Aurora Care Privacy Policy

Ragaven LLC, d/b/a RagavenCare and AuroraCare

Effective Date: October 28, 2026

Last Updated: October 28, 2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING AURORA CARE.

You must be at least 21 years old to use Aurora Care.

Aurora Care is a general wellness application. It is not a medical device, is not cleared or approved by the U.S. Food and Drug Administration (FDA) or any other regulator, and does not diagnose, treat, cure, monitor, or prevent any disease or medical condition. It is not a substitute for medical devices, laboratory tests, professional medical advice, clinical care, or emergency services. See our Terms of Service for the full wellness disclaimer.

Ragaven LLC, doing business as RagavenCare and AuroraCare ("Ragaven," "Aurora Care," "we," "us," or "our"), provides the Aurora Care mobile application, the Aurora Care Angel web portal, and related websites and services (together, the "Services"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, how we protect it, and the choices and rights you have.

This Privacy Policy forms part of, and is incorporated into, our Terms of Service and our End User License Agreement (EULA). Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Who This Policy Covers

Aurora Care has two kinds of users:

Stars are the people whose wellness is being observed — usually older adults who take readings with their own iPhone.
Angels are the family members, friends, or other caregivers a Star chooses to link with. Angels may use the Aurora Care app or the Angel web portal. (Earlier versions of Aurora Care called Angels "Guardians.")

This policy applies to both Stars and Angels. Where a section applies to only one, it says so.

2. Our Key Privacy Commitments

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising.
We do not show advertising in Aurora Care and do not use your health, biometric, or location data for advertising or marketing profiles.
Your face is not stored as a photo or video. Camera images used for readings are processed in real time and are not saved by Aurora Care or transmitted to our servers.
You control sharing. Angels see only what you allow through your care link and sharing settings, and you can revoke access at any time.
We ask before collecting sensitive data. Camera, location, Apple Health, notifications, Bluetooth, motion, and Face ID access each require your permission through iOS, and certain features require a separate in-app consent.

3. Information We Collect

We collect only the information needed to provide the features you choose to use. Depending on the features you enable, this may include the following.

3.1 Account and contact information. Name, email address, mobile phone number, date of birth or age, sex at birth, and account credentials. If you use Sign in with Apple, we receive the identifier and the name and email (or Apple private-relay email) that Apple provides. One-time verification codes are used to confirm your phone number or email address.

3.2 Profile and wellness context. Information you choose to provide to make readings and trends more meaningful, such as height, weight, home address (for the Safe Zone feature), and wellness goals or threshold preferences.

3.3 Camera-based wellness readings (Stars). When a Star takes a reading, the front-facing camera captures live video of the face for about 20 to 30 seconds. From that video, the Services derive wellness estimates such as pulse rate, breathing rate, heart-rate variability, stress indicators, and, where available, blood-pressure and blood-oxygen estimates, together with signal-quality scores and the date and time of the reading.

Primary engine — NuraLogix (DeepAffex / Anura). Where enabled, the Aurora Care app uses technology licensed from NuraLogix Corporation. The app extracts an encrypted facial blood-flow signal on your device and sends that signal (not pictures or video) directly to NuraLogix's DeepAffex cloud service, which returns the wellness estimates. NuraLogix's privacy policy states that facial images and video do not leave your device and are not stored. NuraLogix may also receive the demographic values needed to compute certain estimates (such as age, sex at birth, height, and weight) and technical data such as a licence token, app version, and operating system.
Fallback engine — on-device. If the NuraLogix service is unavailable or not enabled, Aurora Care uses an on-device algorithm. In that case the camera signal never leaves your iPhone; only the resulting estimates are stored.
What reaches our servers. Our servers receive the derived estimates, quality scores, and reading metadata — never the raw camera frames, images, or video.

3.4 Biometric face template (Stars). With your permission, Aurora Care creates a one-way mathematical representation of your face (a "face template") so that only you can take readings on your account and so readings are attributed to the right person. A face template is not a photograph and your face cannot be reconstructed from it.

The face template is stored encrypted on your iPhone in the iOS Keychain.
A copy is stored in our cloud only if you separately and affirmatively opt in (for example, so recognition still works on a new phone). This option is off by default, and the app works fully without it.
The face template is never shared with Angels, never sold, never leased, never traded, and never used for advertising or any purpose other than identity verification within Aurora Care.
See Section 8 for our biometric retention and destruction schedule.

3.5 Apple Health (HealthKit) data. If you grant permission, Aurora Care reads data you choose from Apple Health, which may include heart rate, heart-rate variability, respiratory rate, blood oxygen, blood pressure, body temperature, steps, sleep, and cardio fitness (VO₂ max). If you explicitly choose to share them, Aurora Care may also receive clinical health records stored in Apple Health (such as lab results, conditions, medications, immunizations, allergies, procedures, and vital signs). If you allow it, Aurora Care may also save readings to Apple Health. We never use HealthKit data for advertising or sell it, and we do not disclose it to third parties for marketing or data brokering, consistent with Apple's rules.

3.6 Lab results and cholesterol information (Stars). Lab values you enter or import (for example, cholesterol panels) and any cardiovascular risk estimate calculated from them. If you scan a printed lab report, text recognition runs on your device; only the structured lab values you confirm are saved. Scanned images, raw text-recognition output, raw health-record payloads, and unrelated notes are not uploaded.

3.7 Medications and appointments. Medication names, dosages, schedules, and reminder times, and appointment details (such as date, time, clinician name, specialty, location, and notes) that you or a linked Angel enter. An Angel may propose adding, changing, or stopping a medication, but the change takes effect only after the Star confirms it. Medication reminders and notifications never speak or display medication names or diagnoses.

3.8 Location (Stars). If you turn on the Safe Zone feature and grant location permission, Aurora Care collects your device's precise location, including in the background (approximately every 30 seconds while permission is granted), to determine whether you have left the safe zone you set. Your home address is entered only after you grant location permission.

3.9 Safety and home-sensor events (Stars). If you enable them: Voice Help requests (triggered by the Apple Vocal Shortcut phrase you set up — Aurora Care receives the request, not a recording of your voice), fall-detection and presence/occupancy events from HomeKit sensors you pair, inactivity signals, and the alert history and acknowledgements that result.

3.10 Care-link and Angel information. Who is linked to whom, invitation codes, the sharing permissions each Star grants, Angel alert preferences, and Angel actions (for example, acknowledging an alert or proposing a medication change).

3.11 Consent and audit records. Records of the legal documents and consents you accepted or withdrew (with version and time) and a security audit log of sensitive actions on your account.

3.12 Device and technical information. Motion and Bluetooth signals used by features you enable, device model, operating-system version, app version, push-notification token, Apple App Attest results (used to confirm requests come from a genuine copy of the app), IP address, time zone, and diagnostic logs. Our logs are designed not to contain health readings or other health details.

3.13 Payment information. Subscriptions are purchased through Apple. We receive subscription status and transaction identifiers from Apple; we do not receive or store your card number.

3.14 Communications. Messages you send to our support team and records of service messages (such as verification codes and SMS alert fallbacks) that we send to you.

4. How We Use Information

We use information only to:

Provide the Services — create and secure your account, take and display readings, compute trends and personal baselines, show changes against your own history and your chosen thresholds, send reminders, and deliver the alerts, summaries, and reports you request.
Support your care network — share information with the Angels you link, according to your sharing settings.
Keep the Services safe and working — authenticate users, prevent fraud and abuse, detect and investigate security incidents, debug, and maintain reliability.
Improve the Services — measure feature performance and reliability using information that is de-identified or aggregated where practicable. We do not use identifiable health or biometric data to build marketing profiles.
Communicate with you — send service, security, and administrative messages. We will not send marketing messages without your consent where consent is required, and you can opt out at any time.
Meet legal obligations — comply with law, legal process, and lawful requests; enforce our agreements; and establish, exercise, or defend legal claims.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Trend indicators and threshold notifications in Aurora Care are informational wellness prompts, not clinical assessments.

5. How We Share Information

We do not sell personal information. We share information only as follows:

With your Angels. A Star's readings, alerts, location (when Safe Zone is on), medications, appointments, and lab results are visible only to Angels the Star has linked, and only to the extent the Star's sharing settings allow. Face templates are never shared with Angels. Stars can remove an Angel or change sharing at any time.
With service providers that process data on our behalf, under written contracts that limit their use of the data to providing services to us and require appropriate security and confidentiality. Where a provider handles health information, we have entered into a business associate agreement or equivalent data-protection agreement where required. Our principal providers are:
Amazon Web Services, Inc. — cloud hosting, databases, storage, encryption key management, identity (Amazon Cognito), notifications, and email delivery, in the United States (region us-east-2, Ohio).
NuraLogix Corporation — camera-based wellness estimation (DeepAffex / Anura), as described in Section 3.3.
Twilio Inc. — delivery of one-time verification codes by SMS or email and SMS alert fallback messages. Messages are designed not to contain health details.
Apple Inc. — Sign in with Apple, push-notification delivery (APNs), App Attest, HealthKit and HomeKit (on device), and App Store payments.
At your direction — for example, when you export your data, share a report, or share a summary with a clinician or anyone else. Once you share information outside Aurora Care, the recipient's handling of it is outside our control.
For legal reasons — when we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process; to protect the rights, property, or safety of Ragaven, our users, or others; or to investigate fraud or security issues. Where permitted, we will try to notify you of requests for your data.
In a business transaction — in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to this Privacy Policy and applicable law. We will notify you before your personal information becomes subject to a materially different privacy policy, and biometric data will not be transferred except as permitted by applicable biometric privacy law.
De-identified or aggregated information that cannot reasonably be used to identify you. We will not attempt to re-identify such data.

6. Notifications and Messages

Push notifications and SMS messages are designed to be PHI-safe: they do not include specific readings, medication names, diagnoses, or other health details. Alerts and messages are best-effort and may be delayed or not delivered (see the Terms of Service). You can turn notifications off in iOS Settings at any time; doing so means Angels may not receive alerts and you may not receive reminders. Standard message and data rates may apply to SMS.

7. How We Protect Information

We use administrative, technical, and physical safeguards designed to protect your information, including:

Encryption in transit using TLS 1.2 or higher with certificate pinning between the app and our servers.
Encryption at rest using customer-managed encryption keys in AWS, and encrypted local storage protected by iOS Data Protection and the Keychain on your device.
Access controls that scope each account's data to its owner and to linked Angels, least-privilege access for our personnel, and an append-only audit log.
App integrity checks and protections against automated abuse.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your device, passcode, and account credentials secure. If we discover a breach affecting your personal information, we will notify you and regulators as required by applicable law, including, where applicable, the HIPAA Breach Notification Rule, the FTC Health Breach Notification Rule, and state breach-notification laws.

8. How Long We Keep Information

We keep personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law.

Raw camera images and video: not stored. They are processed in real time on your device.
Location records: automatically deleted 24 hours after they are created.
On-device reading history cache: kept up to 90 days on your iPhone.
Readings, medications, appointments, labs, alerts, and other account data: kept until your account is deleted, then deleted as described below. Your account is deleted when you ask us to delete it, or when a plan ends and is not renewed within the grace period described below. No automatic expiry is applied to readings or health alerts while your account is open.
Biometric face template (retention and destruction schedule): permanently destroyed, from your device and (if you opted in) our cloud, at the earliest of: (a) when you withdraw your biometric consent or turn off face recognition; (b) when your account is deleted; or (c) three (3) years after your last interaction with Aurora Care. Destruction from our cloud is completed within 30 days of the triggering event.
Account deletion: when you request account deletion, your account enters a 30-day grace period during which you may cancel the request. After the grace period, your personal information is deleted or de-identified, except as described below. Residual copies in encrypted backups are overwritten in the normal backup cycle.
Deletion when a plan ends: If a plan ends and is not renewed, we notify the Star and every linked Angel. We send a notice by push notification and email on days 1, 7, 21, and 29 after the plan ends. The last notice is also sent by text message. A 30-day grace period begins when the first notice reaches the Star. If no one renews the plan within 30 days after that first notice, we delete the Star's account and its data. While Apple is still retrying a failed payment, we wait longer before deleting the account, up to 60 days after the plan ended. During the grace period, readings and location sharing are paused. Fall alerts and Safe Zone alerts that the Star has switched on keep working. The Star can download a copy of their data in Settings › Download my data. The Star can also buy their own plan and take over the subscription. If the plan is renewed during the grace period, everything is restored. This rule applies to you only after you have agreed to it. The Star agrees at sign-up, and the person who pays agrees when subscribing. Existing users are asked once in the app and are covered only after they accept. We do not delete an account for non-payment if its holder has not accepted the rule. Section 8 of the Terms of Service has the details.
What we delete with the account: Readings; alerts, including fall, inactivity, and safety events; lab values; medication records and their change history; location records; the face template; appointments; and all other account data. Fall events are treated like other alerts. They are not kept after the account is deleted. Aurora Care is a wellness service, and no medical-records retention rule requires us to keep this data. This applies whether you asked us to delete your account or a plan was not renewed.
Records we keep after deletion: only consent records and security audit logs (kept for seven (7) years), billing and transaction records (kept for up to six (6) years, as tax and financial recordkeeping law requires), and data under a legal hold (kept until the hold ends) survive account deletion. We restrict these records from any other use.

