SAECULA Privacy Notice

This notice describes the personal and health information the SAECULA website and mobile applications are designed to process. Services that collect identity, health, payment-linked, lab, appointment, medication, wearable, or consultation information must remain unavailable until the applicable privacy, security, contractual, consent, and state-licensure controls are enabled.

This engineering draft does not replace an attorney-approved Privacy Policy or, where applicable, a separate Notice of Privacy Practices.

Depending on the features you choose and the permissions you grant, we may collect account and contact information; authentication and consent records; health assessments; medication and supplement information; allergies; lab and biomarker information; wearable data; appointment and support communications; shipping information; transaction records; and technical security data.

Payment card details are handled by the applicable payment processor. Health information must not be placed in payment descriptions, metadata, receipts, or processor dashboards.

We collect health, wearable, location, camera, notification, and similar permission-based information only through the consent controls applicable to that data source and feature.

On public informational pages (for example the home, store, pricing, and help pages), we count visits with a first-party measurement that uses no cookies and no advertising or analytics vendor. It records the page, the website that referred you, any campaign tag in the link, your device type, and a code that changes every day so visits cannot be linked across days. It does not run on account, cart, checkout, assessment, results, or other pages that hold personal or health information, and it is turned off when your browser sends a Global Privacy Control or Do Not Track signal.

We may use information to operate accounts and authentication; provide requested wellness features; perform medication and contraindication safety screening; coordinate permitted orders and services; respond to support requests; prevent fraud and abuse; maintain audit records; and comply with legal obligations.

Health and wellness outputs describe trends, baselines, uncertainty, and safety limitations. Automated outputs are not diagnoses, treatment plans, or affirmative medication clearance.

Marketing messages are optional and each channel has its own choice. If you opt in to marketing email (at sign-up, in Notification Settings, or by ticking the promotional email box at checkout), we may email you offers, product news, and reminders about items left in your cart or an unfinished checkout. A reminder can list the products, quantities, and prices you selected, using our published product descriptions; it never includes assessment answers, conditions, medications, or lab results. Every marketing email has an unsubscribe link, and we stop reminders once you complete an order.

Text message reminders are sent only if you separately agree to receive recurring automated marketing texts at a mobile number you provide; consent is not a condition of purchase, and message and data rates may apply. Texts are short, do not list products, and are sent only during daytime hours. Reply STOP to any text or turn texts off in Notification Settings to stop them. If push notifications are enabled on your device, a reminder push uses generic wording only. We keep a record of when and how you gave or withdrew consent.

AI features remain disabled unless the required privacy configuration, contract evidence, and separate user choices for collection and external sharing are satisfied. When an approved external model path is used, direct identifiers are removed or replaced before provider submission and model output is screened before release.

We do not represent automated output as review by a licensed professional. A pharmacist-reviewed or human-reviewed label is shown only when the server records the verified reviewer identity, review time, and immutable audit evidence. Otherwise the service identifies the result as automated safety screening.

You may decline optional AI processing or external sharing. Declining an optional feature does not authorize a hidden legacy or less-protective fallback.

We disclose information only as needed for an enabled service, at your direction, for security and legal obligations, or to service providers whose contractual and technical requirements have been satisfied. A provider remains disabled when the required agreement or configuration is absent.

Order-fulfillment partners receive only the minimum information required for fulfillment. Payment processors receive transaction information without health data. Licensed-professional and direct-to-consumer lab services are available only when patient-state and licensure restrictions are satisfied.

We do not sell personal health information. Advertising pixels and advertising SDKs are not permitted on authenticated or health-data routes. Separate choices apply to collecting information and sharing it with another party.

Retention periods vary by data category and legal purpose. Account, health, consent, audit, security, billing, support, and backup records do not all use one retention period.

When you request deletion, we delete or de-identify eligible information and retain only information that must remain for a documented legal, security, fraud-prevention, billing, dispute, or audit purpose. Backup and log deletion follows their documented lifecycle rather than an unsupported universal deadline.

De-identified information is retained only when the de-identification and approved-use requirements are satisfied.

Subject to applicable law and identity verification, you may request access, correction, export, or deletion of your information and may withdraw optional collection or sharing choices. You may also disconnect wearable integrations and change device permissions.

State-specific health-data, privacy, telehealth, pharmacist, and lab rights and restrictions apply based on your verified location. Exercising a privacy right will not result in prohibited discrimination.

Enabled services use administrative, technical, and physical safeguards appropriate to the information involved, including least-privilege access, encrypted transport, protected storage, audit logging, and fail-closed runtime controls. No security measure eliminates all risk.

A feature remains unavailable when its required authentication, authorization, consent, encryption, audit, backup, recovery, contractual, or incident-response control is not ready.

The general consumer service is not intended for children under 18. Any future pediatric workflow requires verified guardian authority, applicable consent, state-law review, and mandatory human escalation before activation.

Questions and privacy requests may be sent to privacy@healthaevumai.com. Support requests may be sent to support@healthaevumai.com. Do not include unnecessary health details in an unencrypted email.

Material policy changes require a new version, an updated effective date, required notice or consent, and legal approval before the changed practice is enabled.