Privacy Policy

Version 1.0 | Effective September 14, 2026 | Last Updated September 14, 2026

This Privacy Policy describes how Solliva LLC, a Florida limited liability company located at 7901 4th Street N STE 300, St. Petersburg, Florida 33702 ("Solliva," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the Solliva patient application and related services (the "App"). It applies to you if you use the App as a patient or as the authorized representative of a patient. It is incorporated into, and should be read together with, the Solliva Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. You will be asked to accept this Privacy Policy when you create your account. Please read it before you do. If you do not agree with it, do not create an account or use the App.

1. Solliva’s Three Roles

Understanding this policy requires understanding that Solliva handles information in three different capacities, and different rules apply to each. 1.1 Service provider for your health information. Your clinic — the medical practice or health system responsible for your care (your "Clinic") — is a covered entity under the Health Insurance Portability and Accountability Act ("HIPAA"). When your Clinic works with a care management company (a "Care Management Organization"), that company is your Clinic’s business associate, and Solliva is a subcontractor business associate under 45 C.F.R. § 164.502(e)(1)(ii). When your Clinic licenses the App directly, Solliva is its business associate. In both cases, Solliva handles your protected health information ("PHI") only as the applicable business associate agreements and HIPAA permit. Your Clinic’s Notice of Privacy Practices — not this policy — governs how your PHI may be used and disclosed, and your HIPAA rights are exercised through your Clinic as described in Section 11. 1.2 Independent business for limited non-PHI data. Some information Solliva collects is not PHI and is not governed by the business associate agreements — principally device identifiers, app analytics, and crash and performance data. For that information, Solliva acts for its own purposes, and this policy, together with applicable state privacy law, governs. 1.3 Owner of de-identified data. Solliva creates and owns de-identified and aggregated data as described in Section 8. Once information has been properly de-identified under the HIPAA standard, it is no longer PHI and no longer identifies you.

2. Information We Collect

2.1 Information you provide. When you register and use the App, you may provide: your name, date of birth, contact information, and demographic information; insurance information; your preferred pharmacy and preferred imaging facility; information about social determinants of health, such as housing, transportation, and food access, where you choose to provide it; symptom entries, health concerns, narratives, and other content you type or dictate, including audio you record for transcription; family medical history you choose to enter; appointment requests; messages to support; and, if you purchase an optional paid feature, the transaction records described in Section 2.5. 2.2 Information from your Clinic or Care Management Organization. Your care team supplies the clinical information the App displays to you, including your care plan, care team roster, diagnoses and problem list, medication list, and related records. Solliva receives this information as a service provider so the App can show it to you. Solliva does not create, verify, or control it. 2.3 Information collected automatically. When you use the App, Solliva and its service providers automatically collect: device information (device model, operating system and version, unique device identifiers, language, and time zone); log and usage information (app screens viewed, features used, session times, crash reports, and performance data); coarse network information (IP address and the general location it implies — the App does not collect precise GPS location); and push notification tokens. Section 9 describes the software development kits and similar technologies involved. 2.4 No advertising data. The current version of the App displays no advertising, incorporates no advertising software development kits, and collects no advertising interaction data. Section 9 describes what will change — and what will not — if advertising is ever introduced. 2.5 Payment information. The current version of the App offers no paid features. If Solliva introduces one, purchases will be billed through the Apple App Store, Google Play, or a payment processor; Solliva will receive transaction confirmations, subscription status, and limited billing metadata, and will never receive or store your full payment card number. 2.6 Information from other sources. Solliva may receive contact or enrollment information from your Clinic or Care Management Organization in order to invite and approve you as a user, and technical information from the platform through which you downloaded the App. 2.7 Sensitive information. By its nature, the App handles health information, which many laws treat as sensitive. Solliva collects sensitive information only to provide the App and as this policy describes, and applies the safeguards in Section 13 to it. Solliva does not use or disclose sensitive personal information for purposes that would trigger a right to limit under the California Consumer Privacy Act beyond those permitted by its regulations.

