Privacy Policy

Last updated: June 21, 2026

Privacy at a glance

• We do not sell your personal or health data.
• Your chats are processed by OpenAI's API to generate responses. Under OpenAI's API terms, this content is not used to train OpenAI's models.
• We retain your data while your account is active and delete it within 30 days after you delete your account.
• You can export your data, delete individual conversations, delete your whole account, use Incognito mode (no chat is saved), and opt out of having your chats used to improve Nox — all from inside the app.
• Nox is a wellness and education tool. It is not a medical device, is not HIPAA‑regulated, and is not a substitute for a clinician.

1. Who we are

Nox is an AI health and wellness assistant provided by Xhealth, Inc. ("Xhealth", "we", "us", or "our"). This Privacy Policy explains what information we collect when you use Nox (the "Service"), how we use and share it, and the choices and controls you have.

This is the official Privacy Policy for the Service. If Nox describes our privacy practices inside a conversation, that description is informational only — this Policy controls.

2. Information we collect

• Account information: your name and email address, managed through our authentication provider (Clerk).
• Conversation content: the messages, prompts, images, and files you send to Nox, and Nox's responses, stored to maintain your conversation history (except in Incognito mode — see Section 11).
• Health-related information you choose to share in chat (defined in Section 3).
• Payment information: if you subscribe to a paid plan, billing is handled by Stripe. We store a customer/subscription identifier and plan status; we do not store your full card number.
• Connected‑service data: if you choose to connect Google services (Drive, Calendar, Docs), we access only the specific data you authorize, only to perform the action you request.
• Usage and device data: features used, session activity, approximate timing, browser type, operating system, and IP address — used for security, reliability, and product improvement.

3. What we mean by "health data"

Because Nox is a health assistant, you may share sensitive information. "Health data" includes, but is not limited to:

• Sleep data, heart rate, heart‑rate variability (HRV), body temperature, respiratory rate, activity/steps, and other wearable or Aurena Ring–style readings you type or upload
• Symptoms, conditions, diagnoses, and how you're feeling physically or mentally
• Medication and supplement names, dosages, and schedules
• Lab results, vitals, and measurements (e.g., blood pressure, blood glucose)
• Menstrual / cycle and reproductive‑health information
• Mental‑health information you disclose
• Photos or screenshots you upload (e.g., labels, supplements, meals, rashes, wearable readings, lab reports)
• Location information, only if you choose to share it (e.g., to find nearby care)

You decide what to share. Please avoid sharing more identifying detail than you need (for example, full name, address, or government IDs) inside a conversation.

4. How health data is handled differently

• Encryption: all data, including health data, is encrypted in transit (HTTPS/TLS) and encrypted at rest by our database and hosting providers.
• Used to answer you: health data you share is used to generate relevant responses for you in that conversation.
• AI processing: like other chat content, your messages are sent to OpenAI's API to produce a response. Under OpenAI's API terms, this content is not used to train OpenAI's models.
• Not sold, not advertised: we never sell health data and never use it for third‑party advertising.
• Improvement use is opt‑outable: see Section 5 — you can turn off use of your chats to improve Nox.
• Aurena Ring: Nox does not currently receive a live data feed from the Aurena Ring. It only knows the values you type into Settings or share in chat.

5. How we use your information & how we improve Nox

We use your information to provide and maintain the Service, keep your conversation history, run safety checks (such as detecting potential medical red flags), personalize responses, keep the platform secure, process payments, and meet legal obligations.

The phrase "improve AI responses" can mean many different things, so we separate them clearly:

• Training third‑party models: your chats are not used to train OpenAI's or any other third party's foundation models.
• Human review: your conversations are not routinely read by people. Limited, authorized personnel may access specific conversations only for support you request, safety, abuse prevention, debugging, or legal compliance (see Section 7).
• Internal improvement & analytics: we may use conversation data to evaluate quality, fix problems, and improve Nox's own prompts and features. Where practical we use aggregated or de‑identified data for this.
• Opt‑out: you can turn off use of your chats for internal improvement at any time in Settings → Privacy & data. This does not affect processing needed to answer you, keep the Service running, or comply with law.

