Effective Date: May 12, 2026
This Privacy Policy ("Policy") describes how Simpafy, Inc. collects, uses, stores, and discloses information about individuals who use Simpafy's products and features. This Policy is effective as of the date set forth above. Simpafy may update this Policy from time to time in accordance with Section 12. The then-current version of this Policy is available at https://simpafy.com/privacy-policy.
For questions about this Policy, or to exercise any right described in it, contact Simpafy at support@simpafy.com.
In this Policy, the following terms have the meanings given:
2.1 Account information. When you create an Account, Simpafy collects an email address or a phone number and a password. Simpafy uses this information to identify and authenticate your Account and to contact you about the Services.
2.2 Personal Information you provide. Through your use of the Services, you may provide Personal Information about yourself, including without limitation demographic information, health information, nutrition information, symptoms, medications, goals, and the content of your communications with Simpafy. Personal Information may be provided through any interface of the Services, including Account profile fields, SMS messages, web chat, voice messages, and uploads.
2.3 Personal Information about additional Subjects. You may provide Personal Information about Subjects other than yourself. The provisions of Section 2.2 apply equally to Personal Information about any additional Subject. By providing Personal Information about an additional Subject, you represent that you have the legal right and responsibility to do so.
2.4 Laboratory information. When Simpafy orders bloodwork or other laboratory testing on behalf of a Subject, Simpafy receives order metadata and laboratory results from the laboratory performing the test. This information is Personal Information about the Subject.
2.5 Payment information. Simpafy uses Stripe, Inc. ("Stripe") to process subscription payments. When you subscribe, you provide your payment card information directly to Stripe. Simpafy does not receive or store your full payment card number. Simpafy receives and stores the last four digits of your payment card, your billing address, your subscription status, and related subscription metadata.
2.6 Technical information. When you access the Services, Simpafy automatically collects technical information, including your IP address, browser type, operating system, device type, and pages accessed.
2.7 Cookies and similar technologies. When you access the Simpafy website or application, Simpafy uses cookies, local storage, and similar technologies to operate the Services, authenticate your Account, and maintain your session. Simpafy does not use cookies, local storage, or similar technologies for interest-based advertising, cross-site tracking, or disclosure to third-party advertising networks. You may control cookies and similar technologies through your browser settings; disabling cookies may affect your ability to use certain features of the Services.
3.1 Guardians and Helpers. Each Subject in Simpafy has one or more Guardians and zero or more Helpers. By default, each Account holder is the sole Guardian of their own Subject.
3.2 Rights of Guardians. A Guardian of a Subject may (a) add, modify, and view that Subject's Personal Information, (b) request deletion of that Subject's Personal Information, subject to the rules in Section 4, (c) add or remove Helpers on that Subject, and (d) request the addition of additional Guardians on that Subject, subject to Section 3.4.
3.3 Rights and limitations of Helpers. A Helper of a Subject may add, modify, and view that Subject's Personal Information. A Helper may not add or remove Guardians or Helpers and may not otherwise manage access to the Subject's Personal Information. Any single Guardian of a Subject may add or remove a Helper on that Subject without the consent of other Guardians.
3.4 Adding Guardians. A new Guardian may be added to a Subject only with the unanimous consent of all existing Guardians of that Subject. Where a Subject has a single existing Guardian, that Guardian may add the first additional Guardian without further consent.
3.5 Removing Guardians. A Guardian may not be removed from a Subject by any other Guardian. A Guardian ceases to hold that role only by (a) cancellation of the Guardian's Account under Section 4.2, (b) deletion of the Guardian's Account under Section 4.4, or (c) order of a court or other legally competent authority.
4.1 Retention during Account existence. Simpafy retains Personal Information about you and about any additional Subjects whose Personal Information you have provided for the duration of your Account, including after cancellation of any paid subscription, until you request deletion under Section 4.4 or Section 4.5.
4.2 Cancellation of subscription. Cancellation of a Simpafy subscription terminates billing and does not delete any Personal Information stored by Simpafy. You remain the Guardian of any Subject for which you are the sole Guardian at the time of cancellation. For any Subject that has two or more Guardians at the time of cancellation, cancellation of your Account automatically removes you as a Guardian of that Subject. The remaining Guardians retain authorization to manage that Subject's Personal Information.
4.3 Reactivation. If your Account resumes active use after cancellation, any Guardianship removed under Section 4.2 may be restored only through the procedure for adding Guardians set forth in Section 3.4.
