Insight Health Apps Terms & Conditions, Privacy Policy & Medical Disclaimer

These Terms & Conditions, Privacy Policy, and Medical Disclaimer govern your use of Insight Health Apps websites, software, mobile applications, subscriptions, practitioner platforms, educational programs, affiliate services, distributor programs, and related products or services.

Medical Disclaimer

Insight Health Apps products, software, mobile applications, educational materials, reports, and services are intended solely as consumer wellness products and are designed to complement, not replace, appropriate medical care.

Our products and services have not been evaluated by the U.S. Food and Drug Administration (FDA) or other governmental regulatory authorities and are not intended to diagnose, treat, cure, mitigate, or prevent any disease, illness, medical condition, or psychological disorder.

Information provided through our software, websites, reports, educational materials, and support services is for informational and educational purposes only and should never be interpreted as medical advice.

If you have any medical condition, symptoms, or concerns regarding your health, you should consult a qualified physician or other licensed healthcare professional before making healthcare decisions.

Use of Insight Health Apps products and services is entirely at your own risk.

Acceptance of These Terms

By accessing or using any Insight Health Apps website, mobile application, software, online service, educational platform, subscription, practitioner platform, affiliate portal, distributor portal, or related service, you acknowledge that you have read, understood, and agree to be bound by these Terms and Conditions.

If you do not agree to these Terms, you must discontinue use of our products and services.

Privacy Policy

This Privacy Policy explains how Possibility Wave LLC, doing business as Insight Health Apps ("Insight Health Apps", "we", "us", or "our"), collects, uses, stores, shares, transfers, and protects personal information when you use our websites, software, mobile applications, practitioner platforms, and related services (together, the "Services").

We never sell or rent personal information. We do not share personal information for cross-context behavioral advertising, and we do not use client records for our own marketing.

Who We Are: Legal Entity and Contact Details

Legal entity: Possibility Wave LLC, doing business as Insight Health Apps

Registered and mailing address: 3325 Sagunto Street, Santa Ynez, California 93460, United States

Privacy contact: rw@insighthealthapps.com · Telephone: 800-277-2853

EU Representative

For individuals in the European Union, our representative for the purposes of Article 27 of the EU GDPR is Ryan Williams, who can be contacted at rw@insighthealthapps.com or on 800-277-2853. You may contact our EU representative on any matter relating to the processing of your personal data and to the exercise of your rights under the GDPR, in addition to contacting us directly.

Use the privacy contact above for every data protection matter, including GDPR and UK GDPR requests, Data Processing Agreement (DPA) requests, security questions, and data breach notifications. We aim to acknowledge written privacy enquiries within five business days.

Our Role: Data Controller or Data Processor

Data protection law distinguishes between a "controller" (who decides why and how personal data is processed) and a "processor" (who processes it on the controller's behalf). We act in both roles, depending on the information involved.

1. We act as a data controller for the information you provide when you create an account, purchase a license or subscription, download or use our apps as an end user, contact support, attend training, or join our affiliate, ambassador, or practitioner programs. This includes your account details, order and billing records, support conversations, and website and app usage data.

2. We act as a data processor when a practitioner, clinician, coach, or other professional user ("Professional User") enters information about that Professional User's own clients into the Services. This covers items such as a client's first and last name, date of birth, email address, symptoms or complaints the client reports (for example headaches, joint pain, or sleep difficulties), and individual session reports generated by the software. For this information the Professional User is the data controller and we are the processor. We process client records only on the Professional User's documented instructions, in order to store them, synchronise them across the Professional User's devices, generate the reports the Professional User requests, provide the technical support the Professional User requests, and maintain the security of the Services.

When we act as a processor we do not: use client records for our own purposes, sell or license client records, use client records to train artificial intelligence models, use client records for advertising or marketing, or disclose client records except as instructed by the Professional User, as described in this policy, or as required by law.

If you are a client of a Professional User and you want to access, correct, or delete your information, please contact that Professional User first, because they control the record. If you contact us instead, we will pass your request to the relevant Professional User and assist them in responding.