9. Your Choices and Rights

Choices available to everyone. You can:

Grant or revoke camera, location, Apple Health, notification, Bluetooth, motion, and Face ID permissions in iOS Settings.
Turn optional features (Safe Zone, Voice Help, cloud face-template storage, lab sharing) on or off in Aurora Care Settings.
Add, remove, or change the permissions of linked Angels.
View and edit your profile, medications, and other information you entered.
Request a copy (export) of your data and request account deletion in Settings.
Withdraw any consent at any time. Withdrawal does not affect processing that took place before you withdrew, and some features may stop working without the consent they require.

Rights under U.S. state privacy laws. Depending on where you live (for example, California, Colorado, Connecticut, Delaware, Montana, Nevada, Oregon, Texas, Utah, Virginia, Washington, and other states), you may have the right to: know and access the personal information we hold about you; correct inaccurate information; delete your information; obtain a portable copy; opt out of the sale or sharing of personal information or targeted advertising (we do neither); limit or withdraw consent to the use of sensitive personal information, including health, biometric, and precise location data; and not be discriminated against for exercising your rights. We honor Global Privacy Control signals as an opt-out request where required.

California residents. In the preceding 12 months we collected the categories described in Section 3 (identifiers; personal records; characteristics such as age and sex; commercial information (subscription status); biometric information; internet or device activity; geolocation; sensory information (camera input processed in real time); and sensitive personal information including health, biometric, and precise location data) from you and your device, for the purposes in Section 4, and disclosed them to the categories of recipients in Section 5. We do not sell or share personal information and do not use sensitive personal information for purposes other than those permitted under California law.

Washington, Nevada, Connecticut, and other consumer health data laws. Our separate Consumer Health Data Policy explains what consumer health data we collect, why we collect it, where it comes from, who we share it with, how long we keep it, and how to exercise your rights. It is available in the app and on our website. We collect and share consumer health data only with your consent or as necessary to provide the Services you request, and we never sell it. You may access, delete, or withdraw consent for your consumer health data using the contacts below. [Counsel to confirm: the web address of the Consumer Health Data Policy, and that it is linked from the website homepage.]

HIPAA. Aurora Care is a consumer service. When you use it directly, the information you provide is generally not "protected health information" under HIPAA, but we nonetheless apply safeguards modeled on the HIPAA Security Rule. If we provide Services to you on behalf of a HIPAA covered entity (such as your health plan or provider), we act as that organization's business associate, and the business associate agreement and the covered entity's Notice of Privacy Practices govern that information to the extent they conflict with this policy.

Users outside the United States. Aurora Care is intended for users in the United States, and your information is stored and processed in the United States. If you nonetheless use the Services from another country, you understand your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Where the EU or UK General Data Protection Regulation applies, we process data to perform our contract with you, with your explicit consent (for health and biometric data), and for our legitimate interests in securing and improving the Services; you may have the additional rights to restrict or object to processing and to lodge a complaint with your local supervisory authority.

How to exercise your rights. Use the controls in Settings, or email privacy@ragavencare.com with the subject "Privacy Request." We will verify your identity before acting, which may include confirming a code sent to the phone or email on your account. You may use an authorized agent where the law allows; we may ask for proof of the agent's authority. We will respond within the time required by law (generally within 45 days, extendable where permitted). If we deny your request, you may appeal by replying to our decision with the subject "Privacy Appeal"; if you are unsatisfied with the outcome of an appeal, you may contact your state attorney general.

10. Angels and Information About Others

If you are an Angel, you will see information about a Star only because the Star chose to share it with you. You agree to use it only to support that Star's wellness and safety, to keep it confidential, and not to copy, disclose, or use it for any other purpose. If you enter information about another person (for example, an appointment for a Star, or an invitation to a new Angel), you confirm you have their permission to do so.

11. Children

Aurora Care is intended only for adults aged 21 and older. We do not knowingly collect personal information from anyone under 21. If you believe a person under 21 has provided us information, contact us and we will delete it.

12. Third-Party Services and Links

Your use of Apple services (including HealthKit, Sign in with Apple, and the App Store) is governed by Apple's terms and privacy policy. NuraLogix's own processing is described in the NuraLogix Privacy Policy at nuralogix.ai/privacy-policy. Links to third-party websites or services are provided for convenience; we are not responsible for their privacy practices, and we encourage you to read their policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy in the app and on our website with a new "Last Updated" date. If we make material changes — especially to how we use or share health, biometric, or location data — we will notify you in the app or by email and, where required by law, ask for your consent again before the change applies to you. Information is handled under the version of this policy in effect when it was collected unless you consent otherwise.