3. How We Use Information

3.1 To provide the App. Solliva uses your information to operate the App and its features: displaying your care plan and clinical information; recording your preferences and entries; transmitting your appointment requests and, where enabled, your summaries to your care team; operating AI features you choose to use; providing customer and technical support; and administering optional paid features you purchase. 3.2 To secure and maintain the service. Solliva uses information to authenticate users, detect and prevent fraud, abuse, and security incidents, debug and repair errors, maintain audit logs, and comply with its security obligations under HIPAA. 3.3 To improve the App. Solliva uses usage, performance, and de-identified information to understand how the App is used, improve features, and develop new ones, in each case consistent with the business associate agreements and Section 8. 3.4 AI features. The current version of the App includes no patient-facing AI features. If Solliva introduces one, your entries will be processed to generate the questions, transcriptions, and summaries the feature produces for your review; this policy will be updated before launch; Solliva will not use identifiable PHI to train models made available to any third party; and any use for model development will be governed by the business associate agreements and Section 8. 3.5 To communicate with you. Solliva uses your contact information to send the service communications described in the Terms of Service, and, only with any consent applicable law requires, marketing communications, which you may opt out of at any time. 3.6 To comply with law. Solliva uses and retains information to comply with legal obligations, respond to lawful requests, enforce its agreements, and establish or defend legal claims. 3.7 No use of PHI for advertising or marketing without authorization. Solliva does not use your PHI to select, target, or measure advertising, and does not use or disclose PHI for any communication that constitutes "marketing" under 45 C.F.R. § 164.501 without a valid HIPAA authorization from you.

4. How We Disclose Information

4.1 Your Clinic and Care Management Organization. Information you enter in the App is made available to your Clinic and, where one is involved, the Care Management Organization serving it, so that your care team can review it. Their use of that information is governed by their own legal obligations and privacy notices. 4.2 Service providers. Solliva discloses information to vendors that host, secure, support, and help operate the App, including cloud infrastructure, analytics, communications delivery, transcription, and customer support providers. Every vendor with access to PHI is bound by a written agreement meeting HIPAA’s subcontractor requirements, and every vendor is limited to using information to provide services to Solliva. A current list of subcontractors with access to PHI is available on request at contact@solliva.com. 4.3 Advertising partners. Solliva currently discloses no information to advertising partners, because the App displays no advertising. If advertising is introduced, any disclosure will be limited as Section 9 describes, and Solliva will never disclose PHI to advertisers, advertising networks, measurement vendors, or data brokers. 4.4 Legal disclosures. Solliva may disclose information in response to subpoenas, court orders, warrants, or other valid legal process; to comply with law; to cooperate with governmental or regulatory investigations; to enforce its agreements; or to protect the rights, property, or safety of Solliva, its users, or the public. Disclosures of PHI are limited by HIPAA and the applicable business associate agreements, and Solliva will object to or seek to narrow legal process where it has a good-faith basis to do so. Where the request concerns reproductive healthcare, Solliva complies with the attestation and prohibition requirements of 45 C.F.R. § 164.509 to the extent applicable. 4.5 Corporate transactions. If Solliva is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, information may be transferred as part of that transaction, provided the recipient assumes the commitments of this policy as to previously collected information and any transfer of PHI complies with HIPAA. You will be notified of any transaction that materially changes how your information is handled, and any consent required by applicable law will be obtained. 4.6 De-identified and aggregated data. Solliva discloses, licenses, and sells de-identified and aggregated data as described in Section 8. 4.7 What we do not do. SOLLIVA DOES NOT SELL YOUR IDENTIFIABLE HEALTH INFORMATION. SOLLIVA DOES NOT DISCLOSE PHI TO ADVERTISERS OR DATA BROKERS. SOLLIVA DOES NOT PERMIT ADVERTISERS TO TARGET YOU BASED ON YOUR DIAGNOSES, MEDICATIONS, SYMPTOMS, OR CARE PLAN. SOLLIVA DOES NOT SELL OR SHARE YOUR PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING WITHOUT THE NOTICE AND OPT-OUT RIGHTS, OR THE CONSENT, THAT YOUR STATE’S LAW REQUIRES.

