This page collects the parts of the Solliva Privacy Policy (Version 1.0, effective September 14, 2026) that together constitute Solliva's Consumer Health Data Privacy Policy under the Washington My Health My Data Act and Nevada SB 370: the categories of consumer health data collected, the purposes, the categories of sources and recipients, and how to exercise your rights. It is also published at https://solliva.com/consumer-health-data.
10.4 Washington and Nevada consumer health data. The Washington My Health My Data Act and Nevada Senate Bill 370 give residents (and, in Washington, persons whose data is collected there) specific rights over "consumer health data" not covered by HIPAA: the right to know what is collected and shared, to withdraw consent, to have it deleted (including from archives and backups, and with deletion requests propagated to processors), and to be free from collection or sharing without prior affirmative consent and from sale without a separate, signed authorization. Solliva collects and shares consumer health data only with the consent those laws require, obtained through a distinct consent flow; does not sell consumer health data; does not use geofencing around healthcare facilities for prohibited purposes; and honors deletion within the statutory timelines. The disclosures required by those laws — the categories of consumer health data collected, the purposes, the categories of sources and recipients, and how to exercise rights — are the ones set out in Sections 2, 3, 4, and 10.2 of this policy, which together constitute Solliva’s Consumer Health Data Privacy Policy and are also published as a standalone page linked from Solliva’s homepage at https://solliva.com/consumer-health-data.
2. Information We Collect
2.1 Information you provide. When you register and use the App, you may provide: your name, date of birth, contact information, and demographic information; insurance information; your preferred pharmacy and preferred imaging facility; information about social determinants of health, such as housing, transportation, and food access, where you choose to provide it; symptom entries, health concerns, narratives, and other content you type or dictate, including audio you record for transcription; family medical history you choose to enter; appointment requests; messages to support; and, if you purchase an optional paid feature, the transaction records described in Section 2.5. 2.2 Information from your Clinic or Care Management Organization. Your care team supplies the clinical information the App displays to you, including your care plan, care team roster, diagnoses and problem list, medication list, and related records. Solliva receives this information as a service provider so the App can show it to you. Solliva does not create, verify, or control it. 2.3 Information collected automatically. When you use the App, Solliva and its service providers automatically collect: device information (device model, operating system and version, unique device identifiers, language, and time zone); log and usage information (app screens viewed, features used, session times, crash reports, and performance data); coarse network information (IP address and the general location it implies — the App does not collect precise GPS location); and push notification tokens. Section 9 describes the software development kits and similar technologies involved. 2.4 No advertising data. The current version of the App displays no advertising, incorporates no advertising software development kits, and collects no advertising interaction data. Section 9 describes what will change — and what will not — if advertising is ever introduced. 2.5 Payment information. The current version of the App offers no paid features. If Solliva introduces one, purchases will be billed through the Apple App Store, Google Play, or a payment processor; Solliva will receive transaction confirmations, subscription status, and limited billing metadata, and will never receive or store your full payment card number. 2.6 Information from other sources. Solliva may receive contact or enrollment information from your Clinic or Care Management Organization in order to invite and approve you as a user, and technical information from the platform through which you downloaded the App. 2.7 Sensitive information. By its nature, the App handles health information, which many laws treat as sensitive. Solliva collects sensitive information only to provide the App and as this policy describes, and applies the safeguards in Section 13 to it. Solliva does not use or disclose sensitive personal information for purposes that would trigger a right to limit under the California Consumer Privacy Act beyond those permitted by its regulations.
