Applies to the Lorae website, mobile application, and related services.
Effective Date: September 14, 2026 | Last Updated: September 14, 2026
This Consumer Health Data Privacy Policy ("Health Data Policy") describes how Lorae LLC ("Lorae," "we," "us," or "our") collects, uses, shares, retains, and protects consumer health data through the Lorae website, mobile application, and related services (collectively, the "Services"). It supplements the Lorae Privacy Policy.
This Health Data Policy is intended to provide disclosures required by applicable U.S. consumer health data laws. Rights and obligations vary by jurisdiction. This Health Data Policy is not a HIPAA Notice of Privacy Practices issued by a healthcare provider. Where Lorae processes protected health information (PHI) as a business associate of a HIPAA-covered entity, HIPAA and the applicable business associate agreement govern that processing to the extent applicable.
"Consumer health data" generally means personal information that is linked or reasonably linkable to a consumer and identifies or reveals, or may be used to identify or infer, information about the consumer's physical or mental health status, condition, treatment, or other health-related characteristics, as defined by applicable law.
For Lorae, consumer health data may include information you voluntarily enter, information generated through your use of health- or wellness-related features, and health-related information or inferences derived from that information.
Lorae does not intend to collect precise GPS location, biometric identifiers, photos, camera or microphone content, contacts or address-book data, financial account information, or government-issued identifiers unless a future feature expressly requires such information and Lorae first provides any notice and obtains any consent required by law. See the Lorae Privacy Policy for a broader description of personal information processed through the Services.
We may collect consumer health data from:
We collect and use consumer health data for purposes disclosed in this Health Data Policy, permitted by law, or separately authorized by you, including to:
Where applicable law requires affirmative consent before collecting or using consumer health data for a particular purpose, we will obtain that consent unless a legal exception applies. We will not collect, use, or share additional categories of consumer health data, or use consumer health data for materially different purposes, when applicable law requires prior disclosure and consent without first providing the required disclosure and obtaining the required consent.
Lorae may allow you to connect with a clinician or healthcare organization, receive clinician-assigned activities, and make information available through Clinician's Corner or related sharing features.
Where Lorae represents sharing as client-controlled, you control whether the applicable information is shared through that feature. The information available to a connected clinician depends on the current product configuration, your sharing choice, organization settings, and applicable law. Limited operational information may be processed or displayed when necessary to maintain a connection, administer an assignment, show completion status, maintain security, or comply with law.
A clinician's technical ability to access information does not mean that the clinician has reviewed it or will respond to it. Once information has been received by a clinician or healthcare organization, that recipient may maintain it under its own legal, professional, or recordkeeping obligations. Disconnecting or changing sharing settings does not necessarily delete information already received by that recipient.
Depending on how you use Lorae, we may share:
Consumer health data may be shared with the following categories of recipients when permitted by law:
Where required by law, Lorae enters into contracts with processors that limit processing to documented instructions and require appropriate privacy and security protections.
Certain Lorae features may use artificial intelligence or other automated systems to generate requested patterns, summaries, insights, or responses. If a feature sends consumer health data to an external artificial-intelligence provider, Lorae will provide the disclosures and obtain the consent required by applicable law before that processing occurs.
Lorae does not use identifiable user-entered consumer health data to train external general-purpose artificial-intelligence models unless Lorae provides appropriate notice and obtains any consent required by law. Any statement about a particular provider's retention, model-training, or security practices will reflect Lorae's current contract, configuration, and verified provider practices.
Automated outputs are informational features and are not diagnoses, clinical risk assessments, medical conclusions, or substitutes for professional judgment.
Lorae does not sell consumer health data. Lorae does not use consumer health data for targeted advertising.
Lorae does not knowingly permit third parties to collect consumer health data over time and across unaffiliated websites or online services for targeted advertising. Operational providers may process limited information on Lorae's behalf for functions such as hosting, security, diagnostics, support, or permitted analytics, subject to applicable contracts and law.