For details on how our medical‑safety checks (red‑flag detection) are built, measured, and governed, see our Trust & Transparency page.

6. Service providers & subprocessors

We share data only with the providers needed to run the Service. We do not sell your data. Our current subprocessors are:

• OpenAI, L.L.C. — AI model processing of your messages and uploaded images to generate responses. Not used to train OpenAI's models under their API terms.
• Clerk, Inc. — authentication and account management (name, email, sign‑in).
• Stripe, Inc. — payment and subscription processing for paid plans.
• Google LLC — only if you connect Google Drive, Calendar, or Docs; accesses only what you authorize.
• Our cloud infrastructure provider — application hosting and the managed, encrypted PostgreSQL database where your data is stored.

We may also disclose information when required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required). For an up‑to‑date subprocessor list, contact us at Info@Xhealthus.com.

7. Human access to your conversations

Your conversations are not browsed by our team. Human access is restricted to authorized personnel and only for specific purposes:

• Providing support you have requested
• Investigating safety issues, abuse, or security incidents
• Debugging a specific reported problem
• Complying with a valid legal obligation

We limit access to health data, train personnel on handling it responsibly, and require contractors to sign confidentiality obligations.

8. HIPAA & medical‑device status

• Nox is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease.
• Nox is not a replacement for a clinician or for professional medical advice.
• Xhealth, Inc. is not a HIPAA "covered entity", and the Service is not HIPAA‑regulated. Your conversations are protected under this Privacy Policy and applicable consumer‑privacy law, not under HIPAA.

9. Your choices & controls

• Incognito mode: start a private chat that is not saved to your history (see Section 11).
• Improvement opt‑out: stop your chats from being used to improve Nox.
• Export your data: download a copy of your account and conversations as a file.
• Delete individual conversations: remove a single chat at any time.
• Delete your account: permanently remove your account and associated data.
• Access & correction: depending on your location, you may also have rights to access, correct, restrict, or object to certain processing, and to data portability.

Privacy controls live in Settings → Privacy & data and in the chat itself. You can also email Info@Xhealthus.com.

10. Data retention & deletion

We keep your account information and conversation history for as long as your account is active. When you delete a conversation or your account, here is what happens:

• Chat history: deleted conversations are removed from our active database immediately.
• Account deletion: deleting your account removes your conversations, plan/usage records, and account profile from our active systems, and deletes your sign‑in record with Clerk.
• Backups: residual copies in encrypted backups are purged on a rolling cycle, within 30 days.
• Operational logs: security and diagnostic logs are kept for a limited period and then deleted.
• OpenAI: content sent to OpenAI's API may be retained by OpenAI for a limited period for abuse monitoring and then deleted, per OpenAI's API data policies.

In short: your personal data is deleted within 30 days after account deletion, except where we must retain limited information to comply with law.

11. Incognito mode

When you use Incognito mode, your messages and Nox's responses for that session are not saved to your conversation history and are not stored in our database after the response is delivered. Your messages are still sent to OpenAI's API to generate a response (and processed under the same safety checks), and Incognito chats still count toward your plan's usage limits. Closing or leaving the Incognito session clears it.

12. Security

We use industry‑standard safeguards including encrypted transmission (HTTPS/TLS), encryption at rest, secure authentication, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Children

The Service is intended for adults 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

14. International users & governing law

The Service is operated from the United States and your information is processed there. This Policy is governed by the laws of the State of California, United States, without regard to its conflict‑of‑laws rules.

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for significant changes, provide a prominent notice in the Service or by email. Continued use after changes take effect constitutes acceptance of the updated Policy.

16. Contact us

For privacy questions or requests, contact: