Privacy policy

PRIVACY POLICY

Last updated: 2026-10-08 Version: 2.2.0

1. Scope and contact

WELLNESS DISTRICT LLC operates Aura GPT (Aura). This policy describes how Aura handles information in its website, applications, AI features, and practitioner tools. It does not replace a practitioner's own privacy notice or the policies of a service you connect. For privacy questions and requests, contact info@auragpt.ai with the subject "Privacy request". Please do not email medical records, passwords, or access tokens.

2. Information and sources

Depending on the features you use, Aura receives:

• Account and profile details, contact information, preferences, and authentication information.
• Information you enter or upload, including journals, intake responses, health records, medications, insurance documents, photos, and wellness measurements.
• Chat messages, voice transcripts, audio or images you provide to voice, vision, transcription, and meditation features.
• Practitioner information, authorized client records, session notes, bookings, contracts, and communications.
• Data from services you authorize, such as calendar events, selected workspace content, and wearable or Apple Health measurements. Available categories depend on the service and your permissions.
• Subscription, purchase, and payment-status information; payment processors handle payment credentials.
• Technical and security information, such as device details, IP addresses, diagnostic events, and access logs.

Sources include you, your device, authorized practitioners, connected services, and providers that help operate Aura. A connection is optional. A practitioner's contact import may include your name and contact details before you create an account.

3. Purposes and AI processing

Aura processes information to provide the features you request: personalized wellness assistance, record organization, search, practitioner collaboration, scheduling, communications, contracts, payments, and account support. It also processes information for security, troubleshooting, and legal obligations.

AI features send relevant inputs and context to external AI and voice providers. Depending on the feature and configuration, these may include OpenAI, Google (Gemini API and Vertex AI), Anthropic (Claude), ElevenLabs, and TypeSafe (Jev). Aura also uses analytics and error-monitoring providers; these may include PostHog and Sentry. These companies are named on Aura's AI data sharing screen, where you can agree or decline and later change your choice in Settings > Privacy. Inputs can include conversation context, authorized records, images, or audio. AI responses and summaries may be stored in your Aura history. AI outputs may be inaccurate and are not a medical diagnosis.

Do not assume that every AI request has zero retention. Provider processing, abuse-monitoring retention, model-training restrictions, and regional handling depend on the service, endpoint, settings, and applicable contract. Contact us for information about a particular workflow. This policy does not represent that every vendor has signed a healthcare agreement with Aura.

4. Connected accounts and disconnection

You can manage connections in Settings > Connectors. Permissions determine what Aura may request from a connected service. Disconnecting disables the connection in Aura and removes the stored connection credentials. Failed requests must be retried; a failed disconnect is not a confirmation that access has stopped.

For supported wearable connections, disconnection also removes the imported daily measurements from Aura's active database. Apple Health disconnection removes its imported activity, sleep, nutrition, biometric measurements, and imported workouts, including source-linked workout memories. Google Calendar disconnection removes imported external calendar blocks. Your original data in the source service and appointments created in Aura are not deleted.

Apple Health device permissions are managed separately in iOS Settings. Disconnect there as well to withdraw the device permission. For services connected with your own API key, revoke that key in the originating service if you also want to invalidate it there. Provider-side revocation may require a separate action or may be delayed if that provider is unavailable.

Google user data. If you connect Google Workspace or Google Calendar, Aura requests only the access you approve on Google's consent screen: reading and searching your Gmail, creating Gmail drafts and sending email you have confirmed, finding Google Drive files by name (not their contents), and reading and updating your Google Calendar events. Aura uses this data only to provide the features you request, such as answering questions about your email, preparing drafts, finding files, showing your schedule, and booking appointments you confirm. To answer a request, the relevant content may be sent to the AI providers described in section 3.

Aura's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Aura does not sell Google user data, does not use or transfer it for advertising, does not use it to determine creditworthiness or for lending, and does not use it to develop, improve, or train generalized AI or machine learning models. People at Aura do not read Google user data unless you give specific permission for a particular message or file, it is necessary for security or to comply with law, or the data has been aggregated and anonymized for internal operations. Google access tokens are encrypted at rest. You can disconnect Google in Settings > Connectors, which deletes the stored tokens, and you can also revoke Aura's access at https://myaccount.google.com/permissions.

Disconnection is not a deletion request for everything you have ever saved in Aura or shared elsewhere. See the following sections for saved copies, prior conversations, clinical records, and backups.

5. Search, memories, and saved copies

Aura can organize saved content into searchable records and memories, including numerical search representations called embeddings. These search records are kept in Aura's own database. These representations and generated summaries may reveal sensitive information and are treated as personal data, not as anonymous data simply because they use a different format.

There is a difference between an imported measurement tied to a connection and information copied into a conversation, journal, uploaded file, practitioner record, or generated summary. Older conversations and independently saved content may contain information from a connection without a reliable source link. Disconnecting alone does not currently guarantee removal of every such mention or inference. You can delete supported records or request deletion and review of associated copies by contacting info@auragpt.ai.

Data already delivered to another service or person cannot be recalled by disabling the connection. An active conversation may already contain previously supplied context. End that conversation when withdrawing access to information it contains. Do not interpret disconnection as a promise that previously processed information can be retroactively removed from a recipient's memory or systems.

6. Sharing and service providers

Information is shared as needed for requested features, authorized practitioner access, service operation, or legally required purposes. Choosing to publish a profile or content makes the selected information visible to the audience described in that feature. A social connection is not intended to grant blanket access to private health records.