Data Processing Agreement (Article 28 GDPR). Our Data Processing Agreement is available to every Professional User at no charge. It contains the Article 28(3) processor obligations, the current sub-processor list, confidentiality commitments, security commitments, breach notification terms, audit provisions, and deletion and return terms at the end of the engagement. To request a copy, email rw@insighthealthapps.com with the subject line "DPA request". We will send the current DPA for signature together with the related documentation described under "GDPR Documentation for Professional Users" below. Where required for transfers outside the EEA, the DPA incorporates the European Commission's Standard Contractual Clauses.

Health Information and Special Category Data

Symptoms reported by a client, session observations, session reports generated by the software, and dates of birth can amount to personal data concerning health, which is a special category of personal data under Article 9 of the EU General Data Protection Regulation and Article 9 of the UK GDPR.

When a Professional User records health-related information about a client in the Services, we process that information as a processor, solely to provide the Services to that Professional User, and we apply the additional safeguards described in this policy to it.

The Professional User is responsible for identifying a lawful basis for their processing and, where required, a condition for processing special category data (most often the client's explicit consent), for giving their clients an appropriate privacy notice, and for entering only the information they need. We support this by providing in-app deletion of client profiles and their associated reports, by keeping client records isolated to the account that created them, and by assisting Professional Users with data subject requests.

The Services are wellness and informational tools. We do not diagnose, treat, or provide medical advice, and we do not make automated decisions about any individual that produce legal or similarly significant effects.

Information We Collect

Depending on how you interact with Insight Health Apps, we may collect:

• Account information: name, email address, mailing address, telephone number, date of birth, country, language, login credentials, and practitioner or business information
• Commercial information: payment information, purchase history, subscription status, installment plan records, affiliate records, and tax or VAT details
• Client records that a Professional User chooses to enter: client names, dates of birth, email addresses, reported symptoms, session notes, and session reports generated by the software
• Technical information: device type and model, operating system, app version, IP address, approximate location derived from IP address, crash and diagnostic data, and application usage information
• Website usage information: pages viewed, referring links, search terms used on our site, and cookie identifiers
• Communications: support tickets, emails, chat transcripts, and call records where telephone support or voice features are used
• Program information: training progress, certification records, and affiliate, ambassador, or distributor account data

How We Use Information

We use personal information only to:

• Process purchases, subscriptions, and installment plans
• Deliver products, licenses, and services, including cloud sync and backup of app data
• Provide customer support and respond to enquiries
• Create, maintain, and secure user accounts
• Provide software updates and service notices
• Improve our products, services, and documentation using aggregated and de-identified information
• Prevent fraud, abuse, and unauthorised access
• Administer training, affiliate, ambassador, practitioner, and distributor programs
• Send marketing communications where we have consent or another lawful basis, and honour opt-outs
• Meet legal, tax, accounting, and regulatory obligations, and enforce our agreements

Legal Bases for Processing (EEA, UK, and Switzerland)

Where the EU GDPR, UK GDPR, or Swiss data protection law applies, we rely on the following legal bases:

• Performance of a contract: to provide the Services you have purchased, manage your account, and support you as a customer
• Legitimate interests: to secure and improve the Services, prevent fraud and abuse, keep business records, and communicate with business contacts about relevant products, balanced against your rights and freedoms
• Legal obligation: to keep tax, accounting, and transaction records, and to respond to lawful requests
• Consent: for marketing emails and messages where consent is required, for non-essential cookies and advertising tags where consent is required, and for any optional feature that asks for it
• Explicit consent or another Article 9(2) condition, established by the Professional User as controller: for any health-related information a Professional User records about their clients

Where we rely on legitimate interests, we carry out a balancing assessment and you may object to that processing at any time. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Payment Information

Payment information is processed by secure third-party payment providers and is not stored by Insight Health Apps except where required for transaction records. Card numbers are entered directly with our payment processors and are not stored on our systems.