14. Contact Us

Ragaven LLC, d/b/a RagavenCare and AuroraCare

Privacy questions and requests: privacy@ragavencare.com

General support: support@ragavencare.com

Annex A. Additional text from the In-app Privacy Policy (proposed for counsel review)

The Aurora Care app shows its own Privacy Policy, consent version 2026-10-31-1. The sentences below appear in that in-app text but have no close match in this document. They are inserted as tracked changes so each can be accepted, reworded into the body above, or rejected. Where a sentence restates a commitment this document already makes in different words, rejecting it loses nothing.

A Note Before You Begin

Aurora Care is built for older adults and the family members who care about them.
We have written this policy to be read, not skimmed past.
Section 1 is a plain-language summary of everything that follows.
If you read only one section, read that one.
Aurora handles two kinds of information that the law treats as especially sensitive: health information and biometric information (a mathematical template derived from your face).
We describe both in detail, in Sections 4 and 5.
Do not use its estimates or alerts to make treatment or medication decisions, or in place of professional medical care or an FDA-authorized medical device.

1. The Short Version

Your face stays on your phone.
Aurora creates a one-way mathematical code from your face so that only you can record your own vital signs.
Aurora keeps a copy in the cloud only if you specifically turn that on — it is off unless you choose it, and the app works completely without it.
Your Angels see what you allow them to see.
An Angel is a family member or caregiver you have linked to your account.
They see your vitals, your medication list, and — if you enable it — your location, according to permissions you control and can revoke.
Location is for safety, not surveillance.
If you turn on the Safe Zone feature, your Angels are alerted when you travel outside the area you defined.
Routine movement inside your safe zone is never reported.
Aurora is not a 911 service and does not dispatch emergency help.
Push notifications and text messages can be delayed, silenced, or missed.
You can delete your account and your data, including your face code, at any time.
The rest of this document is the complete version.
Where a section says something different from this summary, the complete version controls.

2. Who We Are and What This Policy Covers

Ragaven LLC, doing business as RagavenCare and AuroraCare ("Aurora Care," "Aurora," "we," "us," or "our"), operates the Aurora Care mobile application and its supporting cloud services (together, the "Service").
It applies to everyone who uses the Service, in either of two roles:
Star — the person whose health and safety Aurora helps monitor, typically an older adult.
Angel — a family member, friend, or caregiver a Star has invited and linked to their account, who receives alerts and may view information the Star has shared.
Earlier Aurora documents, and parts of the Aurora codebase and engineering records, use the word "Guardian" for the role now called "Angel." The two terms refer to the same role.
This policy is intended to be consistent with applicable privacy laws, including the Health Insurance Portability and Accountability Act ("HIPAA") where it applies to Protected Health Information ("PHI").
If this policy conflicts with a signed business associate agreement or another contract governing PHI, that agreement controls to the extent required by law.

3. Age Restriction

If we learn that we have collected information from someone under 21, we will delete it.

4. What Aurora Collects, and Where It Goes

The table below is the complete inventory of information Aurora collects.
"Leaves your device" means the information is transmitted to Aurora's cloud infrastructure.
"Visible to Angels" means a linked Angel may see it, subject to the permissions you set.
Used to confirm that the enrolled Star is the person recording a vitals reading, and to recognize you across your own devices.
The derived measurements, a quality score, and capture metadata are sent to Aurora.
Raw camera frames never leave your device.
Yes — lab and cholesterol values are stored in Aurora's cloud on consent-gated routes Yes, per your care link
Collected in the background approximately every 30 seconds while location permission is granted.
Read on device. [OPEN ITEM — ENGINEERING] Which derived values, if any, are transmitted is being re-confirmed.
Aurora's backend is hosted on Amazon Web Services in the US East (Ohio) region — us-east-2, United States.
Aurora does not currently host data outside the United States.
Information held on an Angel's device.
When you share information with an Angel, the Aurora app on that Angel's phone keeps a local copy so it can display your recent readings without a network connection.
This copy is protected by the Angel's device passcode and iOS file protection.
Section 11.3 explains what happens to it when you revoke a care link.
App usage and diagnostics ("Help improve Aurora").
To find and fix problems, Aurora records how the app is used.
That means which screens you open and how you got there, how long you stay, what you tap, how long screens and actions take, and when the app crashes or freezes.
These records are linked to your account.
They never contain your health readings, lab values, medication details, location, or anything you type.
You can turn this on or off at any time with the "Help improve Aurora" switch: Stars find it in Settings › Security and privacy, and Angels in Profile › Privacy & Security.
In the United States it is on unless you turn it off.
Everywhere else it is off unless you turn it on.
Sign-in code records (when a code was sent and whether it was accepted, with only the last four digits of your phone number) are kept for 90 days to prevent misuse and to help when sign-in fails.

