Biblo

Consumer Health Data Privacy Notice

Last updated October 15, 2026

This notice explains how Data Foundry Ai Inc, operating as Biblo, collects, uses, and shares consumer health data, including information covered by Washington’s My Health My Data Act and Nevada’s consumer-health-data law. It also explains the rights available under those laws where applicable. It is separate from our general Privacy Policy.

Consumer health data includes information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status. It can include health information inferred from other information, even when you did not expressly tell us a condition or measurement.

Features described here collect information only when available and enabled with the permissions and consent they require. Our health features are for general wellness, not medical diagnosis or treatment.

Health data we collect and why

We do not use health information to train generalized AI models, sell it, or use it for advertising.

Where health data comes from

Sources are you and content you submit; Apple Health or another health or fitness source you choose to connect; your permitted device data; connected email, calendar, document, financial, or merchant accounts used for a relevant enabled feature; and inferences we create from those permitted inputs. A connection is not permission to process every available piece of health information for every purpose.

Collection, use, and consent

We collect and process health information with the consent required by applicable law or to the limited extent a law permits processing necessary to provide a product or service you requested. Where we rely on consent, we ask before processing and identify the categories, purposes, and withdrawal method. Required sharing consent is separate from collection consent and from general service terms.

We use necessary information to deliver and protect your requested health features and address relevant support or technical problems. Access by employees and processors is limited to the purpose you authorized or the service you requested. Optional identifiable-content review for broader quality evaluation requires the necessary separate consent. Google’s additional restrictions apply to health information obtained from Google and its derivations.

We disclose additional health-data categories, recipients, or purposes and obtain any required new consent before the change. Research participation or uses beyond this notice are not authorized by accepting general terms.

Health data we share and with whom

The categories above may be disclosed, in the minimum amount necessary, as follows:

Corporate affiliates. Any corporate affiliate receiving consumer health data will be identified in this notice before the disclosure, and we will obtain any consent required for that disclosure. This notice does not authorize sharing with an unidentified affiliate.

We do not sell consumer health data for money or other valuable consideration. We do not use it for advertising or disclose it to advertising platforms or data brokers.

Your health-data rights

Where applicable law provides these rights, you may ask us to confirm whether we collect, share, or sell your consumer health data; access the data; obtain the required list of third parties and affiliates with which it was shared or sold and a way to contact them; withdraw consent for collection or sharing; and delete the data.

Send your request in your existing Biblo conversation or email privacy@heybiblo.com. State the request and the phone number or account email associated with your account. Do not send additional health records or identity documents unless we request information reasonably necessary to authenticate you. You do not need to create a new account. An authorized agent may assist where the applicable law permits.

We respond without undue delay and within 45 days of receipt, or a shorter applicable deadline. We use an extension only where the law permits it and explain it within the initial period. Requests are handled without charge except in the limited circumstances where the applicable law allows a reasonable fee or refusal. We explain any denial and do not unlawfully discriminate for exercising rights.

Withdrawal stops future consent-based collection or sharing for the affected feature, subject to any applicable legal requirements. Deleting or withdrawing access to information genuinely needed for a feature may prevent that feature from working. It does not erase information that a merchant or other recipient is lawfully required to retain.

For an authenticated deletion request, we delete active-system health data, including relevant source-derived memories, within 30 days or sooner where required. We notify applicable processors, contractors, affiliates, and other recipients of the deletion request and require them to honor it as required by law. Archived and backup copies are deleted within the deadlines required by applicable health-data law. For requests covered by Washington law, any permitted delay for archived or backup systems will not exceed six months after authentication. A shorter applicable deadline takes precedence. Pending deletion, these copies remain restricted to legally permitted purposes. Any retention exception must be one the applicable health-data law actually permits.

Appeals and contact

To appeal a denied request, email privacy@heybiblo.com with “Health privacy appeal” in the subject. We respond in writing within 45 days or any shorter applicable period, explaining the decision. If an appeal is denied, you may complain to the appropriate regulator, including the Washington Attorney General or the Nevada Attorney General.

Data Foundry Ai Inc, Attn: Privacy
434 Minna Street #1102
San Francisco, CA 94103
United States
privacy@heybiblo.com