1. Introduction and Who We Are
Welcome to Leira Health. We are committed to protecting your privacy and handling your personal and health information with the care and transparency it deserves.
This Privacy Policy explains how Leira Health, Inc. (“Leira Health,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects your information when you use our mobile application, website at leirahealth.com, and all related services (collectively, the “Platform”).
Leira Health is an AI-powered cardiovascular wellness application. We are not a medical provider, hospital, or healthcare facility. Use of the Leira Health Platform does not create a patient-provider relationship between you and Leira Health.
By accessing or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Platform.
2. Scope of This Policy
This Privacy Policy applies to:
• All users of the Leira Health mobile application on iOS and Android.
• All visitors to the website.
• All participants in Leira Health beta testing programs
• All individuals who complete Leira Health surveys, sign up for waitlists, or contact us directly
This policy applies to users located in the United States. If you are located outside the United States, please be aware that your information may be transferred to and processed in the United States.
3. Information We Collect
We collect information in three ways: information you provide directly, information collected automatically, and information from third-party integrations.
3.1 Information You Provide Directly
Account and Identity Information
• Full name, email address, and account password
• Date of birth (used to calculate age-based cardiovascular risk — date of birth is stored securely and not displayed publicly)
• Biological sex at birth and gender identity
• Ancestry and national origin (used for cardiovascular risk personalization — e.g. African, African American, Caribbean, Asian, European, Hispanic/Latino, South Asian, Middle Eastern, Mixed Heritage)
• Profile photograph (optional)
• Country and city of residence
Cardiovascular Health Data
• Blood pressure readings (systolic and diastolic, logged manually or via connected device)
• Heart rate readings
• Blood oxygen saturation (SpO2) readings where applicable
• Steps and physical activity data
• Body weight and height (used to calculate BMI)
• Cardiovascular conditions diagnosed — including but not limited to hypertension, hyperlipidemia (high cholesterol), atrial fibrillation, heart failure, coronary artery disease, and Type 2 diabetes
• Symptom logs — including type of symptom, severity rating (1–10), and timestamp
• Acute cardiac symptom history — including prior episodes of chest pain, palpitations, angina, syncope, or shortness of breath
• Surgical history — including type of procedure and approximate date
• Family history of cardiovascular disease
Medication and Supplement Information
• Prescription medication names, doses, and frequency
• Supplement names and doses
• Hormonal medications — including contraceptives and hormone replacement therapy
• Antiretroviral medications
• Blood thinners and anticoagulants
• Medication adherence data — whether you took your medication as scheduled
Lifestyle and Behavioral Data
• Dietary habits and food category selections
• Physical activity levels and exercise frequency
• Sleep duration
• Smoking status
• Alcohol consumption frequency
• Daily task completion and streak data
Survey and Feedback Data
• Pre-survey and post-survey responses collected during beta testing programs
• Feedback submitted via email, TestFlight, or WhatsApp
• Responses to in-app feedback prompts
• Prolific user IDs where applicable for research participants
Payment and Subscription Information
• Subscription tier selected — Essentials, Heart Plus, or one-off consultation
• Payment information is processed by Apple App Store or our third-party payment processor and is not stored directly by Leira Health
3.2 Information Collected Automatically
• Device type, operating system version, and app version
• IP address and approximate location (country and city level — not precise GPS)
• App usage data — features accessed, session duration, tap patterns, and interaction logs
• Crash reports and error logs
• App performance diagnostics
• Push notification interaction data — whether notifications were opened
3.3 Information From Third-Party Integrations
• Apple HealthKit — heart rate, step count, blood pressure (where device-connected), sleep data, and other metrics you choose to sync. HealthKit data is used only to provide the Platform’s health monitoring features and is never used for advertising or sold to third parties, in compliance with Apple’s HealthKit guidelines.
• Wearable devices — Apple Watch, Fitbit, Oura Ring, and other wearables connected via Apple Health or direct API integration.
4. How We Use Your Information
4.1 To Provide and Personalize the Platform
• Generate your personalized Heart Score based on AHA cardiovascular risk guidelines
• Deliver AI-powered cardiovascular health insights, pattern recognition, and risk alerts through the Leira AI assistant
• Personalize daily tasks, notifications, and recommendations based on your specific conditions, medications, and health profile
• Track your cardiovascular metrics over time and provide trend analysis
• Connect you with cardiovascular clinicians through the Speak to a Clinician feature
• Provide condition-specific educational content through the Knowledge tab
• Send context-specific reminders — medication reminders, daily check-in prompts, and health alerts
4.2 For Safety and Clinical Oversight
• Detect patterns in your health data that may indicate elevated cardiovascular risk
• Issue clinically appropriate alerts for abnormal readings — including hypertension alerts (SBP ≥ 130 mmHg or DBP ≥ 80 mmHg), hypotension alerts (SBP < 90 mmHg or DBP < 60 mmHg), and critical escalation alerts (SBP < 80 mmHg or MAP < 65 mmHg)
• Direct users to seek clinical care when potentially dangerous patterns are detected
• Apply the RECAP clinical governance framework (Relevance, Evidence-based, Clarity, Adaptability, Precision) to all AI-generated health content before it is surfaced to users
• Maintain human clinician oversight through the Speak to a Clinician pathway
4.3 For Research and Product Improvement
With your explicit, separate consent, we may use de-identified or aggregated health data to conduct cardiovascular health research and improve our AI models and product features. Your data will never be used for research in a form that personally identifies you without your additional, specific consent.
