Aurora Care Consumer Health Data Policy

Ragaven LLC, d/b/a RagavenCare and AuroraCare

Effective Date: October 28, 2026

Last Updated: October 28, 2026

PLEASE READ THIS CONSUMER HEALTH DATA POLICY CAREFULLY.

Ragaven LLC, doing business as RagavenCare and AuroraCare ("Ragaven," "Aurora Care," "we," "us," or "our"), provides the Aurora Care mobile application, the Aurora Care Angel web portal, and related websites and services (together, the "Services"). This policy explains how we handle consumer health data. It is written for the Washington My Health My Data Act, Nevada Senate Bill 370, and the consumer health data provisions of the Connecticut Data Privacy Act. It supplements our Privacy Policy. If the two conflict on consumer health data, this policy controls.

Aurora Care is a general wellness application. It is not a medical device and does not diagnose, treat, or monitor any disease. It is not an emergency service. When you use it directly, the information you provide is generally not "protected health information" under HIPAA.

1. Who This Policy Covers

This policy applies to consumers in Washington, Nevada, and Connecticut, and to anyone whose consumer health data we collect or process in those states. It applies to both kinds of Aurora Care users:

Stars are the people whose wellness is being observed, usually older adults who take readings with their own iPhone.
Angels are the family members, friends, or other caregivers a Star chooses to link with.

You must be at least 21 years old to use Aurora Care.

2. What Consumer Health Data Is

Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. It includes data we derive or infer from other information, such as a trend or a risk estimate.

3. Consumer Health Data We Collect

We collect only what the features you choose need. Depending on the features you turn on, this may include:

Camera-based wellness readings (Stars). Estimates such as pulse rate, breathing rate, heart-rate variability, stress indicators, and, where available, blood-pressure and blood-oxygen estimates, with signal-quality scores and the date and time of each reading. Raw camera images and video are not stored and do not reach our servers.
Biometric face template (Stars). A one-way mathematical representation of your face, used only to confirm that the enrolled Star is the person taking a reading. It is stored encrypted on your iPhone. A copy is stored in our cloud only if you separately opt in.
Profile and wellness context. Age or date of birth, sex at birth, height, weight, wellness goals, and the threshold preferences you set.
Apple Health data. Data you choose to share from Apple Health, which may include heart rate, heart-rate variability, respiratory rate, blood oxygen, blood pressure, body temperature, steps, sleep, and cardio fitness (VO₂ max). If you explicitly choose to share them, this may also include clinical health records stored in Apple Health, such as lab results, conditions, medications, immunizations, allergies, procedures, and vital signs.
Lab results (Stars). Lab values you enter or import, such as cholesterol panels, and any cardiovascular risk estimate calculated from them.
Medications and appointments. Medication names, dosages, schedules, and reminder times, and appointment details such as date, time, clinician name, specialty, location, and notes.
Precise location (Stars). If you turn on Safe Zone and grant location permission, your device's precise location, including in the background, used to tell whether you have left the Safe Zone you set.
Safety and home-sensor events (Stars). Voice Help requests, fall-detection and presence events from HomeKit sensors you pair, inactivity signals, and the alert history and acknowledgements that result.
Trends and inferences. Personal baselines, trends, and changes against your own history and your chosen thresholds.

4. Where It Comes From

We collect consumer health data from these sources:

You, when you enter information or take a reading.
Your device, including the camera, motion and Bluetooth signals for features you enable, and location if you allow it.
Your linked Angels, for example when an Angel enters an appointment or proposes a medication change. A medication change takes effect only after the Star confirms it.
Apple Health and HomeKit, when you grant permission.
NuraLogix Corporation, which returns the wellness estimates calculated from the encrypted facial blood-flow signal your device sends it.

5. Why We Collect and Use It

We collect and use consumer health data only to:

Provide the Services you ask for: take and show readings, compute trends and baselines, send reminders, and deliver the alerts, summaries, and reports you request.
Support your care network by sharing information with the Angels you link, according to your sharing settings.
Keep the Services safe and working: authenticate users, prevent fraud and abuse, and investigate security incidents.
Improve the Services, using data that is de-identified or aggregated where practicable.
Meet legal obligations and enforce our agreements.

We never use consumer health data for advertising or to build marketing profiles.

6. Your Consent

We collect consumer health data only with your consent or as necessary to provide a Service you ask for. Camera, location, Apple Health, notification, Bluetooth, motion, and Face ID access each require your permission through iOS. Certain features, such as cloud storage of your face template, require a separate in-app consent.

We share consumer health data only with your separate consent or as necessary to provide a Service you ask for. For example, an Angel sees a Star's data only after the Star links that Angel and chooses what the Angel may see. [Counsel to confirm: whether the care-link sharing screen is presented as a consent to share that is separate from the consent to collect.]

You may withdraw consent at any time in Settings or in iOS Settings, or by emailing us. Withdrawal does not affect processing that took place before you withdrew. Some features may stop working without the consent they need.

