HeadsUp Privacy Notice 

Last Update: October 7th, 2026

We’ve written this notice in plain English so you can understand what data HeadsUp Health collects, why we collect it, who sees it, and what you can do about it.

1. AT A GLANCE

This notice covers our websites (headsuphealth.com and headsup.health), our patient mobile and web app (the “Patient App“), our provider portal (the “Provider Portal“), and all related services (together, the “Services“).

TL;DR. We collect what we need to run the Services and improve them. We never sell your personal data. We do not use your health data, prompts, or content to train AI models. Health data of US patients is governed by your clinic’s Notice of Privacy Practices and our Business Associate Agreement with your clinic. You can manage cookies through our Cookie Preference Center and exercise your rights by emailing privacy@headsup.health.

2. WHO WE ARE AND WHO THIS NOTICE APPLIES TO

HeadsUp Health LLC (“HeadsUp“, “we“, “us“) is the controller of the personal data described in this notice, except as set out below.

3. WHAT WE COLLECT AND WHY

We collect data in three ways: what you give us directly, what we collect automatically, and what comes from connected services you enable.

Information you give us directly

• Account registration: name, email, password, organization, role, and (for Provider Users) professional license information.
• Health data (Patient App): vitals, lab results, medication, symptoms, weight, sleep, biometric, nutrition, exercise, reproductive health, and similar physical and/or mental health and wellness data you enter or sync from connected devices. This is special category / sensitive personal data and is treated accordingly.
• Support requests: anything you include in a ticket, chat, or email (descriptions, screenshots, contact details).
• Forms: demo requests, contact forms, feedback surveys.

Information collected automatically

• Device and connection data: IP address, browser type, operating system, device identifiers, crash and debug logs.
• Usage data: pages visited, time on site, feature interactions, referring URLs.
• Cookies and tracking technologies: see Section 4.

Information from connected services

• Health devices and apps: if you connect a device or third-party app (e.g., Google Health Connect, a glucose monitor, fitness tracker, or lab platform), it may share health and demographic data with the Patient App to power the integration. The third party’s privacy policy also applies.
• Other users: a colleague or healthcare provider may provide your information to invite you or reference you in a support ticket.

What we don’t collect

• Political opinions, religious beliefs, sexual orientation, or other special-category data beyond the health data you intentionally provide. If such data is inadvertently submitted (e.g., in a support message), we will delete it promptly.
• Children’s data: Our Services are not intended for individuals under 18. See Section 9.

AI model training

We do not use your prompts, health data, content, or outputs to train HeadsUp’s AI models or any third-party AI models. Any AI features within the Services operate on your data only to deliver the requested feature.

Lawful bases (for users in the UK, EU, and other GDPR-aligned jurisdictions)

• Contract: to provide the Services you’ve signed up for.
• Explicit consent: for processing of health data (UK GDPR / GDPR Article 9).
• Legitimate interests: security monitoring, fraud prevention, product analytics, and direct marketing to existing customers — balanced against your rights.
• Consent: non-essential cookies, marketing emails.
• Legal obligation: retaining certain records, responding to lawful requests.

You can ask us at any time which legal basis we rely on for a specific processing activity by emailing privacy@headsup.health.

4. HEALTH DATA — SPECIAL PROVISIONS

Because we handle health and wellness data, additional rules apply.

• US: Your health data within the Patient App is Protected Health Information (PHI) under HIPAA. HeadsUp acts as a Business Associate of your healthcare clinic, which is the Covered Entity. Your clinic’s Notice of Privacy Practices governs how your PHI is collected, used, and disclosed; our Business Associate Agreement with your clinic supplements those protections. Contact your clinic for their Notice of Privacy Practices.
• UK / EU: Health data is special category personal data under UK GDPR and GDPR Article 9. We process it on the basis of your explicit consent, your provider’s lawful basis under Article 9(2)(h) (provision of healthcare), or other applicable lawful basis. You can withdraw consent at any time.
• Australia: Health information is sensitive information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We handle it in accordance with APP 3 (collection) and APP 6 (use and disclosure).
• Canada: Health data is sensitive personal information under PIPEDA and provincial privacy laws (including Quebec Law 25). We obtain consent and apply enhanced safeguards.
• Singapore: Health information is treated under the Personal Data Protection Act 2012 with applicable safeguards.
• UAE: Health data is subject to Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields and the UAE Personal Data Protection Law. Your healthcare provider is responsible for ensuring lawful processing and any cross-border transfers comply with these laws. By using the Patient App in connection with UAE-based care, you consent to processing and transfer as authorized by your healthcare provider.
• Brazil: Health data is sensitive personal data under the Lei Geral de Proteção de Dados (LGPD). We process it on the basis of your express consent, which you can withdraw at any time.

5. COOKIES AND TRACKING TECHNOLOGIES

Cookies are small files stored on your device. We use them to keep you logged in, understand how people use our website, and – only with your consent – serve relevant ads.

Your control. Strictly necessary cookies load automatically. Every other cookie – including analytics and advertising pixels – loads only after you consent via our Cookie Preference Center. You can change your choices at any time.

Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a valid opt-out of the sale or sharing of personal information under CCPA/CPRA.

6. WHO WE SHARE YOUR DATA WITH

We do not sell your personal data. We share it only in these circumstances:

A full list of our key subprocessors is available at https://headsuphealth.com/subprocessors/ (or by email request).