4.4 Deletion of your Account. You may request deletion of your Account at any time, including after cancellation. Upon deletion of your Account, Simpafy removes the Personal Information stored about you. For any Subject of which you were a Guardian at the time of deletion, deletion of your Account automatically removes you as a Guardian of that Subject. Where you were one of two or more Guardians of a Subject, that Subject's Personal Information is retained and remains under the authorization of the other Guardians. Where you were the sole Guardian of a Subject, that Subject's Personal Information is also deleted. For any Subject of which you were a Helper but not a Guardian, your access is removed, and the Personal Information you contributed remains in the care of the Subject's Guardians.
4.5 Deletion of a Subject's Personal Information. Personal Information about a Subject may be deleted only at the request of that Subject's Guardians. Where a Subject has two or more Guardians, deletion requires the unanimous consent of all Guardians of that Subject. The sole exception is where deletion is required by law, including by order of a court or other legally competent authority.
4.6 Removal from backup systems. Upon deletion under Section 4.4 or Section 4.5, Simpafy removes the affected Personal Information from its active systems immediately and from its backup systems within thirty (30) days.
5.1 Age. Simpafy Accounts are available only to individuals eighteen (18) years of age or older. Only an Account holder may interact directly with the Services.
5.2 Geographic availability. The Services are currently available only to individuals located in the United States.
6.1 Scope. Simpafy uses Personal Information only for the purposes set forth in this Section 6.
6.2 Providing the Services. Simpafy uses Personal Information to operate, maintain, and provide the Services to you, including to respond to your communications, send you messages and notifications, process and fulfill laboratory orders, and retrieve and display laboratory results.
6.3 Account management and security. Simpafy uses Personal Information to create, authenticate, and manage your Account; to detect, prevent, and respond to fraud, abuse, and security incidents; and to enforce this Policy and the Simpafy Terms of Service.
6.4 Communications about the Services. Simpafy uses your email address and phone number to send you transactional and service-related communications, including verification messages, security notices, subscription and billing notices, updates to this Policy, and responses to your inquiries.
6.5 Improvement of the Services through de-identified information. Simpafy may process Personal Information to produce de-identified or aggregated information, and may use such de-identified or aggregated information to analyze usage of the Services, to improve the Services, and to train and refine machine learning models used to deliver the Services. De-identified and aggregated information does not identify any individual Subject and is not Personal Information under this Policy.
6.6 Artificial intelligence and machine learning. The Services make use of artificial intelligence and machine learning technology to operate and deliver features to you. Simpafy does not disclose Personal Information to any third party for the purpose of training artificial intelligence or machine learning models. Where Simpafy uses third-party providers to host or execute artificial intelligence or machine learning workloads, Simpafy requires that such providers not use Personal Information to train models for the provider or for any other customer.
6.7 Legal compliance and protection of rights. Simpafy uses Personal Information as necessary to comply with applicable laws and legal process, to respond to lawful requests from public authorities, to enforce this Policy and the Simpafy Terms of Service, and to protect the rights, property, or safety of Simpafy, its users, or others.
6.8 Uses to which Simpafy does not put Personal Information. Simpafy does not:
(a) sell Personal Information; (b) rent, lease, or trade Personal Information to any third party; (c) use Personal Information to serve interest-based or behavioral advertising; (d) disclose Personal Information to advertisers, data brokers, or marketing partners; or (e) use Personal Information for any purpose not described in this Policy.
7.1 Scope. Simpafy discloses Personal Information to third parties only as described in this Section 7.
7.2 Service providers. Simpafy uses third parties to support the delivery of the Services. These service providers process Personal Information on Simpafy's behalf under contractual agreements that require them to protect Personal Information consistent with this Policy and to use it only for the purposes for which Simpafy has engaged them. The categories of service providers Simpafy uses include:
(a) cloud infrastructure, hosting, and computation providers, which store and process Personal Information as necessary to operate the Services, including computation performed for artificial intelligence and machine learning features of the Services; (b) electronic mail delivery providers, which transmit email messages on Simpafy's behalf; (c) Short Message Service (SMS) providers, which transmit text messages on Simpafy's behalf; and (d) professional service providers, including auditors, accountants, legal counsel, and insurance providers, which receive Personal Information only as necessary to perform professional services for Simpafy.