7. Who We Share It With

We do not sell consumer health data. We share it only as follows:

With your Angels, only the Angels a Star has linked, and only to the extent the Star's sharing settings allow. Face templates are never shared with Angels. A Star can remove an Angel or change sharing at any time.
With service providers that process data on our behalf under written contracts that limit their use of it:
Amazon Web Services, Inc.: cloud hosting, databases, storage, encryption key management, identity (Amazon Cognito), notifications, and email delivery, in the United States (region us-east-2, Ohio).
NuraLogix Corporation: camera-based wellness estimation (DeepAffex / Anura). It receives an encrypted facial blood-flow signal, not images or video, and the demographic values needed for certain estimates.
Twilio Inc.: delivery of one-time verification codes and SMS alert fallback messages. Messages are designed not to contain health details.
Apple Inc.: Sign in with Apple, push-notification delivery, App Attest, HealthKit and HomeKit (on device), and App Store payments.
At your direction, for example when you export your data or share a report with a clinician.
For legal reasons, when we believe in good faith that the law, a subpoena, or a court order requires it, or to protect the safety of our users or others.
In a business transaction, such as a merger or sale of assets, subject to this policy and applicable law.

Ragaven does not share consumer health data with affiliates. [Counsel to confirm: Ragaven LLC has no affiliates that receive consumer health data.]

8. Geofencing

We do not set up a geofence around any place that provides in-person health care services. We do not use location to identify or track people who visit such a place, or to send them messages or ads. The only geofence in Aurora Care is the Safe Zone a Star sets, and we use it only to tell whether the Star has left that Safe Zone. [Counsel to confirm: no other geofence is used in the Services.]

9. How Long We Keep It and When We Delete It

Raw camera images and video: not stored.
Location records: deleted automatically 24 hours after they are created.
On-device reading history cache: kept up to 90 days on your iPhone.
Readings and other account data: kept until your account is deleted. Your account is deleted when you ask us to delete it, or when a plan ends and is not renewed within the grace period below.
Biometric face template: destroyed at the earliest of when you withdraw biometric consent or turn off face recognition, when your account is deleted, or three (3) years after your last interaction with Aurora Care. Destruction from our cloud is completed within 30 days.
Deletion when a plan ends: If a plan ends and is not renewed, we notify the Star and every linked Angel. We send a notice by push notification and email on days 1, 7, 21, and 29 after the plan ends. The last notice is also sent by text message. A 30-day grace period begins when the first notice reaches the Star. If no one renews the plan within 30 days after that first notice, we delete the Star's account and its data. While Apple is still retrying a failed payment, we wait longer before deleting the account, up to 60 days after the plan ended. During the grace period, readings and location sharing are paused. Fall alerts and Safe Zone alerts that the Star has switched on keep working. The Star can download a copy of their data in Settings › Download my data. The Star can also buy their own plan and take over the subscription. If the plan is renewed during the grace period, everything is restored. This rule applies to you only after you have agreed to it. We do not delete an account for non-payment if its holder has not accepted the rule. Section 8 of the Terms of Service has the details.
What we delete with the account: Readings; alerts, including fall, inactivity, and safety events; lab values; medication records and their change history; location records; the face template; appointments; and all other account data. Fall events are treated like other alerts and are deleted with the account.

Only these records survive account deletion:

Consent records and security audit logs: kept for seven (7) years.
Billing and transaction records: kept for up to six (6) years, as tax and financial recordkeeping law requires.
Data under a legal hold: kept until the hold ends.

We restrict these records from any other use. Residual copies in encrypted backups are overwritten in the normal backup cycle. [Counsel to confirm: the length of the backup overwrite cycle.]

10. Your Rights

Subject to the law where you live, you have the right to:

Confirm and access. Ask whether we collect, share, or sell your consumer health data, and get a copy of it.
Know who received it. Get a list of the third parties and affiliates with whom we have shared your consumer health data, with a way to contact them.
Delete. Ask us to delete your consumer health data. When we delete it, we also tell our service providers to delete it. [Counsel to confirm: our service-provider contracts require them to delete consumer health data when we pass on a deletion request.]
Withdraw consent. Withdraw your consent to our collection or sharing of your consumer health data.
Appeal. Appeal our decision if we decline your request.

We will not discriminate against you for exercising these rights.

11. How to Exercise Your Rights

Use the controls in Settings, including Settings › Download my data and account deletion. Or email privacy@ragavencare.com with the subject "Privacy Request."

We will verify your identity before we act. This may include confirming a code sent to the phone or email on your account. You may use an authorized agent where the law allows. We may ask for proof of the agent's authority.

We will respond within the time the law requires, generally within 45 days. We may extend that time where the law permits, and we will tell you if we do.

If we decline your request, you may appeal by replying to our decision with the subject "Privacy Appeal." If you are not satisfied with the outcome of your appeal, you may contact your state attorney general.

12. No Sale of Consumer Health Data

We do not sell consumer health data. We do not "share" it for cross-context behavioral advertising, and we do not show advertising in Aurora Care.

13. How We Protect It

We use encryption in transit (TLS 1.2 or higher with certificate pinning), encryption at rest with customer-managed keys in AWS, encrypted local storage on your iPhone, access controls that limit each account's data to its owner and linked Angels, and an append-only audit log. Only personnel who need consumer health data to provide the Services may access it. No method of storage or transmission is completely secure.

14. Changes to This Policy

We may update this policy. We will post the updated policy in the app and on our website with a new "Last Updated" date. If we make a material change to how we use or share consumer health data, we will notify you and, where the law requires, ask for your consent before the change applies to you.

15. Contact Us