5. Your Face Template — Biometric Information

This is the most sensitive information Aurora handles, so we describe it in full.

5.1 What Aurora creates, and why

When you enroll, Aurora generates a face template: a one-way mathematical representation derived from your face.
Aurora uses it for two purposes only:
To verify that the person taking a vitals reading is you, so that a reading recorded by someone else is not attributed to your health record; and
To recognize you across devices you own.
It is a set of numbers produced by a one-way process.

5.3 Cloud storage is opt-in and off by default

This setting is off by default.
It appears in Settings, not during onboarding.
You will never be asked for it while setting up your account, and setup will never be blocked on it.
Every feature of Aurora works without it.
The only thing cloud storage adds is that your face still works if you get a new phone.
Aurora's servers refuse to store a face template without an active consent record on file.

5.4 What Aurora never does with it

Never shared with your Angels or with any other person or company;
Never sold, licensed, traded, or otherwise disclosed for value;
Never used to identify you to anyone other than yourself.

5.5 How it is protected

The face template is encrypted at rest using an AWS Key Management Service customer-managed key dedicated to health and biometric data, and encrypted in transit using TLS 1.3 with certificate pinning.
Access is scoped to your account.

5.6 Withdrawing consent and deletion

Doing so removes the template from both Aurora's cloud and your device.
Deleting your Aurora account also deletes the template from both locations.

5.7 Retention and destruction schedule

This section exists in part to satisfy the published-schedule requirement of the Illinois Biometric Information Privacy Act.

5.8 Help deciding

If you would like help deciding whether to enable cloud storage of your face template, you may ask a linked Angel to review the choice with you.
The decision remains yours, and is recorded against your account.

6. Lab Results

Lab and blood-panel values you enter — including cholesterol values used for cardiovascular risk estimation — are stored in your Aurora account under HIPAA safeguards, on routes that require an active consent record before Aurora will read or write them.
Aurora uses them to support health trends, risk-score context, and care summaries.
Earlier Aurora materials described lab values as stored "on your device only" and never transmitted.
That statement was inaccurate for cholesterol and lab-panel values and has been retired.
This section reflects the current engineering record.
The following are excluded and are never uploaded: scanned images, raw OCR text, raw FHIR payloads, unrelated clinical notes, and unsupported clinical-record fields.
Health records you view through Aurora's Apple Health records viewer are read on your device and are not copied into a separate Aurora store.
Angels see lab results per your care link and Angel-sharing permissions.

7. Location and the Safe Zone

Location collection is entirely optional and requires two separate affirmative steps from you.
After you tap "Enable Location Access" and grant iOS system-level permission, Aurora collects your device's GPS coordinates in the background approximately every 30 seconds, for as long as the app is installed and permission remains granted.
Aurora does not collect location without your grant.
You enter your home address after granting location access — Aurora never obtains your address without your permission.
You define a safe zone around your home address.
An Angel is alerted only if you travel outside that zone.
Routine movement within the zone is never reported to anyone.
Aurora staff do not access your real-time coordinates.
Aurora retains no historical location history beyond this window.
Location data and your home address are not sold, used for advertising, or shared with anyone outside your Angel network.
You can update or remove your home address and safe zone at any time in Settings, and you can turn off location sharing entirely from Settings → Privacy → Location or from your device's system settings.
Revoking permission immediately stops all location collection.
Removing your safe zone stops location-based Angel alerts.

8. Medications

If you add medications in Aurora, the names, dosages, and schedule times you enter are stored as part of your account so the list is preserved across your devices and visible to your linked Angels.
Medication entries are saved only when you tap Save, or confirm the "Save medications?" prompt.
They are cached encrypted on your device and stored encrypted in Aurora's cloud.
Medication reminder audio never says medication names, diagnoses, or other medical terms, and alert notifications never contain them.
You can edit or remove any medication at any time from Settings → Medications.
Removing a medication stops its reminders; the change record is retained as part of your care history.
Deleting your account removes your medication records.

9.1 When Aurora asks

Aurora requests notification permission at specific moments of value, not during initial account setup:
When an Angel accepts your invitation and links to your Star account, Aurora requests notification permission so your Angels can receive alerts when your vital signs cross the safe-range thresholds you configured.
After you complete your first vitals capture session, Aurora may request notification permission to send reminders that help you maintain a consistent monitoring routine.
Angels who link to a Star account are prompted to enable notifications during their alert-preference setup, so they can receive connection events and threshold-based health alerts.