Mobile Applications

Our mobile applications may collect and process information necessary to:

• Create and authenticate user profiles
• Save practitioner information
• Save and organise client records
• Synchronise application data across the Professional User's devices
• Provide cloud backup and restore
• Deliver software functionality, including voice analysis and library features
• Diagnose crashes and improve the user experience

Client records stored within our systems are encrypted using industry-standard security measures, as described under "Data Security and Technical and Organisational Measures".

Cookies and Analytics

Our websites may use cookies and similar technologies to:

• Remember user preferences
• Authenticate users and keep shopping carts working
• Improve website functionality
• Analyze website traffic
• Detect fraud
• Measure the performance of our advertising, where permitted
• Improve performance

Strictly necessary cookies are used to operate the site. Where the law requires it, including for visitors in the EEA and the UK, we ask for your consent before placing non-essential analytics or advertising cookies, and you can refuse or withdraw that consent at any time.

Third-party analytics and advertising providers may place cookies to help us understand website traffic and advertising performance, subject to the same consent requirement where applicable.

Users may also disable cookies through their browser settings; however, doing so may affect website functionality.

Information Sharing and Sub-processors

We will never sell your personal information. We do not share personal information for cross-context behavioral advertising.

Information may be shared only:

• With trusted service providers and sub-processors who assist in delivering our services, under written contracts that include confidentiality, security, and data protection terms, and Standard Contractual Clauses where required
• To process payments and prevent payment fraud
• To fulfil product orders and deliver email or messaging
• With professional advisers such as accountants and auditors, where necessary
• To comply with legal obligations, or to respond to a valid legal request after assessing its scope
• To protect our legal rights or the safety of our users
• In connection with a merger, acquisition, financing, or sale of assets, in which case the recipient remains bound by this policy for data already collected, and we will notify you of any material change

Our current sub-processors. The following providers process personal information on our behalf. The locations shown are their primary processing locations; some also process within the European Union. A dated sub-processor list, including a description of the services and processing locations, is included in our DPA and available on request.

• Shopify Inc.: ecommerce platform, order processing, and website hosting (United States, Canada)
• Stripe, Inc.: card payments, subscription billing, and installment processing (United States, Ireland)
• Supabase, Inc.: database and file hosting for account data and application records (United States)
• Twilio Inc. (SendGrid): transactional and marketing email delivery (United States, European Union)
• Google LLC (Google Cloud, Firebase): application analytics, crash reporting, and cloud infrastructure (United States, European Union)
• Meta Platforms, Inc.: advertising measurement and audience tools for our website (United States)
• Zendesk, Inc.: customer support ticketing (United States)
• n8n GmbH (n8n Cloud): workflow automation and internal system integration (European Union, United States)
• OpenAI, L.L.C.: AI-assisted text generation for support and content features, under API terms that prohibit training on submitted data (United States)
• Vapi Inc.: voice and telephony features, including call handling and voice analysis (United States)
• Partial.ly, Inc.: installment payment plans (United States)
• GoAffPro: affiliate referral tracking and commission management (international)
• Intuit Inc. (QuickBooks Online): accounting and bookkeeping records (United States)

If we add a sub-processor that will process client records on behalf of Professional Users, we will give Professional Users advance notice and an opportunity to object, as set out in our DPA.

Who Can Access Information

Within Insight Health Apps, access to personal information is limited to authorised personnel who need it to do their job, such as support staff handling a ticket, engineers diagnosing a fault, and billing staff resolving a payment issue. Access is governed by role-based permissions, protected by multi-factor authentication for administrative systems, subject to confidentiality obligations, and logged so that access can be reviewed.

Client records are visible to the account that created them. Our support staff can access an account only where the account holder requests assistance or where access is necessary to investigate a security or technical incident, and access is limited to what the task requires.

Sub-processors may access personal information only as necessary to deliver their service and only under a written contract containing confidentiality and security obligations.

We may disclose information where required by law, after assessing the legal basis and scope of the request, and we will notify the affected account unless we are legally prohibited from doing so.

