Privacy Policy

1. How Nira Health Uses and Discloses Your Health Information

Treatment

We use and disclose your health information to provide services based on intake data and lab results to inform treatment plans. Nira Health does not provide diagnoses but develops personalized recommendations to support your mental health. Information may be shared with healthcare providers as needed to facilitate your care.

Payment

Your information may be used to process payments for services rendered or for other billing and financial management purposes.

Healthcare Operations

Nira Health may use your PHI to improve our services, AI recommendations, conduct quality assessments, and perform audits to maintain efficient operations.

Business Associates

We may work with third-party service providers who need access to health information to perform functions on Nira Health's behalf. These third parties are required to maintain the confidentiality and security of your information.

Legal and Regulatory Requirements

We may disclose your information to comply with legal obligations, such as court orders or subpoenas, and only after a thorough legal review to ensure compliance with federal and state law.

Public Health and Safety

PHI may be disclosed for public health purposes, such as reporting diseases or addressing public health emergencies, in compliance with applicable laws.

Breach Notification

Nira Health will notify you or authorities of any breach of unsecured health information, as required by applicable laws. State-specific timelines may apply.

2. Children and Minor Patients

Nira Health provides services to children and adolescents only with appropriate consent from a parent or legal guardian. Personal and health information about minor patients is collected, used, and disclosed only with verifiable parental or legal guardian authorization and in accordance with applicable privacy and data protection laws.

A parent or legal guardian may access, review, request amendment of, or request deletion of their child's information when permitted by law. We share personal information about minor patients with trusted third parties, such as electronic health record providers, diagnostic laboratories, and clinical partners, only to the extent necessary to support care and operations.

Nira Health maintains strong privacy and security practices and works with vendors who are contractually obligated to protect personal information. We do not knowingly collect personal information directly from minors without consent from a parent or legal guardian.

If you have questions about how your child's information is used or wish to exercise privacy rights on behalf of a minor, contact us at info@nira-health.com.

3. State-Specific Privacy Practices

Nira Health complies with additional state requirements where applicable:

• California: Under the California Confidentiality of Medical Information Act (CMIA), Nira Health will not disclose mental health information without explicit patient consent, except as required by law.
• New York: Consistent with New York Mental Hygiene Law, mental health information will only be disclosed with specific patient consent, unless legally mandated.
• Texas: Texas Medical Records Privacy Act provides enhanced protections; Nira Health adheres to these standards for any disclosures.

4. Your Rights Regarding Your Health Information

Right to Access and Copy

You may request access to your health information, including assessments and health records, in paper or electronic format. Requests will be fulfilled within 30 days. Contact info@nira-health.com to make a request. Reasonable fees may apply for copies.

Right to Amend

If you believe your information is incorrect or incomplete, you may request an amendment by contacting info@nira-health.com. We will respond within 60 days.

Right to Request Restrictions

You may request limitations on certain uses or disclosures of your PHI. While Nira Health is not obligated to agree, we will review each request individually. Submit requests to info@nira-health.com.

Right to Confidentiality and Privacy

You may request specific methods of communication, such as email only, for additional privacy. Contact us at info@nira-health.com to arrange confidential communication.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures Nira Health has made of your health information, excluding those made for treatment, payment, or healthcare operations. The first request within 12 months is free. Contact info@nira-health.com for details.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Nira Health by contacting our Privacy Officer at info@nira-health.com. Complaints may also be filed with the U.S. Department of Health and Human Services at www.hhs.gov/ocr. Nira Health prohibits any retaliation for filing complaints.

Right to Revoke Authorization

You may revoke any authorization to use or disclose your PHI at any time by contacting us at info@nira-health.com. Revocation will apply only to future actions and will not affect disclosures made before revocation.

5. Changes to This Notice

Nira Health reserves the right to update this Notice at any time. Changes will apply to all health information maintained, including information collected before the change. Updated notices will be posted on our website, and a copy is available upon request.

6. Contact Information

For any questions about this notice or your privacy rights, please contact us at info@nira-health.com.

7. Cookies and Tracking Technologies

Nira Health uses the following tracking technologies on our website and services. You may opt out of non-essential tracking at any time.

Google Analytics (GA4)

We use Google Analytics 4 (property: nira-health.com) to collect anonymized data about how visitors use our website, including pages visited, session duration, and general location. Google Analytics does not collect personally identifiable health information. To opt out, install the Google Analytics Opt-out Browser Add-on or adjust your browser's cookie settings.

Meta Pixel (ID: 1330787988916447)

We use Meta Pixel to measure the effectiveness of our advertising and to reach potential patients who may benefit from our services. Meta Pixel may collect information about your visit including pages viewed and actions taken. To opt out of Meta's use of this data for advertising, visit Meta's Cookie Policy or adjust your preferences in your Facebook/Instagram account settings.

HubSpot

When you submit a form or book a call, your contact information (name, email, phone number) is stored in HubSpot, our customer relationship management (CRM) platform. HubSpot also places cookies to track form submissions and page visits for marketing purposes. To opt out of HubSpot tracking, you may disable cookies in your browser settings. Contact us at info@nira-health.com to request deletion of your contact record.

Cal.com

We use Cal.com to facilitate appointment scheduling. When you book a discovery call or appointment, Cal.com collects your name, email address, and selected appointment time. This data is used solely for scheduling purposes and is subject to Cal.com's privacy policy. Cal.com does not receive your clinical health information.

8. Biometric and Genetic Data

Nira Health collects pharmacogenomic (PGx) testing data and biomarker panel results as part of our clinical evaluation process. This data may include genetic markers relevant to medication metabolism, nutrient levels, inflammatory markers, and other biomarkers relevant to pediatric brain health.