5. Communications

5.1 Service communications. Solliva sends account, security, appointment-related, and other transactional communications by in-App notice, email, SMS, and push notification, as described in Section 14 of the Terms of Service. These are part of the service; you can disable push notifications in your device settings, but some communications cannot be disabled while you maintain an account. 5.2 Marketing communications. Marketing messages are sent only where permitted by law and, where required, only with your prior express written consent obtained separately. Opt out at any time by replying STOP to texts, using the unsubscribe link in emails, or adjusting in-App preferences. Opting out of marketing does not affect service communications or your care. 5.3 Notification content. Solliva configures notifications to minimize the health information visible on a lock screen or in a message preview, and offers settings to further restrict notification content. Email and SMS are not fully secure channels; adjust your preferences if this concerns you.

6. AI Features and Your Information

6.1 What the features do with your data. The current version of the App includes no patient-facing AI features. This Section states the commitments that will govern them if Solliva introduces them, and this policy will be expanded with specifics before any launch. When available, AI features will process the text and audio you provide to produce structured questions, transcriptions, and summaries for your review, on Solliva’s systems or those of contracted service providers bound as described in Section 4.2. 6.2 Labeling. Content generated by an AI feature will be identified as AI-generated in the App, and summaries transmitted to your care team will be labeled as patient-generated content produced with artificial intelligence assistance. 6.3 Model development. Any model development will use de-identified data as described in Section 8, and Solliva will not use your identifiable PHI to train models made available to third parties.

7. Data Retention

7.1 General approach. Solliva retains information for as long as needed to provide the App, meet legal and contractual obligations — including HIPAA’s six-year documentation retention requirement where applicable — resolve disputes, and enforce agreements, and then deletes or de-identifies it under a documented retention schedule. Representative periods:

7.2 Deletion limits. Backups are deleted on a rolling schedule. De-identified and aggregated data, and models and analyses already created from them, are not subject to deletion, as Section 8 explains.

8. De-Identified Data, Aggregated Data, and AI Training

8.1 What we create. Solliva creates "De-Identified Data" — data from which identifiers of you, your relatives, your employers, and your household members have been removed in accordance with 45 C.F.R. § 164.514(b), using the Expert Determination or Safe Harbor method, and any applicable state standard — and "Aggregated Data," meaning statistical data across many users in which no individual is identified or reasonably identifiable. 8.2 What we do with it. Solliva owns De-Identified Data and Aggregated Data. Today, Solliva uses them only to operate, evaluate, and improve the App. Solliva’s agreements reserve the right to use them more broadly in the future — to train and improve artificial intelligence models (including models used outside the App), to develop new products and software, to conduct and publish research, and to license or sell them to healthcare organizations, payers, life sciences companies, and researchers, with Solliva keeping all revenue. Solliva does not currently license or sell De-Identified Data and does not currently use it to train models made available outside the App; before beginning any of those activities, Solliva will update this policy and obtain any consent applicable law requires. You are not paid for De-Identified Data, and this exchange is part of how the App’s core features are provided to you without charge. 8.3 Authorization chain. Solliva creates De-Identified Data from PHI only where your Clinic has authorized de-identification in its agreements and, where a Care Management Organization is involved, that authorization has been validly passed through to Solliva. 8.4 No re-identification. Solliva does not attempt to re-identify De-Identified Data or Aggregated Data, and contractually prohibits everyone who receives such data from attempting re-identification or permitting others to do so. 8.5 Effect of deletion. Information already incorporated into a trained model generally cannot be identified or extracted. Deleting your account or your content stops future use of your identifiable information but does not un-train models or destroy De-Identified Data, Aggregated Data, or analyses created before the deletion. 8.6 Separate consent where required. Where your state’s law requires your separate, affirmative, revocable consent before health-derived data is collected, shared, or sold — see Section 10 — Solliva obtains that consent through its own distinct flow before the covered activity occurs, never conditions the App’s free features on it, and honors withdrawal prospectively.