You will be clearly informed during onboarding if your data is being used for research purposes and given the option to opt out. You may opt out of research use at any time via your account settings without affecting your access to the Platform.
Note: Leira Health has an IRB-approved pilot study underway at Johns Hopkins University. Participants in this pilot are subject to separate informed consent documentation.
4.4 For Legal and Compliance Purposes
• Comply with applicable United States federal and state laws
• Respond to lawful requests from regulatory or law enforcement authorities
• Enforce our Terms and Conditions and protect the rights and safety of Leira Health, our users, and the public
• Detect and prevent fraud, abuse, or unauthorized access to the Platform
4.5 For Communications
• Send service-related communications — account confirmations, security alerts, and important product updates
• Send clinician-reviewed personalized cardiovascular health newsletters (with your consent)
• Respond to your support requests, feedback, and survey submissions
• Conduct beta testing check-ins and follow-up interviews (during testing phases)
5. Legal Basis for Processing
We process your personal and health information on the following legal bases:
• Consent — for sensitive health data, research use, marketing communications, and menstrual health data collection. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Contractual necessity — to provide the services you have signed up for under our Terms and Conditions
• Legitimate interests — to improve our Platform, ensure clinical safety, and prevent fraud, where these interests do not override your fundamental rights
• Legal obligation — to comply with applicable United States law and regulatory requirements.
6. How We Share Your Information
Leira Health does not sell your personal or health information to third parties. We do not share your data with advertisers. We do not use your health data for targeted advertising of any kind.
We may share your information in the following limited circumstances:
6.1 Service Providers
We work with carefully selected third-party service providers who assist us in operating the Platform. These include cloud infrastructure providers, analytics platforms, payment processors, and customer support tools. All service providers are contractually required to protect your data, may only use it to provide services on our behalf, and may not use it for their own purposes.
6.2 Healthcare Clinicians
When you use the Speak to a Clinician feature, relevant aspects of your health profile — including your logged metrics, symptom history, and conditions — may be shared with the clinician you are connected with, with your consent. Professional confidentiality obligations and applicable healthcare privacy laws bind clinicians.
6.3 Research Collaborators
With your explicit, separate consent, de-identified data may be shared with academic or clinical research partners, including Johns Hopkins University, for cardiovascular health research. You will be informed of the specific research purpose before any such sharing occurs and may opt out at any time.
6.4 Legal Requirements
We may disclose your information if required to do so by law, court order, subpoena, or in response to a lawful request by a government or regulatory authority. We will notify you of such requests where legally permitted to do so.
6.5 Business Transfers
In the event of a merger, acquisition, financing, reorganization, or sale of all or a portion of Leira Health’s assets, your information may be transferred as part of that transaction. You will be notified via email and a prominent in-app notice at least 30 days before your information becomes subject to a materially different privacy policy.
6.6 With Your Consent
We may share your information for any other purpose with your explicit prior consent.
7. Apple HealthKit — Specific Terms
Leira Health integrates with Apple HealthKit to import health and fitness data with your explicit permission. The following specific terms apply to HealthKit data:
• HealthKit data is used solely to provide and improve the Platform’s cardiovascular health monitoring features
• HealthKit data is never used for advertising, marketing profiling, or sold to third parties
• HealthKit data is never shared with data brokers
• HealthKit data is not used for any purpose unrelated to the health and fitness services provided by Leira Health
• You may revoke HealthKit permissions at any time by going to iPhone Settings > Privacy & Security > Health > Leira Health
These terms comply with Apple’s HealthKit and Health Records API guidelines.
8. The Leira AI Assistant — Disclosure and Governance
The Leira AI assistant is an artificial intelligence tool. It is not a human clinician, doctor, nurse, or any other type of healthcare professional. At the start of every AI chat session, the Platform clearly discloses that you are interacting with an AI.
What Leira AI does:
• Identifies patterns in your logged health data
• Provides personalized cardiovascular health insights based on your profile
• Flags potentially concerning readings and directs you to seek clinical care
• Answers general cardiovascular health questions using evidence-based guidelines
• Provides educational information about heart health, medications, and lifestyle
What Leira AI does not do:
• Diagnose medical conditions
• Prescribe or recommend changes to medications without clinical oversight
• Replace the advice, diagnosis, or treatment of a licensed healthcare provider
• Provide emergency medical care — in any emergency, call 911 immediately
All AI-generated health content is subject to the RECAP clinical governance framework before being displayed to users. The five RECAP criteria — Relevance, Evidence-based, Clarity, Adaptability, and Precision — ensure that AI responses are clinically appropriate, accurate, and safe. If a response does not meet RECAP standards, a fallback message is displayed directing you to seek clinical advice.