9.2 No PHI in notifications

Notifications are delivered through the Apple Push Notification service.
Aurora does not include Protected Health Information — specific vital readings, medication names, or diagnoses — in notification payloads.
Notification text is limited to PHI-safe templates.

9.3 Alerts are best-effort

They may be delayed, blocked, silenced, unavailable, or missed because of device settings, Focus or Do Not Disturb, Notification Summary, network coverage, carrier delivery, battery state, third-party platform behavior, or a recipient's failure to notice or respond.
Aurora does not guarantee that any Angel will receive, see, hear, acknowledge, or respond to an alert.
Aurora is not a 911 service, emergency dispatch service, alarm company, or medical device, and is not a substitute for trained emergency personnel.
For a life-threatening emergency, use your phone's emergency services feature or call emergency services directly.

9.4 Turning them off

You may revoke notification permission at any time from iOS Settings → Aurora → Notifications.
Revoking permission stops Aurora push notifications; all other features remain available.

10. How Aurora Uses Information

Aurora uses the information described above to:
Provide, maintain, and improve the Service;
Deliver vitals capture, trends, risk context, medication reminders, and safety alerts;
Enable the sharing you have authorized between you and your Angels;
Verify that the enrolled Star is the person recording a reading;
Process subscriptions, billing, and customer support;
Send service messages, notices, and administrative communications;
Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized access;
Maintain consent and audit records; and
Aurora does not sell personal information, health information, or biometric information, and does not use them for advertising or profiling.

11.1 Your Angels

Information flows to a linked Angel only through a care link you created and can revoke.
What an Angel sees is determined by the permissions you set.
Your face template is never included.

11.2 Service providers

A HIPAA business associate agreement is in place.

11.3 What happens on an Angel's device when you revoke

Revoking a care link immediately stops any further information from reaching that Angel, and stops their access to Aurora's servers for your account.
Information already delivered to an Angel may remain stored in the Aurora app on that Angel's phone.
Aurora does not currently perform a server-driven purge of that local copy.
It is removed when the Angel deletes the Aurora app or clears its data.
The same is true after you delete your Aurora account.

11.4 Other disclosures

To comply with law, legal process, or a governmental request;
To protect the rights, property, or safety of Aurora, our users, or the public;
To professional advisors, such as auditors and counsel, under duties of confidentiality; and
Where PHI is involved, disclosures are limited to the minimum necessary for the permitted purpose and are governed by applicable HIPAA requirements and any signed business associate agreement.

12. How Long Aurora Keeps Information

No automatic expiry is configured today.
Deleted with the account, like other alerts.
Health alerts (alerts raised from your readings and their delivery status) Until account deletion (Section 13.3).
Your account and its data when a plan ends and is not renewed Deleted 30 days after the first notice reaches the Star, if the plan is not renewed and the Star (and the paying Angel, when an Angel pays) agreed to this rule.
Consent records, security audit logs, billing records and data under a legal hold are kept.
Angel invitation records (name and phone number of the person invited) 24 hours, then automatically expire
These records are append-only and are not deleted on account deletion.
Some records must be retained even after you ask us to delete your account — for example, consent and audit records, and billing records required by tax law.
Section 13.3 explains how this interacts with your deletion rights.

13.1 Rights available to everyone

Decline cloud sync of your face template.
Revoke any care link, ending an Angel's access.
Turn off location sharing, remove your safe zone, or remove your home address.
Edit or remove medications and lab values.

13.2 Access and portability

You may request a copy of the information Aurora holds about you.
Aurora produces an encrypted export covering your account data, vital signs, location history, medications, lab values, alerts, appointments, and consent records.
The export does not currently include your cloud-stored face template, even though account deletion does remove it.
Engineering has this recorded as an open defect.

13.3 Correction, deletion, and restriction

You may request correction or amendment of information Aurora holds about you. [OPEN ITEM — COUNSEL] The mechanism for rectification has not been specified.
You may request deletion of your account.
After that, deletion cascades across Aurora's databases, authentication system, push registration, and stored exports.
Certain records are excepted: consent and audit records (which are append-only and required for compliance), billing records required by law, information Aurora must retain to resolve a dispute or enforce an agreement, and the local copy held on a linked Angel's device (Section 11.3).
You may withdraw any consent you gave, at any time. [PROPOSED — COUNSEL TO CONFIRM] Withdrawal is not retroactive but stops the relevant processing going forward.
The effects and timelines of withdrawal have not been settled.
A user-initiated restriction of processing is not available today.
Aurora can suspend an account at an operator's direction, but there is no self-service control by which you can restrict processing while keeping your account open.

