Empelo Health — Privacy Policy
Effective date: September 3, 2026 | Last updated: September 3, 2026
1. Who We Are
This Privacy Policy describes how Empelo Health Inc. (“Empelo Health,” “we,” “us”) collects, uses, discloses, and protects information when you use the Empelo Health patient portal, connect a wearable device (such as Oura or WHOOP), receive SMS check-ins, or otherwise interact with our services (collectively, the “Services”).
If your Services are provided to you through your employer or health plan, a separate Employee Consent & Data Use Notice governs certain aspects of that relationship (including who at your workplace can and cannot see your individual results). Where the two documents address the same topic, the Employee Consent & Data Use Notice controls for that specific point.
2. Information We Collect
2.1 Information you provide directly
Account and contact information (name, email, phone number) used to create and secure your patient portal access.
Health information you enter yourself, including annual physical results, self-reported symptoms, and responses to SMS check-ins.
Communications you send us, including care-team messages, booking requests, and support inquiries.
2.2 Information from connected wearable devices
If you choose to connect a WHOOP, Oura, or similar device, we receive health and fitness data from that provider through an authorization you grant directly to us via that provider’s own consent screen. Depending on the device and the scopes you approve, this may include: recovery or readiness data (recovery/readiness score, heart rate variability, and resting heart rate); cycle or daily strain data (day strain and average heart rate during a cycle); sleep data (duration, start and end time); workout or activity data (activity type and accumulated strain); profile information; and body measurements (height, weight, and max heart rate). You can revoke this authorization at any time, either from within your Empelo Health portal or directly with the device manufacturer; revoking access stops future data collection but does not automatically delete data already received (see Section 6, Data Retention).
2.3 Information collected automatically
Basic technical information (IP address, browser type, access times) collected by our hosting infrastructure for security and reliability purposes.
SMS delivery and response metadata from our messaging provider, used to confirm check-ins were received and to honor opt-outs.
3. How We Use Your Information
To generate your personalized health score, care recommendations, and Score Card.
To operate the SMS check-in program, including sending reminders and recording your responses.
To facilitate booking requests and communications with your care team.
To detect, prevent, and respond to a small number of specific safety situations flagged by our automated systems or care team (see Section 7, Crisis and Safety Escalations, below).
To maintain, secure, and improve the Services, including troubleshooting and audit logging required under our security and compliance obligations.
To comply with legal obligations, including those arising under HIPAA where applicable.
4. How Information Is Shared
We share information only in the limited circumstances below, and never more broadly than necessary for that purpose:
With your employer or health plan, but only in de-identified, aggregate form above a minimum group-size threshold — never as individually identifiable results — unless you separately and explicitly authorize otherwise.
With service providers who process data on our behalf under contract, including our cloud hosting provider (AWS), our SMS provider (Twilio), and our AI-assisted care companion (built on AWS Bedrock), each bound by a written agreement limiting their use of your information to providing services to us.
With WHOOP, Oura, or other wearable providers, but only to the extent necessary to retrieve the data you've authorized us to access — we do not send your Empelo Health data back to these providers.
With your care team members whom you've specifically invited or shared results with through the portal's sharing features.
When required by law, subpoena, or valid legal process, or to protect someone's immediate safety (see Section 7 below).
In connection with a merger, acquisition, or sale of assets, subject to the same privacy protections described here.
5. Health Information and HIPAA
Depending on how Empelo Health's services are structured with a given employer or clinical partner, some or all of the health information we handle may be “protected health information” (PHI) under HIPAA. In these arrangements, Empelo Health may act as a HIPAA business associate to the relevant covered entity, and we handle PHI subject to the safeguards and use restrictions set out in our Business Associate Agreements.
6. Data Retention
We retain your information for as long as your account is active and as needed to provide the Services, plus any additional period required under the applicable Business Associate Agreement with the relevant covered entity, or as otherwise required by law. You may request deletion of your account and associated data as described in Section 8, subject to any retention we're legally required to maintain.
7. Crisis and Safety Escalations
Our AI-assisted care companion is designed to recognize certain narrow, specific indications of immediate risk to your safety during a conversation. If this happens, we may escalate this information to emergency services, a member of your care team, or another appropriate resource, consistent with our commitment to your safety. This is a narrow exception to the general data-sharing limits described above, used only for genuine safety situations, not general monitoring.
8. Your Choices and Rights
Access and correction: you can view and request correction of your information through your patient portal or by contacting us.
Wearable disconnection: you can disconnect a connected device at any time; see Section 2.2.
SMS opt-out: reply STOP to any check-in message to stop receiving future messages.
Deletion: you may request deletion of your account, subject to Section 6.
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we've collected about you, to request its deletion, and to be free from discrimination for exercising these rights — as noted above, we do not sell or share personal information. If you are a Washington resident, Washington's My Health My Data Act may give you additional rights regarding certain consumer health data, including the right to withdraw consent and request deletion. To exercise any of these rights, contact us using the information in Section 12.
9. Security
We use administrative, technical, and physical safeguards designed to protect your information, including encrypted connections (TLS) for all data in transit. We continue to build out and strengthen our infrastructure-level safeguards as our systems mature.
10. Children's Privacy
The Services are intended for use by adults age 21 or older, accessed through your employer or health plan. We do not knowingly collect information from anyone under the age of 21. If we learn that we have collected information from someone under 21, we will take steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new “last updated” date, and where required by law, provide additional notice of material changes.
12. Contact Us
Questions about this Privacy Policy or your information can be directed to: zach@empelohealth.com.