7.3 Payment processor. Simpafy discloses payment-related information to Stripe, Inc. as described in Section 2.5.
7.4 Laboratory testing providers. When Simpafy orders laboratory testing on behalf of a Subject, Simpafy discloses to the laboratory performing the test, and to any intermediary service provider facilitating the order, the information necessary to create and fulfill the order, including the Subject's name, contact information, demographic information, and the identity of the laboratory panel ordered. The Subject attends the laboratory in person to provide a biological sample. The laboratory processes the Subject's biological sample and returns laboratory results to Simpafy. The laboratory's handling of the Subject and of the Subject's biological sample is governed by the laboratory's own privacy practices and applicable laws.
7.5 Legal disclosures. Simpafy may disclose Personal Information to courts, law enforcement, government authorities, or other third parties where Simpafy reasonably believes such disclosure is required by law or legal process; necessary to enforce this Policy or the Simpafy Terms of Service; or necessary to protect the rights, property, or safety of Simpafy, its users, or others.
7.6 Business transfers. In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or other transaction involving the transfer of all or substantially all of Simpafy's business or assets, Personal Information may be transferred as part of the transaction. In such event, Simpafy will provide notice to Account holders of the transfer, and of any successor entity's privacy practices that differ from this Policy.
7.7 With your consent. Simpafy may disclose Personal Information to a third party with your explicit consent for the specific purpose for which you have consented.
7.8 No other disclosures. Simpafy does not disclose Personal Information to any third party except as described in this Section 7.
8.1 Safeguards. Simpafy implements technical, administrative, and physical safeguards designed to protect Personal Information from unauthorized access, use, alteration, disclosure, and loss. These safeguards include encryption of Personal Information in transit over public networks, encryption of Personal Information at rest in Simpafy's storage systems, access controls restricting internal access to Personal Information to authorized personnel, authentication of Account holders, and monitoring for unauthorized activity.
8.2 Limitations of security. No method of transmitting or storing information is completely secure. Simpafy does not warrant that its safeguards will prevent all unauthorized access, use, alteration, disclosure, or loss of Personal Information.
8.3 Transmission through telecommunications networks. Simpafy's safeguards apply to Personal Information within Simpafy's systems. Where you communicate with Simpafy through Short Message Service (SMS), voice, or other telecommunications services, the content of such communications is transmitted through networks operated by third-party carriers. Simpafy does not control and is not responsible for the security or handling of Personal Information during transmission through such third-party carrier networks.
8.4 Your Account security. You are responsible for maintaining the confidentiality of your Account credentials, including any password or authentication token associated with your Account. You agree to notify Simpafy promptly at support@simpafy.com of any actual or suspected unauthorized access to or use of your Account.
8.5 Security incidents. In the event of a security incident affecting Personal Information, Simpafy will notify affected Account holders and relevant regulatory authorities as required by applicable law.
9.1 Rights under this Policy and applicable law. You have certain rights regarding Personal Information that Simpafy holds about you. The specific rights available depend on applicable law. Rights under this Section 9 may be exercised by an Account holder with respect to (a) that Account holder's own Personal Information, and (b) Personal Information about any Subject for whom the Account holder is a Guardian. The rights described in this Section 9 are available to the extent required by applicable law.
9.2 Access to Personal Information. Subject to identity verification and applicable law, you may request access to the Personal Information Simpafy holds about you or about a Subject for whom you are a Guardian.
9.3 Correction of Personal Information. Subject to identity verification and applicable law, you may request that Simpafy correct inaccurate or incomplete Personal Information that Simpafy holds about you or about a Subject for whom you are a Guardian.
9.4 Deletion of Personal Information. You may request deletion of your Account or of Personal Information Simpafy holds about you, in accordance with the rules set forth in Section 4.
9.5 SMS communications. Where you have consented to receive SMS messages from Simpafy, you may opt out of further SMS communications at any time by replying "STOP" to any SMS message from Simpafy. Replying "HELP" to any SMS message from Simpafy returns information about the Services and contact information. Opting out of SMS does not delete your Account or any Personal Information Simpafy holds about you.
9.6 Email communications. Transactional and service-related email messages from Simpafy are necessary for the operation of your Account. Where Simpafy sends you promotional or marketing email messages, each such message will include a mechanism to unsubscribe from further promotional communications. Opting out of promotional email does not delete your Account and does not affect transactional communications.
9.7 Sale and targeted advertising. As stated in Section 6.8, Simpafy does not sell Personal Information and does not use Personal Information for targeted or behavioral advertising. No opt-out from sale or targeted advertising is available because no such processing occurs.
9.8 How to exercise your rights. To exercise any right described in this Section 9, contact Simpafy at support@simpafy.com. Simpafy may require you to verify your identity before processing your request. Simpafy will respond to verified requests within the timeframe required by applicable law.