7. HOW LONG WE KEEP YOUR DATA

We retain personal data only as long as needed to provide the Services, meet legal obligations, resolve disputes, and enforce our agreements. Specific retention factors include:

• the nature and sensitivity of the data;
• the purposes for which we process it;
• legal and regulatory retention requirements (including HIPAA’s 6-year minimum for certain records, and longer periods under some state and international laws);
• whether the data has been de-identified.

When data is no longer needed, we delete or de-identify it. De-identified data may be retained and used indefinitely for service improvement, research, and analytics, in compliance with applicable law.

8. YOUR RIGHTS

Depending on where you live, you have some or all of the following rights. We respond within 15 days (Brazil), 30 days (EU, UK, Canada, Singapore, Australia, UAE), or 45 days (USA). Contact us at privacy@headsup.health.

For US patients: Requests relating to PHI should generally be directed to your clinic in the first instance, since they are the Covered Entity. We will support your clinic in responding to your request.

Complaints. If you’re not satisfied, you may complain to your local data protection authority:

• EU: your national DPA (edpb.europa.eu)
• UK: ICO (ico.org.uk)
• California: CPPA (cppa.ca.gov)
• Canada: OPC (priv.gc.ca); Commission d’accès à l’information du Québec (cai.gouv.qc.ca)
• Australia: OAIC (oaic.gov.au)
• Singapore: PDPC (pdpc.gov.sg)
• UAE: UAE Data Office (or applicable free zone authority)
• Brazil: ANPD (gov.br/anpd)

We’d prefer you contact us first at privacy@headsup.health.

9. INTERNATIONAL DATA TRANSFERS & DATA PRIVACY FRAMEWORK

HeadsUp is based in the United States. If you use the Services from outside the US, your data will be transferred to, stored in, and processed in the US and other countries where we or our service providers operate.

HeadsUp complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/. In some instances, HeadsUp may be liable if a third party to which it transfers personal data acts as its agent and processes such personal data in a manner inconsistent with the DPF Principles.

We commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of any human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of an employment relationship. We are also subject to the Federal Trade Commission’s investigatory and enforcement powers with respect to claims relating to our compliance with DPF.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, HeadsUp commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF should first contact us at privacy@headsup.health.

We will refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to the International Centre for Dispute Resolution-American Arbitration Association (“ICDR-AAA”), an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.icdr.org/dpf for more information or to file a complaint. Under certain conditions, you may invoke binding arbitration with us via the ICDR-AAA. The services of ICDR-AAA are provided at no cost to you.

In addition to the above, where required by applicable law, we also use other appropriate safeguards for international transfers, including:

• Standard Contractual Clauses: EU SCCs and the UK International Data Transfer Addendum for transfers from the UK and EU.
• Other transfer mechanisms: for transfers from other jurisdictions, we rely on legally recognized transfer mechanisms or contractual protections as required by applicable law.
• Consent: where you have given explicit consent to such transfers (e.g., as part of your account setup).

To request more information about our transfer safeguards, email privacy@headsup.health.

10. CHILDREN

The Services are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child’s data has been collected, email privacy@headsup.health and we will delete it promptly.

11. SECURITY

We use reasonable physical, technical, and administrative safeguards to protect your data, including authentication, encryption, access controls, and regular backups. No system is 100% secure, and you should take steps to protect your own credentials and devices. If we experience a data breach that affects your personal data, we will notify you as required by law.

12. STATE AND COUNTRY-SPECIFIC DISCLOSURES

California (CCPA / CPRA)

California residents have specific rights, including the right to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. We do not sell personal information. Health information is treated as sensitive personal information. To exercise your rights, email privacy@headsup.health or use our Cookie Preference Center. We honor valid GPC signals.

Other US states (Virginia, Colorado, Connecticut, Texas, etc.)

Residents of certain US states have rights similar to those in the table at Section 7. Contact us to exercise them.

EU and UK

You have the rights set out in Section 7 plus the right to lodge a complaint with your local Data Protection Authority. Our EU/UK Representative under GDPR Article 27 is identified in Section 1.

Canada

We comply with PIPEDA and applicable provincial laws (Quebec Law 25, Alberta PIPA, BC PIPA). Quebec residents have additional rights including the right to be informed about automated decision-making.

Australia

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may complain to the OAIC if you believe we have mishandled your data.

UAE

We comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable, DIFC and ADGM data protection laws, alongside Federal Law No. 2 of 2019 on health data.

Brazil

We comply with the Lei Geral de Proteção de Dados (LGPD / Law No. 13.709/2018). You have the rights described in Section 7. You may complain to the ANPD (gov.br/anpd).

13. CONTACT US AND POLICY UPDATES

Questions? Email privacy@headsup.health.

Updates. We may update this notice from time to time. The “Last updated” date at the top reflects the most recent changes. For material changes, we will notify you by email or in-app.

What this notice doesn’t cover. Third-party websites or services linked from our Services operate under their own privacy policies. This notice also doesn’t cover the privacy practices of your healthcare provider or your healthcare organization, which are governed by their own notices and (in the US) HIPAA.

HeadsUp Health LLC · PO Box 190778, Miami Beach, FL 33119 · privacy@headsup.health · +1 (602) 688-4063