Privacy Policy

1. Information We Collect

Account Information

When you create a Gabriel Care account, we collect:

• Name
• Email address
• Date of birth
• State of residence
• Phone number

Health Information

To provide personalized recommendations and process claims, we collect:

• Health interests and wellness goals
• Current insurance status
• Experience with integrative and functional medicine
• Medical claims data (provider, service type, amount, receipts)
• Treatment protocols and outcomes (if voluntarily shared)

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card numbers. We receive from Stripe:

• Last four digits of your payment card
• Card type and expiration date
• Billing address
• Transaction history

Wearable & Biometric Data

If you connect a wearable device via Terra API, we collect:

• Daily step count
• Heart rate and heart rate variability (HRV)
• Sleep duration and quality metrics
• Activity and exercise data
• Other metrics available through your connected device

If you connect Apple Health in the Gabriel iPhone app, we collect the Apple Health data described in Section 3B.

Genetic Information

If you import a raw DNA file or share genetic results with Gabriel, we collect the genetic information described in Section 3C.

Usage Data

We automatically collect information about how you use Gabriel Care:

• Pages visited and features used
• Time spent on the platform
• Device type, operating system, and browser
• IP address and general location
• Interactions with Gabriel Intelligence (queries, chat history)

Communications

We collect communications you send to us, including:

• Support messages and inquiries
• SMS messages (if you opt in to text notifications)
• Email correspondence
• Feedback and survey responses

2. How We Use Your Information

We use the information we collect to:

• Process membership and claims: Verify eligibility, process payments, and reimburse approved medical expenses
• Provide AI health scoring and recommendations: Gabriel Intelligence uses your health data, wearable metrics, and claims history to generate personalized health scores and treatment recommendations
• Correlate treatments and outcomes: Analyze anonymized data to identify patterns and improve our wellness benefit categories
• Communicate with you: Send account updates, claim status notifications, educational content, and important service announcements via email, SMS, and in-app messages
• Improve our services: Analyze usage patterns to enhance Gabriel Intelligence, optimize the user experience, and develop new features
• Prevent fraud and abuse: Monitor claims for fraudulent activity and ensure fair use of community resources
• Comply with legal obligations: Respond to legal requests, enforce our Terms of Service, and protect our rights and the rights of our members

3. How We Share Your Information

Service Providers

We share your information with trusted third-party service providers who help us operate Gabriel Care:

• Stripe: Payment processing and bank transfers
• Supabase: Database hosting and authentication
• Vercel: Web hosting and application infrastructure
• Terra API: Wearable device data integration
• Twilio: SMS notifications
• Resend: Transactional email delivery

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

The AI model providers Gabriel works with are described in Section 3A.

We Never Sell Your Data

Your personal information is never sold to third parties. We do not share your data with advertisers or data brokers.

Mobile Information and SMS Consent

If you provide a mobile number and opt in to SMS, we use your number to send account verification codes, benefits and care navigation updates, reminders, and service messages. Message frequency varies. Message and data rates may apply. You can reply STOP to opt out or HELP for help at any time.

We do not sell or share mobile numbers or SMS consent with third parties or affiliates for their marketing or promotional purposes. Mobile information is shared only with service providers, such as Twilio, as needed to deliver Gabriel Care messages and operate the service.

Practitioner Directory

Gabriel uses Google Maps Platform to retrieve current public business information, ratings, review counts, and photos when you search the practitioner directory. Google content is fetched when needed and is subject to the Google Maps Platform Terms and the Google Privacy Policy.

Legal and Regulatory Disclosures

We may disclose your information if required by law or in response to:

• Subpoenas, court orders, or legal process
• Requests from government agencies or regulators
• Situations involving potential threats to safety or security

Aggregated and Anonymized Data

We may use and share aggregated, anonymized data that cannot identify you personally for research, analytics, and to improve health outcomes for our community. For example, we may publish insights like "Members using peptide protocols reported a 23% improvement in recovery time."

3A. AI Model Providers

Gabriel is a reasoning and orchestration layer that works with AI models from third-party providers. We choose and change those providers over time, and may also use privately hosted models.

When you use Gabriel in the app, on the web, or by text, we send the providers your message, the recent conversation, any photos or files you share, and information from your Gabriel Record, such as your labs, medications, Apple Health data, and genetic findings. The same applies when Gabriel reads a document you submit, transcribes a recording, or makes a phone call about your care or a claim.

Providers process this information for us under their terms for business customers. We do not sell it or share it for advertising. The Gabriel app asks your permission before it first sends your information to AI providers.

3B. Apple Health

If you connect Apple Health in the Gabriel iPhone app, the app asks for your permission and then reads, but never writes, the following Apple Health data: steps, resting heart rate, heart rate variability, sleep, and heartbeat series recorded by Apple Watch, and on supported iOS versions, breathing disturbances during sleep and sleep apnea and hypertension notifications. The app turns heartbeat series into a daily coherence score on your iPhone, then sends daily summaries to your Gabriel account so your Record is the same on every device.