Data Security and Technical and Organisational Measures

We maintain technical and organisational measures designed to protect personal information, including health information. These include:

• Encryption in transit: TLS 1.2 or higher for all web, app, and API traffic, with HTTP Strict Transport Security enabled on our storefront and application endpoints
• Encryption at rest: AES-256 or equivalent encryption provided for databases, object storage, and backups by our infrastructure providers
• Access control: unique user accounts, multi-factor authentication for administrative access, least-privilege roles, and prompt removal of access when it is no longer needed
• Network and platform protection: managed firewalls and web application protection, restricted administrative interfaces, and locked-down production environments
• Monitoring and logging: logging of administrative and support access, with review of unusual activity
• Backups: encrypted backups with periodic restore testing
• Confidentiality: written confidentiality obligations for employees and contractors, plus privacy and security awareness training
• Vendor management: security and privacy review of sub-processors, contractual data protection terms including Standard Contractual Clauses, and periodic reassessment
• Incident response: a documented incident response and breach notification procedure, described under "Personal Data Breach Notification"
• Data minimisation and isolation: client records are kept separate per account, and we limit collection to what the Services need

While we take these precautions, no method of electronic transmission or storage can be guaranteed to be completely secure. Please protect your account credentials, use a strong unique password, and tell us promptly if you believe your account has been compromised.

Meta Platform Data Storage

Meta Platform Data may not be persistently stored on organizational or personal devices under any circumstances. Authorized personnel may access Meta Platform Data through approved browser-based or mobile client sessions where such access does not result in persistent local storage of the data on the device.

International Data Transfers

We are established in the United States and process personal information primarily in the United States, at data centres operated by the sub-processors listed above. Some of those sub-processors also process information within the European Union and the United Kingdom. Client records entered by a Professional User in the EEA or the UK are therefore transferred to, and stored in, the United States, and may be processed in other countries where our sub-processors operate.

Transfer mechanism. Where personal data protected by the EU GDPR, UK GDPR, or Swiss data protection law is transferred outside the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (Module Two for controller-to-processor transfers and Module Three for processor-to-processor transfers, as applicable, decision 2021/914), together with the UK International Data Transfer Addendum and the Swiss addendum where relevant. We apply supplementary measures alongside the clauses, including encryption in transit and at rest, access controls and authentication, data minimisation, contractual confidentiality, and a documented transfer risk assessment with each sub-processor.

If you are a Professional User and you need the executed clauses for your own records, email rw@insighthealthapps.com with the subject line "SCC request" and we will provide the applicable clauses and the identity of the contracting parties.

EU-U.S. Data Privacy Framework. Possibility Wave LLC is not certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, or the Swiss-U.S. Data Privacy Framework, and we do not rely on the Data Privacy Framework as our transfer mechanism. Our transfers are made under the Standard Contractual Clauses described above. If we certify in the future, we will update this policy with the legal name under which we are certified and the scope of that certification.

Data Retention and Deletion

Account and business records. Customer account, order, and billing information may be retained for up to ten (10) years following the most recent customer interaction where needed for tax, accounting, warranty, chargeback, dispute, or legal purposes, or where a longer period is required by law.

Client records in a Professional User's account. Client profiles, reported symptoms, session notes, and session reports are retained for as long as the Professional User keeps them in the account. We do not delete them on a fixed schedule, because they belong to the Professional User's practice records.

Deleting an individual client. A Professional User can permanently delete an individual client profile, together with the session reports associated with it, from within the application, without needing to contact us. If you would like help completing a deletion, email rw@insighthealthapps.com and we will action it within 30 days. When a client record is deleted, it is removed from our live systems promptly, removed from any synchronised copies on the Professional User's devices at the next successful sync, and removed from encrypted backups on the normal backup rotation, within 90 days. Residual copies may exist briefly in backups or system logs; they are isolated from active use, are not accessed except for a restore or a security investigation, and are deleted on that rotation.