13.4 If HIPAA applies

Where PHI and HIPAA rights are involved, requests will be handled in accordance with HIPAA and any applicable business associate agreement, which may impose different timelines and exceptions than those described above.

13.5 How to exercise a right

Use the controls in Settings where available, or contact us at the address in Section 17.

14. How Aurora Protects Information

At rest: AWS Key Management Service customer-managed keys, including a key dedicated to health and biometric data.
On your device, information is held in the iOS Keychain and in encrypted local storage with file-level protection.
On an Angel's device: the local copy of a Star's information is protected by iOS file protection and the device passcode.
Access scoping: Cloud face templates and health information are scoped to the owning account.
Every route that reads or writes health information checks for an active consent record and fails closed.
An Angel reaches a Star's information only through an explicit, revocable care link.
No PHI or credentials in logs.
Audit trail: Sensitive actions are written to an application-level append-only audit log bound to the authenticated actor.

15. International Users and Data Transfers

Aurora's infrastructure is located in the United States.

16. Third-Party Services and Changes

We are not responsible for the privacy practices of third parties.
The updated version will be posted with a revised effective date.
If a change materially affects how we handle your health or biometric information, we will notify you in the app or by email before it takes effect, and — where required — obtain your consent again.

17. Contact Us

For privacy questions, requests to exercise your rights, or complaints, contact us at the email address above.
If you are not satisfied with our response, you may have the right to complain to a supervisory authority in your jurisdiction, including the U.S.
Department of Health and Human Services Office for Civil Rights where HIPAA applies.

(other)

Who We Are and What This Policy Covers
Information What it is Leaves your device?
Face template A one-way mathematical representation of your face (approximately 256 numbers).
Only if you turn on cloud sync — off by default No — never
Vital signs Heart rate, respiratory rate, blood pressure estimate, blood oxygen (SpO₂), and heart rate variability, measured on your device from the camera.
Medications Medication names, dosages, and schedule times you enter.
Yes — encrypted on device and in Aurora's cloud Yes, your shared list
Location GPS coordinates supporting the optional Safe Zone feature.
Yes, when the feature is enabled Yes, per your care link
Home address The address you enter to define your safe zone.
Apple Health data Steps, sleep, heart data, and similar metrics read from Apple Health if you permit it.
Phone number Used to sign you in with a one-time code sent by text message.
Yes, to our messaging provider and authentication service No
Identifiers and contact details Name, email address, mailing address, and account credentials.
Angel relationships Who is linked to whom, and invitation codes.
Consent and audit records Append-only records of consents you granted or withdrew, and of sensitive actions taken on your account.
Push token A device identifier used to deliver alerts.
Payment and billing Subscription status, transaction metadata, and limited payment-processing details.
Device, usage, and technical data IP address, device identifiers, app activity, logs, and analytics.
Fall, inactivity, and safety events Records of detected falls, inactivity periods, and threshold breaches that trigger an alert.
Yes Yes, per your care link
Voice Help activation A record that you triggered Voice Help. [OPEN ITEM — ENGINEERING] Whether wake-phrase detection is entirely on-device, and whether any audio leaves your phone, must be confirmed before publication.
Communications Text messages, email, support messages, and call-related metadata.
Your Face Template — Biometric Information
5.1 What Aurora creates, and why
5.2 On your device by default
5.3 Cloud storage is opt-in and off by default
5.4 What Aurora never does with it
Amazon Web Services (us-east-2, USA) Hosting, storage, encryption, push delivery All backend data, including PHI.
Apple Push notification delivery (APNs); Apple Health integration (on device) Push token; health data read locally on your device
11.3 What happens on an Angel's device when you revoke
Location records 24 hours from creation (figure carried from the prior policy; the enforcing control requires engineering confirmation)
Face template Until consent withdrawal, account deletion, or [3 years] after last use — whichever comes first; destroyed within [30 days]
Vital signs and derived health metrics Until account deletion (Section 13.3).
Medication records Life of the account; deleted on account deletion, including change records
Lab and cholesterol values Until account deletion (Section 13.3)
Fall, inactivity, and safety events Until account deletion (Section 13.3).
Account and contact information Life of the account, plus [90 days] after deletion for backup expiry
Local copy on an Angel's device Until that Angel deletes the app or clears its data (Section 11.3)
13.5 How to exercise a right