9. Advertising and Tracking Technologies

9.1 No advertising today. The current version of the App displays no advertising. It incorporates no advertising software development kits, does not collect or use the mobile advertising identifier, does not engage in cross-context behavioral advertising, and does not sell or share personal information as state privacy laws define those terms. Because the App does not track you across other companies’ apps and websites, it does not present an App Tracking Transparency request on iOS — there is nothing to ask about. 9.2 If advertising is ever introduced. Solliva has reserved the contractual right to introduce advertising to support the App’s free features. Before any advertising launches, Solliva will update this policy with at least thirty (30) days’ notice describing exactly what advertising partners would receive, and will obtain any consent applicable law requires. The following commitments will bind Solliva whenever advertising exists: no PHI will be disclosed to advertisers, advertising networks, measurement vendors, or data brokers; no advertising will be targeted using your diagnoses, medications, symptoms, care plan, or anything you enter about your health; advertising partners will be contractually prohibited from inferring health conditions from the App or combining App data with outside data to build health profiles; every advertisement will be labeled; you will be able to opt out of any personalization; and opt-out preference signals recognized by applicable law, including the Global Privacy Control, will be honored. 9.3 Technologies currently in use. The App currently uses a limited set of third-party software development kits for analytics, crash reporting, and communications delivery. The current list, the provider of each, and the data each receives is maintained at https://solliva.com/privacy/third-party-software and is updated whenever the App’s composition changes. Solliva configures these technologies consistent with guidance from the HHS Office for Civil Rights on tracking technologies and with the Federal Trade Commission’s Health Breach Notification Rule, and prohibits every one of them from receiving PHI. 9.4 Do Not Track. Because there is no common standard for browser "Do Not Track" signals, the App does not respond to them. Solliva does not sell or share personal information; if that ever changes, recognized opt-out preference signals, including the Global Privacy Control, will be honored as opt-out requests.

10. Your Privacy Rights Under State Law

10.1 Overview. Depending on where you live, you may have some or all of the following rights with respect to personal information Solliva holds outside its HIPAA service provider role: to know or access it; to receive a portable copy; to correct it; to delete it; to opt out of sale, sharing, targeted advertising, and certain profiling; to limit the use of sensitive personal information; and to appeal a refusal. Information Solliva handles as PHI under HIPAA is generally exempt from these state laws; Section 11 explains the rights that apply to it instead. 10.2 How to exercise rights. Submit requests through the App’s privacy settings or by email to contact@solliva.com. Solliva will verify your identity using account information and reasonable additional confirmation where the request is sensitive, will respond within the time your state’s law requires (generally forty-five (45) days, extendable once with notice), and will not discriminate against you for exercising a right. An authorized agent may submit a request on your behalf with proof of authority; Solliva may still require you to verify your identity directly. If Solliva declines a request, the response will explain why and how to appeal, and appeals will be decided within the period your state’s law requires; if your appeal is denied, you may contact your state attorney general. 10.3 California. The California Consumer Privacy Act, as amended, gives California residents the rights described above as to information not covered by HIPAA or the California Confidentiality of Medical Information Act. In the preceding twelve (12) months, Solliva has collected the categories of personal information described in Section 2, from the sources described there, for the purposes described in Section 3, and has disclosed them to the categories of recipients described in Section 4. The categories are summarized below. Solliva does not sell personal information and does not share it for cross-context behavioral advertising, and has not done either in the preceding twelve (12) months. Solliva does not use or disclose sensitive personal information for purposes requiring a right to limit beyond those permitted by 11 C.C.R. § 7027(m). Solliva does not knowingly sell or share the personal information of consumers under sixteen (16). California’s Shine the Light law (Civ. Code § 1798.83) permits you to request information about disclosures to third parties for their direct marketing; Solliva does not make such disclosures.

