Consumer Health Data Privacy Notice

1. Scope and operator

Aldrick is operated by USA Research Group LLC. This notice applies to health-related information you provide to Aldrick and to results Aldrick derives from it. Aldrick is an educational platform and does not provide diagnosis, treatment or emergency services.

2. Categories of consumer health data we collect

• Health assessment responses.
• Body measurements such as height, weight and waist.
• Blood-pressure readings and other cardiovascular information.
• Sleep information, including sleep duration and sleep-related symptoms.
• Sexual-health information.
• Mental and cognitive information.
• Activity and strength information.
• Hormone and lab information where Aldrick supports entering it.
• Medications, conditions, lifestyle information and selected goals.
• Derived information: health scores, category scores, confidence indicators, plans, signals and educational insights.

3. Sources

• Directly from you, through assessments, measurements and profile settings.
• Derived from the information you provide, using Aldrick's deterministic scoring and rules.

Aldrick does not connect wearables or fitness trackers in the current MVP, and does not obtain health data from data brokers.

4. Purposes

• Providing the assessments, scores, confidence indicators, plans, measurement history, explanations and educational safety information you request.
• Maintaining, debugging and securing the platform.
• Sending follow-up emails when the follow-up preference is enabled.
• Complying with applicable law.

5. Consent to collection

Affirmative consent will be required before health-data collection in the external private beta. Consent to these policies is part of private-beta access, and we will record the policy versions shown on these pages when consent is captured.

This notice does not claim that a consent record already exists for your account. If you are using Aldrick during internal staging, ask us at privacy@aldrick.com about the status of consent recording for your account.

6. Processors and disclosures

We share consumer health data only with service providers that process it on our behalf to deliver the service:

• Supabase — authentication and database.
• Cloudflare and Lovable — application hosting and runtime.
• Lovable AI Gateway and OpenAI — AI-supported explanations.
• Resend — email delivery.
• Authorities or professional advisers where legally required.

Service-provider processing under contract is not a sale of data. We do not sell consumer health data.

7. AI processing (AI notice version 2026-08-14)

• Structured health context derived from your answers and results may be sent through Lovable's AI Gateway to OpenAI to generate an explanation.
• Your email address and direct account identifiers are not intentionally included in that request payload.
• AI does not calculate the deterministic Aldrick score and does not diagnose you.
• There is currently no free-text “Ask” feature that sends open-ended messages for AI processing.
• AI wording can be incomplete or inaccurate.

8. No sale and no targeted advertising

In the current system, Aldrick does not sell consumer health data and does not use consumer health data for targeted advertising. Any future change would be disclosed, with the choices required by applicable law, before it applies.

9. Your rights

• Confirm whether we collect, share or sell your consumer health data.
• Access the consumer health data associated with your account.
• Correct inaccurate information where applicable, including by updating your answers.
• Delete your consumer health data.
• Withdraw consent to collection and processing.
• Appeal a denied request, where an appeal right applies.

Submit requests to privacy@aldrick.com. We may need to verify your identity securely before we act on a request.

10. Deletion

When we verify a deletion request, we delete consumer health data from active systems and, as required by applicable law, communicate the request to relevant processors.

Copies in backups and records we are required to retain by law may be handled as permitted by law. We do not promise a guaranteed deletion timeline.

11. No geofencing

Aldrick does not use geofencing around healthcare facilities, and does not use geofencing to collect health data or send health-related messages, in its current implementation.

12. Changes, effective date and contact

The version identifier and effective date at the top of this page show the current version of this notice. We will update it as Aldrick develops.

Contact us at privacy@aldrick.com or by mail:

• USA Research Group LLC
• 2260 Ringling Blvd, Suite 320
• Sarasota, FL 34120
• United States