This data is:

• Collected only with explicit written consent from a parent or legal guardian
• Stored securely using industry-standard encryption and access controls
• Shared only with your child's treating providers, authorized clinical staff, and third-party laboratory partners operating under business associate agreements
• Never sold to third parties, insurers, or employers
• Retained only as long as required for clinical purposes and applicable law

To request access to or deletion of genetic and biomarker data, contact us at info@nira-health.com.

9. Do Not Sell or Share My Personal Information

Nira Health does not sell your personal information or your child's personal information to third parties. We do not share personal health information for cross-context behavioral advertising without your explicit consent.

If you wish to exercise your right to opt out of any sharing of your personal data, or if you have questions about how your data is used, contact us at info@nira-health.com. We will respond to all opt-out requests within 15 business days.

10. Automated Decision-Making

Our Atlas application uses algorithmic analysis to help identify behavioral patterns, track symptom changes over time, and surface insights for parents and caregivers. This automated analysis is designed as a wellness and observation tool only.

All clinical decisions at Nira Health — including diagnosis, treatment recommendations, medication guidance, and care plans — are made exclusively by licensed healthcare providers. No automated system makes clinical decisions about your child's care. Algorithmic outputs from Atlas are reviewed and interpreted by qualified clinicians before any clinical action is taken.

You have the right to request human review of any recommendation or output that has affected your child's care. To make such a request, contact us at info@nira-health.com.

11. Atlas App — Data Collected

The following categories of data are collected through the Atlas application. All data is entered by or on behalf of a parent or legal guardian; no data is collected directly from the child.

• Parent account information: Parent or guardian email address used to create and authenticate the Atlas account
• Child profile information: Child's first name, age, sex, and in-app avatar selection
• SDQ responses: Strengths and Difficulties Questionnaire responses completed by the parent or caregiver as part of Atlas's structured behavioral assessment
• Daily behavior ratings: Parent-reported daily ratings of mood, focus, sleep quality, and behavioral regulation logged through the Atlas check-in interface
• Behavioral events: Specific events logged by the parent, including meltdowns, outbursts, notable positive moments, medication administration notes, and other caregiver-defined observations
• Compass360 derived values: Algorithmic scores and composite values generated by the Atlas Compass360 feature based on the combination of SDQ responses, daily ratings, and events entered over time. These are derived metrics, not clinical assessments.

Atlas does not collect data directly from children, does not interface with wearable devices, and does not access health data from Apple Health, Google Fit, or any third-party health platform unless you explicitly authorize such integration in a future release.

12. Data Retention

Nira Health retains personal and health information only as long as necessary to fulfill the purposes described in this Privacy Policy, to comply with applicable legal obligations, and to protect legitimate business interests.

• Clinical records: Retained for a minimum of seven (7) years from the date of the last clinical encounter, or as required by applicable state law, whichever is longer
• Atlas app data: Retained for the duration of your active Atlas account, plus up to 12 months after account deletion or deactivation, except where a shorter retention period is required by law
• Contact and marketing data: Retained until you request deletion or opt out of communications, subject to legally required minimum retention periods
• Billing and transaction records: Retained for a minimum of seven (7) years for accounting and tax compliance purposes

To request deletion of your data before the end of the applicable retention period, contact us at info@nira-health.com. We will delete or anonymize data promptly unless retention is required by law.

13. Third-Party Data Sharing — Atlas and Website

Nira Health does not sell your personal information. The following third parties may receive data as part of delivering our services. No other third-party data sharing occurs without your explicit consent.

Supabase

Atlas uses Supabase as its backend database and authentication provider. Atlas app data — including parent account information, child profiles, daily ratings, SDQ responses, events, and Compass360 values — is stored in Supabase-hosted databases. Supabase operates under a data processing agreement with Nira Health and does not use this data for its own purposes. Data is stored in the United States. Subject to Supabase's Privacy Policy.

Anthropic

If you use the Atlas AI Coach feature, anonymized behavioral observation data may be transmitted to Anthropic's API to generate responses. Data sent to Anthropic does not include your name, child's full name, or any other directly identifying information. Anthropic processes this data solely to generate AI responses and does not retain it for model training under our enterprise agreement. Subject to Anthropic's Privacy Policy. You may opt out of the AI Coach feature at any time in Atlas settings.

Apple (IAP and Push Notifications)

Atlas uses Apple's in-app purchase (IAP) infrastructure for processing paid feature purchases and subscriptions. Apple receives transaction data including your Apple ID and purchase details. Atlas also uses Apple Push Notification service (APNs) to send you app notifications; Apple does not receive the content of these notifications in readable form. Subject to Apple's Privacy Policy.

Website Analytics and Advertising (existing)

As described in Section 7, Nira Health's marketing website uses Google Analytics, Meta Pixel, HubSpot, and Cal.com. These services apply only to the nira-health.com website and do not receive Atlas app data.

14. Data Residency

Nira Health and its service providers store and process data primarily within the United States. Specifically:

• Clinical records are stored on U.S.-based servers operated by Nira Health's clinical infrastructure partners
• Atlas app data is stored in Supabase-hosted databases located in the United States
• Marketing and CRM data (HubSpot, Cal.com) may be processed on servers in the United States and the European Union, subject to those providers' data transfer frameworks

By using Nira Health's services, you acknowledge that your information may be transferred to, stored, and processed in the United States, which may have different data protection laws than your country or state of residence. Nira Health takes appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy regardless of where it is processed.

If you have questions about data residency or international data transfer practices, contact us at info@nira-health.com.

Acknowledgment of Receipt of Privacy Practices

Nira Health makes a good-faith effort to ensure that all users acknowledge these Privacy Practices as part of the consent process when using our services.