3. How We Use Information
3.1 To provide the App. Solliva uses your information to operate the App and its features: displaying your care plan and clinical information; recording your preferences and entries; transmitting your appointment requests and, where enabled, your summaries to your care team; operating AI features you choose to use; providing customer and technical support; and administering optional paid features you purchase. 3.2 To secure and maintain the service. Solliva uses information to authenticate users, detect and prevent fraud, abuse, and security incidents, debug and repair errors, maintain audit logs, and comply with its security obligations under HIPAA. 3.3 To improve the App. Solliva uses usage, performance, and de-identified information to understand how the App is used, improve features, and develop new ones, in each case consistent with the business associate agreements and Section 8. 3.4 AI features. The current version of the App includes no patient-facing AI features. If Solliva introduces one, your entries will be processed to generate the questions, transcriptions, and summaries the feature produces for your review; this policy will be updated before launch; Solliva will not use identifiable PHI to train models made available to any third party; and any use for model development will be governed by the business associate agreements and Section 8. 3.5 To communicate with you. Solliva uses your contact information to send the service communications described in the Terms of Service, and, only with any consent applicable law requires, marketing communications, which you may opt out of at any time. 3.6 To comply with law. Solliva uses and retains information to comply with legal obligations, respond to lawful requests, enforce its agreements, and establish or defend legal claims. 3.7 No use of PHI for advertising or marketing without authorization. Solliva does not use your PHI to select, target, or measure advertising, and does not use or disclose PHI for any communication that constitutes "marketing" under 45 C.F.R. § 164.501 without a valid HIPAA authorization from you.
4. How We Disclose Information
4.1 Your Clinic and Care Management Organization. Information you enter in the App is made available to your Clinic and, where one is involved, the Care Management Organization serving it, so that your care team can review it. Their use of that information is governed by their own legal obligations and privacy notices. 4.2 Service providers. Solliva discloses information to vendors that host, secure, support, and help operate the App, including cloud infrastructure, analytics, communications delivery, transcription, and customer support providers. Every vendor with access to PHI is bound by a written agreement meeting HIPAA’s subcontractor requirements, and every vendor is limited to using information to provide services to Solliva. A current list of subcontractors with access to PHI is available on request at contact@solliva.com. 4.3 Advertising partners. Solliva currently discloses no information to advertising partners, because the App displays no advertising. If advertising is introduced, any disclosure will be limited as Section 9 describes, and Solliva will never disclose PHI to advertisers, advertising networks, measurement vendors, or data brokers. 4.4 Legal disclosures. Solliva may disclose information in response to subpoenas, court orders, warrants, or other valid legal process; to comply with law; to cooperate with governmental or regulatory investigations; to enforce its agreements; or to protect the rights, property, or safety of Solliva, its users, or the public. Disclosures of PHI are limited by HIPAA and the applicable business associate agreements, and Solliva will object to or seek to narrow legal process where it has a good-faith basis to do so. Where the request concerns reproductive healthcare, Solliva complies with the attestation and prohibition requirements of 45 C.F.R. § 164.509 to the extent applicable. 4.5 Corporate transactions. If Solliva is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, information may be transferred as part of that transaction, provided the recipient assumes the commitments of this policy as to previously collected information and any transfer of PHI complies with HIPAA. You will be notified of any transaction that materially changes how your information is handled, and any consent required by applicable law will be obtained. 4.6 De-identified and aggregated data. Solliva discloses, licenses, and sells de-identified and aggregated data as described in Section 8. 4.7 What we do not do. SOLLIVA DOES NOT SELL YOUR IDENTIFIABLE HEALTH INFORMATION. SOLLIVA DOES NOT DISCLOSE PHI TO ADVERTISERS OR DATA BROKERS. SOLLIVA DOES NOT PERMIT ADVERTISERS TO TARGET YOU BASED ON YOUR DIAGNOSES, MEDICATIONS, SYMPTOMS, OR CARE PLAN. SOLLIVA DOES NOT SELL OR SHARE YOUR PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING WITHOUT THE NOTICE AND OPT-OUT RIGHTS, OR THE CONSENT, THAT YOUR STATE’S LAW REQUIRES.
10. Your Privacy Rights Under State Law
10.2 How to exercise rights. Submit requests through the App’s privacy settings or by email to contact@solliva.com. Solliva will verify your identity using account information and reasonable additional confirmation where the request is sensitive, will respond within the time your state’s law requires (generally forty-five (45) days, extendable once with notice), and will not discriminate against you for exercising a right. An authorized agent may submit a request on your behalf with proof of authority; Solliva may still require you to verify your identity directly. If Solliva declines a request, the response will explain why and how to appeal, and appeals will be decided within the period your state’s law requires; if your appeal is denied, you may contact your state attorney general.