A medical disclaimer is displayed at the start of every AI chat session and is accessible via a persistent hyperlink throughout the chat interface. A human clinician escalation pathway is available at all times through the Speak to a Clinician tab in the main navigation.
9. Access Tiers and Data
Leira Health offers three access tiers. The data practices described in this Privacy Policy apply equally across all tiers:
• Essentials — access to core cardiovascular monitoring features. No clinician messaging.
• Heart Plus — all Essentials features plus capped clinician messaging (approximately 100 minutes per month).
• Audio/Video Consultation Add-On — 15-minute audio or video consultation with a cardiovascular clinician at a one-off fee of approximately $45. Payment is required before booking is confirmed.
Upgrading or downgrading your tier does not affect the privacy protections applied to your data.
10. Data Storage and Security
Leira Health is committed to protecting your information using industry-standard security measures. Our security practices include:
• Encryption of all data in transit using TLS (Transport Layer Security) 1.2 or higher
• Encryption of sensitive health data at rest using AES-256 encryption
• Access controls — only authorized personnel with a legitimate need can access your data
• Role-based access control — different team members have access only to the data relevant to their role
• Regular security assessments and vulnerability testing
• Incident response procedures — in the event of a data breach, we will notify affected users and relevant authorities within the timeframes required by applicable law
Re-authentication security: the Platform requires Face ID, Touch ID, or a 4-digit PIN for re-authentication after periods of inactivity, to protect your health data on your device.
While we implement strong security measures, no digital system is completely secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect any unauthorized access to your account.
11. Data Retention
We retain your personal and health data for as long as your account is active or as necessary to provide our services. Specific retention periods:
• Account and identity data — retained for the duration of your account plus 3 years following account deletion, unless a longer period is required by law
• Health and cardiovascular data — retained for the duration of your account plus 3 years following account deletion
• Clinician consultation records — retained for a minimum of 7 years in compliance with healthcare record-keeping standards
• Research data (de-identified) — may be retained beyond account deletion in accordance with applicable research ethics standards and IRB protocols
• Beta testing survey data — retained for 2 years following the close of the testing program
• Payment records — retained for 7 years for tax and accounting compliance
If you delete your account, we will delete or anonymize your personal data within 30 days, subject to the retention requirements above and any applicable legal obligations.
12. Your Rights
As a user of the Leira Health Platform, you have the following rights regarding your personal information:
• Right to Access — you may request a copy of the personal information we hold about you at any time
• Right to Correction — you may request that we correct inaccurate or incomplete information about you
• Right to Deletion — you may request that we delete your personal data, subject to applicable legal retention obligations. You can initiate account deletion from your Profile settings.
• Right to Withdraw Consent — you may withdraw consent for research use, marketing communications, or menstrual health data collection at any time, without affecting your access to the Platform or the lawfulness of prior processing
• Right to Data Portability — you may request your personal and health data in a structured, machine-readable format
• Right to Restrict Processing — you may request that we restrict the processing of your data in certain circumstances
• Right to Object — you may object to processing of your data for legitimate interests or direct marketing purposes
• Right to Opt Out of Research Use — you may opt out of having your de-identified data used for research at any time via Profile > Settings > Data Preferences
To exercise any of these rights, contact us at:leirahealth.inquirires@gmail.com
We will acknowledge your request within 5 business days and respond in full within 30 days. If we need additional time, we will notify you.
13. California Privacy Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
• The right to know what personal information is collected, used, shared, or sold
• The right to delete personal information held by businesses
• The right to opt out of the sale or sharing of personal information — Leira Health does not sell personal information
• The right to non-discrimination for exercising your privacy rights
• The right to correct inaccurate personal information
• The right to limit use and disclosure of sensitive personal information
To submit a California privacy rights request, contact us at:leirahealth.inquirires@gmail.com
14. Children’s Privacy
The Leira Health Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information without parental consent, we will delete that information promptly.
If you are a parent or guardian and believe your child has used the Platform without your consent, please contact us immediately
15. Third-Party Links and Services
The Platform may contain links to third-party websites, services, or resources — including content in the Knowledge tab sourced from the American Heart Association, World Health Organization, and Johns Hopkins Medicine. We are not responsible for the privacy practices of these third parties and encourage you to review their privacy policies before providing any personal information.
16. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
• Notify you via email at least 14 days before the change takes effect
• Display a prominent in-app notice about the update
• Update the ‘Last Updated’ date at the top of this policy
Your continued use of the Platform after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must stop using the Platform and may delete your account.
17. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal and health information, please contact us:
Leira Health, Inc.
Website: leirahealth.com
Email: leirahealthinquiries@gmail.com
We aim to respond to all privacy-related inquiries within 5 business days.