Heart Arc — Privacy Notice

actual data practices so counsel can finalize. Bracketed […] items need your input. Effective date: [DATE]. Operated by [LEGAL ENTITY / PRACTICE NAME] ("we", "us").

1. What this is

Heart Arc is a private, invite-only cardiovascular-prevention pilot. You enter health information and share recent lab/imaging results (as PDFs); a board-certified cardiologist reviews them and prepares a personalized prevention report. It is not for emergencies and does not replace care from your own physician.

2. Information we collect

• Identity & contact: first/last name, date of birth, email, and (optionally) mobile phone; U.S. state of residence.
• Health information you provide: sex at birth, race/ethnicity (used only for certain calcium-score comparisons), height/weight/waist, blood pressure, smoking, diabetes, kidney disease, HIV status (optional), family history, medications, and imaging/lab findings.
• Documents you upload: lab and imaging reports as PDF files.
• Consent metadata: the consent version you accepted, a timestamp, your IP address, and browser user-agent (kept as proof of consent).
• Operational logs: limited event logs (e.g., code opened, submission received) used to run and secure the service.

We do not intentionally collect Social Security numbers, financial/payment information, or government IDs, and you should not upload them.

3. How we use it

• To prepare and deliver your cardiologist-reviewed prevention report.
• To contact you about your assessment and results.
• To operate, secure, debug, and improve the service.
• To comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising.

4. Who we share it with

• The reviewing cardiologist who prepares your report.
• Service providers that host and run the service on our behalf, under contract: [Supabase] (database, file storage, functions) and [Resend] (transactional email notifications). These providers process data only to provide their services to us.
• Legal/safety: if required by law or to protect rights, safety, or security.

We do not otherwise disclose your information to third parties.

5. Where it's stored & security

Data is stored with our hosting provider [Supabase, region: ___]. We use access-code gating, row-level security, server-side-only privileged functions, administrator authentication, upload validation (file-type checks and rejection of PDFs containing active content), and size limits. Data is encrypted in transit; at-rest encryption is provided by our hosting provider. No method is 100% secure. Full anti-malware scanning and image handling are not yet enabled during the pilot (PDF-only uploads).

6. How long we keep it (retention)

See the separate Retention & Deletion Policy. In summary: uploaded lab/imaging files and your submission are retained only as long as needed to prepare and deliver your report, then deleted — by default within 7 days after the reviewing physician downloads your file, and in all cases no later than 30 days after submission. On deletion, uploaded files are removed from storage and the sensitive record is cleared.

7. Your choices & rights

You may request to access, correct, or delete your information, or ask questions about this notice, by contacting [CONTACT EMAIL]. Depending on your state, you may have additional rights [e.g., under California / other state law — for counsel]. Because this is an invite-only pilot, you can also simply decline to participate.

8. Children

Heart Arc is for adults 18 and older. We do not knowingly collect information from children.

9. Medical & HIPAA note [for counsel]

This service is delivered by a physician/practice. Whether HIPAA and its Privacy/Security Rules apply (and whether Business Associate Agreements with [Supabase]/[Resend] are required) depends on the operating entity's status and arrangements — counsel to confirm before real-patient data. This notice should be reconciled with any applicable Notice of Privacy Practices.

10. Changes

We may update this notice; the effective date will change and, where appropriate, we will notify participants.

11. Contact

[CONTACT NAME / EMAIL / MAILING ADDRESS]

Draft prepared to reflect current technical practices. Not a substitute for legal advice; have qualified counsel review and finalize before collecting real patient data.