9.9 Appeals. If Simpafy denies a request made under this Section 9, you may appeal the denial by contacting Simpafy at support@simpafy.com with a description of the basis for the appeal. Simpafy will respond to the appeal within the timeframe required by applicable law.
9.10 No discrimination. Simpafy will not discriminate against you for exercising any right described in this Section 9, including by denying the Services, charging different prices, or providing a different level or quality of the Services, except where such differential treatment is permitted by law.
9.11 Do Not Track signals. Some web browsers include a "Do Not Track" feature that allows you to signal your preference not to be tracked across websites. There is no industry consensus on how to interpret Do Not Track signals. Simpafy does not respond to Do Not Track signals. Simpafy does not engage in the kind of cross-site tracking that Do Not Track signals are intended to prevent; see Sections 6.8 and 2.7.
10.1 General. In addition to the rights described in Section 9, you may have additional rights under the privacy laws of the state in which you reside. This Section 10 describes state-specific rights and disclosures, and certain federal requirements applicable to children.
If you are a resident of California, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the "CCPA"), provides you with specific rights regarding your Personal Information.
(a) Categories of Personal Information collected. In the twelve (12) months preceding the effective date of this Policy, Simpafy has collected the following categories of Personal Information as defined under the CCPA:
(i) identifiers, including name, email address, phone number, IP address, and Account identifiers; (ii) customer records information (as referenced in Cal. Civ. Code § 1798.80(e)), including name, address, telephone number, and payment card information; (iii) protected classification characteristics, including age and biological sex where voluntarily provided; (iv) commercial information, including subscription and billing records; (v) internet or other electronic network activity information, including interactions with the Services; (vi) geolocation data derived from IP address; (vii) audio, electronic, or similar information, where voluntarily provided; (viii) inferences drawn from the above to create a profile reflecting preferences and health-related attributes; and (ix) Sensitive Personal Information, as described in Section 10.2(b).
(b) Sensitive Personal Information. Simpafy collects Sensitive Personal Information as that term is defined by the CCPA, including:
(i) Account log-in credentials, including passwords and authentication tokens; (ii) the contents of your communications with Simpafy, including SMS and in-app messages; and (iii) Personal Information concerning your health and the health of any additional Subjects you manage.
Simpafy uses Sensitive Personal Information only for the purposes described in Section 6 and does not use Sensitive Personal Information for purposes other than those reasonably necessary and proportionate to provide the Services.
(c) Sources of Personal Information. Simpafy collects Personal Information from (i) you directly, through your use of the Services; (ii) laboratories and intermediary service providers, as described in Section 2.4; (iii) automatically, as described in Section 2.6; and (iv) from additional Subjects on your behalf, as described in Section 2.3.
(d) Business purposes. Simpafy uses Personal Information for the business purposes described in Section 6.
(e) Categories of third parties. Simpafy discloses Personal Information to the categories of third parties described in Section 7.
(f) Rights under the CCPA. As a California resident, you have the right to (i) know what Personal Information Simpafy has collected about you; (ii) request deletion of your Personal Information; (iii) request correction of inaccurate Personal Information; (iv) opt out of the sale or sharing of Personal Information, not applicable because Simpafy does not sell or share Personal Information (see Section 9.7); (v) limit the use of Sensitive Personal Information, not applicable because Simpafy uses Sensitive Personal Information only for purposes permitted under the CCPA without an obligation to offer such limitation; and (vi) not be subject to discrimination for exercising these rights.
(g) How to exercise CCPA rights. To exercise any right under the CCPA, follow the procedure described in Section 9.8. Simpafy will respond within forty-five (45) days of receipt of a verified request, subject to a one-time extension of up to forty-five (45) additional days where reasonably necessary, with notice of such extension.
(h) Authorized agent. You may designate an authorized agent to submit requests under the CCPA on your behalf. Simpafy may require proof of your written authorization of the agent and may verify the agent's identity before processing the request.
If you are a resident of Washington, the Washington My Health My Data Act (the "MHMDA") provides you with specific rights regarding Consumer Health Data. For purposes of this Section 10.3, "Consumer Health Data" has the meaning given to that term by the MHMDA.
(a) Consumer Health Data collected. Simpafy collects Consumer Health Data as part of the Personal Information described in Section 2. Categories of Consumer Health Data collected include health conditions, symptoms, diagnoses, treatments, medications, biometric and laboratory results, and other health-related information you provide through the Services or that is returned to Simpafy by laboratories.