Closing your account. Email rw@insighthealthapps.com to request account closure. We delete or de-identify the account and its client records within 30 days, and the data is purged from backups within 90 days, with these exceptions: records we must keep to comply with tax, accounting, or other legal obligations (up to ten years); transaction and refund records needed to handle chargebacks or disputes; records needed to establish or defend legal claims; and aggregated or anonymised statistics that cannot identify any individual. Some data does remain stored after account closure for those limited periods, and it is used only for those purposes.

Your Privacy Rights

Where applicable under law, including the EU GDPR, the UK GDPR, and the California Consumer Privacy Act as amended, you may request to:

• Access the personal information we hold about you, and receive a copy
• Correct inaccurate or incomplete information
• Delete your personal information
• Restrict processing
• Object to processing, including direct marketing, which you can stop at any time
• Receive your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
• Withdraw consent you have given, without affecting processing carried out before withdrawal
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects
• Not be discriminated against for exercising your rights
• Lodge a complaint with your local supervisory authority

Privacy requests may be submitted by emailing rw@insighthealthapps.com. We respond within one month of receiving a request, and we may extend that period by up to two further months where requests are complex or numerous, in which case we will tell you within the first month and explain why. We may ask for information to verify your identity. Requests are free of charge unless they are manifestly unfounded or excessive.

If your information was entered by a Professional User, that Professional User is the controller of it. We will forward your request to them promptly and assist them in responding, and we will tell you which Professional User to contact.

If you are in the EEA or the UK, you also have the right to complain to your national supervisory authority. For clients of Professional Users established in Italy, the supervisory authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it). We would appreciate the chance to address your concern first.

Personal Data Breach Notification

We maintain a documented incident response procedure that covers detection, containment, assessment, notification, and remediation.

When we act as a processor and become aware of a personal data breach affecting client records, we notify the affected Professional User without undue delay and in any event within 48 hours of becoming aware. The notification includes, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for further information. We provide updates as our investigation develops and cooperate with the Professional User's own notification obligations.

When we act as a controller and a breach is likely to result in a risk to the rights and freedoms of individuals, we notify the competent supervisory authority without undue delay and within 72 hours of becoming aware where required. Where a breach is likely to result in a high risk, we notify affected individuals without undue delay, describing the nature of the breach and the steps they can take.

Analytics, AI, and Product Development

We use aggregated, de-identified usage information, such as feature adoption counts and error rates, to improve the Services. Client records, reported symptoms, and session reports are not sold, are not licensed to third parties, are not used for advertising or audience building, and are not used to train artificial intelligence models. Where an AI-assisted feature processes content, it does so through providers whose API terms prohibit using submitted content to train their models.

Children's Privacy

The Services are intended for adults and for use by qualified professionals. They are not directed to children, and we do not knowingly collect personal information from children. If you believe a child's information has been entered into the Services, contact us and we will help remove it.

GDPR Documentation for Professional Users

To help Professional Users meet their own obligations, we provide the following on request, at no charge:

• This privacy policy, in a form you can reference from your own client notice
• Our Data Processing Agreement, incorporating the Article 28(3) processor obligations
• The current sub-processor list with services, processing locations, and safeguards
• A description of our technical and organisational security measures
• The applicable Standard Contractual Clauses and transfer risk assessment summary
• Our breach notification procedure and incident response summary
• A processing summary you can use when completing your own Article 30 records

Email rw@insighthealthapps.com to request any of these documents.

Information for your own client privacy notice. If you are a Professional User preparing a notice for your clients, you can use the following: the controller is you, the Professional User; the processor is Possibility Wave LLC, doing business as Insight Health Apps, 3325 Sagunto Street, Santa Ynez, California 93460, United States, privacy contact rw@insighthealthapps.com; the purposes are secure storage of client records, synchronisation across your devices, generation of session reports you request, and technical support you request; personal data is stored and processed primarily in the United States, with some processing in the European Union by our sub-processors; and the transfer safeguard is the European Commission's Standard Contractual Clauses together with supplementary technical and organisational measures. Retention is controlled by you, and you can delete a client profile and its reports at any time from within the application.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, our providers, or the law. The revised policy is published on this page with a new "last updated" date. Where a change materially affects how we process client records on behalf of Professional Users, we will notify account holders by email or in-app notice before it takes effect.

