FTC Health Breach Notification Rule, or other applicable laws.
18. Children and Teen Users
Lorae's consumer Services are currently intended for individuals age 18 or older. Lorae does not knowingly permit individuals under 18 to create consumer accounts. If Lorae later permits users ages 13 through 17, this Health Data Policy, the Privacy Policy, Terms of Use, Legal Notice, consent architecture, clinician-sharing controls, and other applicable disclosures will be revised before that change is implemented.
19. Material Changes to This Health Data Policy
We may update this Health Data Policy from time to time. We will update the "Last Updated" date and provide notice of material changes as required by law. Where applicable law requires affirmative consent before Lorae collects, uses, or shares additional categories of consumer health data or uses consumer health data for additional purposes, we will obtain that consent before the new processing begins.
20. Contact
Consumer health data questions, requests, consent withdrawals, and appeals: support@loraeapp.com
Lorae LLC