If Lorae ever proposes to engage in an activity that constitutes a sale of consumer health data under applicable law, we will obtain the separate authorization or consent required by law before doing so and provide all required disclosures.
Depending on where you live and the law that applies, you may have the right to:
You may submit a consumer health data request through privacy controls available in the Services, if provided, or by contacting support@loraeapp.com. You do not need to create a new account solely to submit a request, although we may ask you to use an existing account or provide information reasonably necessary to authenticate your identity.
We will respond within the time required by applicable law. Where applicable law provides an appeal right, a denial will explain how to appeal. Unless another method is provided in the denial, you may submit an appeal to support@loraeapp.com with the subject line "Privacy Appeal." If an appeal is denied, we will provide information about contacting the appropriate regulator when required by law.
We will not unlawfully discriminate against you for exercising applicable consumer health data rights.
When applicable law requires deletion, we will delete qualifying consumer health data from our records and direct applicable processors, contractors, affiliates, and other recipients to honor the deletion request, subject to legal exceptions.
You may request account deletion using the in-app account-deletion process, if available, or by contacting support@loraeapp.com. Consumer health data stored in archived or backup systems may be deleted on a delayed schedule where applicable law permits.
Information already received and maintained by a clinician or healthcare organization may be subject to that recipient's independent legal and professional recordkeeping obligations. A request to Lorae does not necessarily require an independent healthcare provider to delete its own records.
Where required, Lorae will obtain affirmative, voluntary consent before collecting or sharing consumer health data unless the processing is necessary to provide a product or service you requested or another legal exception applies. Where required, consent to share consumer health data will be separate and distinct from consent to collect it.
You may withdraw applicable consent prospectively through available product controls or by contacting support@loraeapp.com. Withdrawal may affect Lorae's ability to provide features that require the relevant data. Consent to a sale of consumer health data, if ever applicable, would be obtained separately as required by law.
We retain consumer health data for as long as reasonably necessary to provide the Services, maintain your account, satisfy the purposes described in this Health Data Policy, comply with legal and contractual obligations, maintain appropriate security and audit records, resolve disputes, and enforce agreements.
When an account is deleted, Lorae will delete or deidentify associated consumer health data unless retention is required or permitted by law, necessary for security or fraud prevention, subject to a healthcare organization's recordkeeping obligations, or otherwise subject to a valid exception. Lorae will not state a fixed deletion period unless that period reflects the production system and applicable legal requirements.
Lorae maintains administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of consumer health data and to restrict access to personnel, contractors, and processors with a legitimate need for access. No system or transmission method can be guaranteed to be completely secure.
Public statements about encryption, access controls, audit logging, certifications, retention periods, or other technical safeguards will reflect Lorae's actual production implementation.
Lorae does not use geofencing around mental-health, reproductive-health, or other healthcare facilities for the purpose of identifying, tracking, collecting data from, or sending health-related messages or advertisements to consumers where prohibited by applicable law.
Consumer health data laws and HIPAA are separate legal frameworks. Some information processed by Lorae may be PHI governed by HIPAA when Lorae acts as a business associate of a HIPAA-covered entity. Other health-related information may not be subject to HIPAA but may be protected by state consumer health data laws, the FTC Act, the FTC Health Breach Notification Rule, or other applicable laws.
Lorae's consumer Services are currently intended for individuals age 18 or older. Lorae does not knowingly permit individuals under 18 to create consumer accounts. If Lorae later permits users ages 13 through 17, this Health Data Policy, the Privacy Policy, Terms of Use, consent architecture, clinician-sharing controls, and other applicable disclosures will be revised before that change is implemented.
We may update this Health Data Policy from time to time. We will update the "Last Updated" date and provide notice of material changes as required by law. Where applicable law requires affirmative consent before Lorae collects, uses, or shares additional categories of consumer health data or uses consumer health data for additional purposes, we will obtain that consent before the new processing begins.
Consumer health data questions, requests, consent withdrawals, and appeals:
Lorae LLC