(b) Purposes for collection. Simpafy uses Consumer Health Data for the purposes described in Section 6.
(c) Sharing of Consumer Health Data. Simpafy discloses Consumer Health Data to the categories of third parties described in Section 7. Simpafy does not sell Consumer Health Data.
(d) Rights under the MHMDA. As a Washington resident, you have the right to (i) confirm whether Simpafy is collecting, sharing, or selling your Consumer Health Data and to access that data; (ii) withdraw consent to Simpafy's collection and sharing of your Consumer Health Data; (iii) request deletion of your Consumer Health Data; and (iv) appeal a denial of any of the foregoing rights.
(e) Consent. During Account creation, Simpafy presents you with a consent mechanism to obtain your affirmative consent to Simpafy's collection, use, and sharing of your Consumer Health Data for the purposes described in this Policy. You may withdraw this consent at any time by contacting Simpafy at support@simpafy.com. Withdrawal of consent will result in closure of your Account and deletion of your Personal Information in accordance with Section 4.
(f) How to exercise MHMDA rights. To exercise any right under the MHMDA, follow the procedure described in Section 9.8. Simpafy will respond within forty-five (45) days of receipt of a verified request, subject to a one-time extension of up to forty-five (45) additional days where reasonably necessary, with notice of such extension.
(g) Geofencing. Simpafy does not use a geofence around any entity that provides in-person health care services for the purpose of identifying or tracking a consumer, collecting Consumer Health Data from a consumer, or sending notifications, messages, or advertisements to a consumer related to the consumer's Consumer Health Data or health care services.
Residents of states that have enacted comprehensive consumer privacy laws other than California and Washington — including, without limitation, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — may have additional rights under their state's privacy law, including rights of access, correction, deletion, portability, and to opt out of certain processing. To exercise any right under your state's privacy law, follow the procedure described in Section 9.8. Simpafy will respond within the timeframe required by the applicable state law.
If you are a resident of Nevada, Nevada law provides you with the right to opt out of the sale of certain information. As stated in Section 6.8, Simpafy does not sell Personal Information, and no opt-out is required.
The Services are not directed to children under 13 years of age. Only Account holders 18 years of age or older may create an Account, log in, and interact directly with the Services. Simpafy does not knowingly collect Personal Information directly from a child under 13.
Where an Account holder records information about a child under 13 as an additional Subject under Section 2.3, that information is collected from the Account holder, not from the child. Under Section 2.3, the Account holder represents that they have the legal right and responsibility to provide such information, which in the case of a child under 13 requires the Account holder to be the parent or legal guardian of the child.
A parent or legal guardian who has provided Personal Information about a child under 13 through the Services may, at any time, (i) review the Personal Information Simpafy holds about that child, (ii) request deletion of that Personal Information, and (iii) refuse to permit further collection or use of that Personal Information. Any such request may be made through the procedure described in Section 9.8 and will be handled in accordance with Sections 3 and 4.
If Simpafy becomes aware that it has collected Personal Information directly from a child under 13 outside the framework described in this Section 10.6, Simpafy will delete that Personal Information.
11.1 Links to third-party websites and services. The Services may contain links to websites, applications, services, or content operated by third parties. Simpafy does not control and is not responsible for the privacy practices of any third-party website, application, service, or content that is linked to or referenced from the Services. Your interaction with any third-party website, application, service, or content is governed by the privacy policies and practices of that third party. Simpafy encourages you to review the privacy policy of any third-party website or service before providing Personal Information to it.
12.1 Updates. Simpafy may update this Policy from time to time. Simpafy will post the updated Policy at https://simpafy.com/privacy-policy and will revise the Effective Date at the top of the Policy.
12.2 Notice of material changes. Where Simpafy makes a material change to this Policy — including a change that affects the categories of Personal Information collected, the purposes for which Personal Information is used, the categories of third parties to whom Personal Information is disclosed, or the rights available to you under this Policy — Simpafy will provide notice to Account holders prior to the effective date of the change. Such notice may be provided by email to the email address associated with your Account, by a notice within the Services, or by other reasonable means.
12.3 Continued use. Your continued use of the Services after the effective date of any update to this Policy constitutes your acceptance of the updated Policy. If you do not agree to an updated Policy, you may cancel your subscription or delete your Account in accordance with Section 4.
12.4 Prior versions. Simpafy retains and, upon written request to support@simpafy.com, will make available prior versions of this Policy.