We use Apple Health data only to provide Gabriel to you: to show your trends, to inform Gabriel's answers and suggestions, and, for Gabriel Care members, to calculate the wearable engagement bonus. We share it only to provide the service to you, including with the AI model providers in Section 3A with your permission. We do not use Apple Health data for advertising, marketing, research, or other data mining, and we never sell it. We do not store Apple Health data in iCloud.

You can turn off Gabriel's access at any time in your iPhone's Settings (Privacy & Security, then Health) or in the Health app. Turning it off stops new reads. Summaries already in your Record stay until you delete your account or ask us to delete them at privacy@askgabriel.com.

3C. Genetic Information

Importing genetic data is optional. If you import a raw DNA file (a 23andMe, AncestryDNA, or VCF file) in the Gabriel app, the app reads the file on your device, and the raw file is not uploaded. The app sends the genetic markers it recognizes to our servers, which keep a limited set of findings and discard the rest. For each finding we save the variant (rsID), the gene, your genotype, what it means, a suggested next step, and the strength of the evidence, along with the type of file, the number of markers read, and the date you imported it. If you share genetic results with Gabriel by text message, Gabriel may save them with your phone number.

We use your genetic information to personalize Gabriel's answers. Your findings are part of the Record information sent to the AI model providers described in Section 3A when you message Gabriel, and when a question relates to them, we look them up in Gabriel's clinical reference tools. Those lookups send the variant and your genotype, without your name or account details. Findings linked to disease risk are hidden until you choose to see them in the app, and Gabriel uses them in answers only after you make that choice.

We do not sell your genetic information. We do not share it with your employer or a team sponsor, with insurers, or with data brokers. We do not use it for advertising, and we do not use it to decide your membership eligibility, price, or benefits.

We keep your genetic findings until you remove them or delete your account. You can remove them at any time in the app. The app also keeps a copy of your results on your device, which is removed when you delete the app or clear its data. Genetic results you shared by text, and past conversations or notes that mention your results, are not removed that way; email privacy@askgabriel.com and we will delete them.

4. HIPAA Compliance

Gabriel Care LLC is committed to protecting your health information in compliance with the Health Insurance Portability and Accountability Act (HIPAA).

• Encryption: All health data is encrypted in transit (TLS) and at rest (AES-256)
• Access controls: Only authorized personnel can access identifiable health information
• Business Associate Agreements (BAAs): All service providers handling health data have signed BAAs
• Audit logging: All access to health data is logged and monitored
• Regular security assessments: We conduct routine security audits and vulnerability assessments

5. Your Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following rights:

• Right to Know: You can request details about the personal information we collect, use, and share
• Right to Delete: You can request that we delete your personal information (subject to legal exceptions)
• Right to Opt-Out of Sale: We do not sell personal information, so there is nothing to opt out of
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at privacy@askgabriel.com.

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access controls: Role-based access with multi-factor authentication for staff
• Regular backups: Automated daily backups stored in secure, redundant locations
• Security monitoring: 24/7 intrusion detection and anomaly monitoring
• Incident response: Documented procedures for responding to security breaches

While we take every precaution to protect your data, no system is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information to the best of our ability.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. After you cancel your membership, we retain your data for:

• Seven (7) years: Financial and claims records (required for tax and legal compliance)
• Anonymized permanently: Aggregated health insights used for research

You may request deletion of your account at any time by contacting privacy@askgabriel.com. We will delete your data within 30 days, except where retention is required by law.

Deleting Your Account

You can delete your account in the Gabriel app (Settings, then Delete account) or by emailing privacy@askgabriel.com. Deleting your account in the app removes your sign-in and your Gabriel Record right away, including your chats, health profile, routine, lab results, wearable and Apple Health data, and the genetic findings you imported. Files you uploaded or sent by text, such as chat attachments and forms you filled or signed, are deleted within 30 days, except the Gabriel Care records described below.

Deleting your account does not cancel a Gabriel Care membership or change its billing, so cancel your membership separately. Records Gabriel Care keeps for your membership, claims, and reimbursements, including receipts and insurance documents you submitted for them, are kept with the financial and claims records for the seven years described above, then deleted. Text messages you exchanged with Gabriel are stored with your phone number and are not removed when you delete your account in the app; email privacy@askgabriel.com and we will delete them within 30 days, except where retention is required by law.

8. Children's Privacy

Gabriel Care is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete it promptly.

9. International Users

Gabriel Care is designed for US residents only. If you access Gabriel Care from outside the United States, your information may be transferred to and processed in the US. By using our services, you consent to the transfer and processing of your information in the United States.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Email notification to your registered email address
• In-app notification when you next log in
• Posting the updated policy on this page with a new "Last updated" date

Changes will take effect 30 days after notification. Your continued use of Gabriel Care after the effective date constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your information, please contact us:

Gabriel Care LLC
Email: privacy@askgabriel.com
Address: 5725 S Valley View Blvd Ste 5, Las Vegas, NV 89118

For privacy-related requests (data access, deletion, etc.), please use privacy@askgabriel.com for fastest response.