The service providers below process information to operate Aura. Each is listed with what it actually receives:

• Supabase: the database, sign-in, and stored files. It holds your account, profile, messages, records, and uploads.
• Vercel: hosts the Aura website and app, so the requests you make and the pages you load pass through it. Vercel Analytics counts page views on the website.
• Amazon Web Services: stores uploaded audio, video, documents, and reports in Amazon S3, keeps account-deletion records there, and sends some email through Amazon SES, such as practice invitations.
• Stripe: processes payments, subscriptions, and practitioner payouts, including the payment details and the account they belong to.
• SendGrid: sends email on Aura's behalf, including reminders and messages a practitioner sends through Aura.
• Twilio: sends and receives text messages, so it processes your mobile number and the message content in order to deliver them.
• Expo: delivers push notifications to the Aura mobile app. It receives the device's notification token and the notification text.
• Browserbase: runs the remote browser for web-reading and browser tasks you ask Aura to carry out, so it processes the pages Aura opens for you and, if you choose to sign in to a website during such a task, what you enter on that site. Aura does not store those sign-in details.
• Google Places: looks up a business or place when you ask Aura to find one. The search text is sent; your health records are not.
• Pollinations.ai: creates a background image for a guided meditation when the usual image service is unavailable. The image description is sent, not your messages.
• Higgsfield: creates offering videos for practitioners who turn that feature on. It receives the offering details and any images supplied for that video.

The AI providers named in section 3 also process information, for the purposes named there. Connected services receive the requests or content necessary for actions you authorize. Availability and use vary by feature; this list is not a certification of a vendor's configuration or contract.

Ordinary email, SMS, and calendar services have their own privacy limitations. Avoid including sensitive medical details in messages or calendar fields that do not require them. Information may also be disclosed where legally required, to respond to security incidents, or in a business transfer subject to applicable privacy obligations.

SMS information and consent

When you use Aura texting, we process your mobile phone number, message content, consent and opt-out records, and delivery information to verify your number, deliver the messages you request or subscribe to, support replies, and honor your communication choices.

We do not sell or share mobile phone numbers or SMS opt-in and consent information with third parties or affiliates for their marketing or promotional purposes. Messaging service providers may process this information as needed to deliver messages on our behalf. The other sharing descriptions in this policy do not permit third-party marketing use of SMS opt-in or consent data.

Ongoing Aura conversational texts require a separate, optional opt-in. Creating an account, accepting general terms, or requesting a verification code does not enroll you in ongoing texts. This opt-in does not authorize promotional messages, which require separate marketing consent. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. Contact info@auragpt.ai for assistance. SMS program terms are available at https://auragpt.ai/terms#sms-consent.

7. Retention and deletion

Account content generally remains until you delete it, request its deletion, or close your account, subject to applicable retention obligations. Different rules can apply to practitioner clinical records, signed contracts, financial records, security logs, and legal holds. HIPAA does not itself impose a universal seven-year medical-record retention period; applicable recordkeeping obligations depend on the record and jurisdiction.

Removal from the active application does not mean every backup, log, or vendor copy is erased immediately. When requesting deletion, you may ask what remains, why it remains, which recipients must be notified, and the applicable deletion schedule. We do not promise a single backup or vendor retention period across all features in this policy.

A practitioner may need to retain records already created in the course of care. Withdrawing future sharing does not automatically erase that practitioner's existing records. Contact the practitioner and Aura to determine the rules for those records.

8. Security

Aura uses authentication, database access rules, server-side authorization, and encryption of connected-service credentials. Security also depends on correctly configured infrastructure, operational controls, and vendor services. This notice is not a security certification or a guarantee that any system is immune to compromise.

Use a unique password, protect your email account and device, and review your connections and sharing choices. Report suspected unauthorized access to info@auragpt.ai. We assess security incidents and provide notifications where required by applicable law.

9. Health information and HIPAA

Health information is sensitive even when HIPAA does not apply. HIPAA applicability depends on the parties and the service: some practitioner workflows may involve a covered entity and business associates, while consumer wellness use may fall under other privacy laws.

Using Aura or accepting these terms does not establish a business associate agreement, certify a workflow as HIPAA compliant, or authorize every disclosure. Practitioners must confirm applicable agreements, eligible vendor services, and required safeguards before using a workflow for protected health information. Where Aura acts on a practitioner's behalf, that practitioner's notice and applicable agreement also govern the handling of clinical records.

10. Your choices and rights

Use settings to manage connections, available memory controls, notifications, and practitioner sharing. You can request access, correction, export, deletion, withdrawal of consent, and information about disclosures at info@auragpt.ai. We may need to verify your identity without collecting unnecessary sensitive documents.

Depending on your location and applicable law, additional rights may include restricting sensitive-data use, objecting to processing, appealing a denied request, and complaining to a regulator. California rights apply where the CCPA covers the business and information. Consumer health laws, including Washington's My Health My Data Act where applicable, may provide rights even where HIPAA does not apply. Requests to appeal should use the subject "Privacy appeal"; Washington consumers may also contact the Washington Attorney General at https://www.atg.wa.gov/file-complaint.

This policy is a notice, not a substitute for a separate consent or authorization required by law. Withdrawal does not undo processing already lawfully completed, but may prevent continued use of the affected feature.

11. Children, international use, and cookies

Aura is not directed to children under 13. Contact us if you believe a child has supplied information without appropriate authorization. Practitioner services and local laws may require additional age and consent controls.

Aura and its providers may process information in countries other than yours, including the United States. International rights and transfer requirements depend on the applicable law and processing arrangement. This notice does not certify that every workflow is suitable for every jurisdiction.

Cookies and similar device storage support sign-in, preferences, and application operation. Browser controls can restrict them, although this may affect functionality. Contact us about the use of optional analytics or tracking in a particular feature.

12. Policy changes

We update this notice when practices change and provide additional notice or obtain consent when required. The website and newly released app versions use the same policy source. Older installed app versions may show an earlier copy; the current web notice is available at https://auragpt.ai/privacy.