Software License

All Insight Health Apps software, mobile applications, reports, educational materials, databases, algorithms, graphics, documents, trademarks, and intellectual property remain the exclusive property of Insight Health Apps.

Purchasing a product grants a limited, revocable, non-exclusive, non-transferable license to use the software in accordance with the applicable subscription or license purchased.

No ownership rights are transferred.

User Accounts

Users are responsible for maintaining the confidentiality of their login credentials.

Insight Health Apps reserves the right, acting reasonably and in accordance with applicable law, to suspend or terminate any account for fraud, abuse, unauthorized access, misuse, security concerns, or violation of these Terms.

Affiliate, Ambassador, Practitioner & Distributor Programs

Participation in any affiliate, ambassador, practitioner, reseller, or distributor program is subject to these Terms and any separate Affiliate or Distributor Agreement, Compensation Plan, or Program Policies adopted by Insight Health Apps.

Participation in these programs is a revocable privilege and does not create any ownership interest in the Company, its customers, software, affiliates, distributors, practitioners, intellectual property, goodwill, or business relationships.

Ownership of Customer Relationships

All customer accounts, software licenses, subscriptions, practitioner accounts, affiliate accounts, distributor accounts, referral relationships, customer records, and business relationships remain the sole property of Insight Health Apps.

No participant acquires ownership rights over customers, software licenses, affiliates, distributors, practitioners, referrals, or organizational structures through participation in Company programs.

Organizational Changes

Insight Health Apps reserves the right, acting reasonably and in accordance with applicable law, to modify, reorganize, merge, assign, transfer, or reassign customer accounts, affiliate relationships, distributor relationships, practitioner relationships, referral relationships, organizational structures, and program administration whenever reasonably necessary for the operation, compliance, growth, or management of the business.

Participation in any Company program does not create a vested ownership interest in any customer, referral, affiliate, distributor, practitioner, or organizational structure.

Program Changes

Insight Health Apps may modify, suspend, discontinue, replace, or update:

• Products
• Software
• Mobile applications
• Subscription plans
• Pricing
• Commission structures
• Incentive programs
• Affiliate programs
• Distributor programs
• Educational programs
• Features
• Services

Where required by law, reasonable notice will be provided.

Intellectual Property

All trademarks, copyrights, patents, software, source code, algorithms, frequency libraries, reports, educational materials, graphics, logos, videos, databases, documentation, business systems, and proprietary content remain the exclusive property of Insight Health Apps.

No copying, resale, redistribution, reverse engineering, or unauthorized use is permitted without prior written permission.

Limitation of Liability

To the fullest extent permitted by applicable law, Insight Health Apps, its owners, officers, employees, contractors, affiliates, licensors, and suppliers shall not be liable for any indirect, incidental, consequential, special, exemplary, or punitive damages arising from the use of or inability to use any product or service.

Our total liability for any claim shall not exceed the amount paid by the customer for the applicable product or service giving rise to the claim, except where prohibited by law.

Indemnification

You agree to indemnify and hold harmless Insight Health Apps, its officers, directors, employees, contractors, licensors, and affiliates from any claims, liabilities, damages, losses, costs, or expenses arising from your misuse of the products or services, violation of these Terms, or infringement of the rights of any third party.

Governing Law

These Terms and Conditions shall be governed by and interpreted in accordance with the laws of the State of California, without regard to conflict of law principles.

Any disputes shall be brought in the appropriate state or federal courts located in California, except where applicable law requires otherwise.

Severability

If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

Changes to These Terms

Insight Health Apps reserves the right to amend or update these Terms and Conditions, Privacy Policy, product offerings, subscriptions, and related policies at any time.

Updated versions will be posted on the Company’s website and become effective upon publication unless otherwise stated.

Continued use of the Company’s products or services following publication of updated Terms constitutes acceptance of those changes.

Contact Information

For questions regarding these Terms and Conditions or our Privacy Policy, please contact Insight Health Apps using the contact information published on our official website.