10.4 Washington and Nevada consumer health data. The Washington My Health My Data Act and Nevada Senate Bill 370 give residents (and, in Washington, persons whose data is collected there) specific rights over "consumer health data" not covered by HIPAA: the right to know what is collected and shared, to withdraw consent, to have it deleted (including from archives and backups, and with deletion requests propagated to processors), and to be free from collection or sharing without prior affirmative consent and from sale without a separate, signed authorization. Solliva collects and shares consumer health data only with the consent those laws require, obtained through a distinct consent flow; does not sell consumer health data; does not use geofencing around healthcare facilities for prohibited purposes; and honors deletion within the statutory timelines. The disclosures required by those laws — the categories of consumer health data collected, the purposes, the categories of sources and recipients, and how to exercise rights — are the ones set out in Sections 2, 3, 4, and 10.2 of this policy, which together constitute Solliva’s Consumer Health Data Privacy Policy and are also published as a standalone page linked from Solliva’s homepage at https://solliva.com/consumer-health-data. 10.5 Other states. Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Florida, and other states with comprehensive privacy laws have substantially the rights described in Section 10.1, exercised as described in Section 10.2, including a right of appeal. Where a state treats health-adjacent data as sensitive data requiring opt-in consent, Solliva obtains that consent before processing.

11. Your HIPAA Rights

11.1 Where to direct requests. Your rights over your PHI — to inspect and obtain a copy of your records (45 C.F.R. § 164.524), to request amendment (§ 164.526), to request restrictions (§ 164.522), to request confidential communications, and to receive an accounting of certain disclosures (§ 164.528) — are exercised through your Clinic, which maintains your designated record set. Solliva assists your Clinic in fulfilling these requests as its agreements require but cannot act on a request made directly to Solliva. 11.2 Breach notification. If a breach of unsecured PHI occurs, notification will be provided as HIPAA requires, ordinarily by your Clinic. For information Solliva holds outside its HIPAA role, Solliva provides breach notification as required by the FTC Health Breach Notification Rule, 16 C.F.R. Part 318, and applicable state breach notification laws. 11.3 Complaints. You may complain about the handling of your health information to your Clinic, to Solliva at contact@solliva.com, or to the HHS Office for Civil Rights at www.hhs.gov/ocr. You will never be retaliated against for filing a complaint.

12. Children and Minors

12.1 Children under thirteen. The App is not directed to children under thirteen (13), and Solliva does not knowingly collect personal information directly from them except through an account created and managed by a parent or guardian in connection with the child’s care. If Solliva learns that a child under thirteen has created an independent account, it will delete the account and its data. 12.2 Proxy accounts. Where a parent, guardian, or personal representative manages an account for a minor or an adult who lacks capacity, the information in the account is visible to that representative to the extent your Clinic’s configuration allows, consistent with state minor-consent and confidentiality laws. Your Clinic controls that configuration.

13. Security

13.1 Safeguards. Solliva maintains a written information security program with administrative, physical, and technical safeguards consistent with the HIPAA Security Rule, including encryption of data in transit and at rest, role-based access controls, multi-factor authentication, audit logging, vulnerability management, penetration testing, workforce training, and an incident response plan. 13.2 Your part. Protect your credentials, enable multi-factor authentication, secure your device with a passcode or biometric lock, and notify Solliva at contact@solliva.com immediately if you suspect unauthorized access. No system is perfectly secure, and Solliva cannot guarantee that unauthorized access will never occur.

14. Other Important Information

14.1 United States only. The App is intended for use in the United States, and information is processed in the United States. Solliva does not represent that the App or this policy satisfies the privacy laws of any other country. Where any service provider accesses information from outside the United States, Section 4.2’s contractual safeguards apply, and disclosure is available on request. 14.2 Deceased individuals. PHI of a deceased individual remains protected for fifty (50) years after death. Requests concerning a deceased user’s information should be directed to the Clinic and must come from a personal representative recognized under HIPAA and state law. 14.3 Links and third-party services. The App may link to third-party services, including pharmacies, imaging facilities, and advertisers. Their privacy practices are their own; this policy does not apply to them. 14.4 Changes to this policy. Solliva may update this policy. Material changes will be announced at least thirty (30) days in advance by in-App notice or email, and, where a change would materially expand how previously collected information is used, Solliva will obtain any consent applicable law requires before applying the change to that information. The "Last Updated" date above reflects the current version, and prior versions are available on request. 14.5 Contact. Privacy questions and requests: contact@solliva.com. Security reports: contact@solliva.com. Mail: Solliva LLC, Attn: Privacy, 7901 4th Street N STE 300, St. Petersburg, Florida 33702. California residents may also contact the Complaint Assistance Unit of the California Department of Consumer Affairs as described in the Terms of Service.