Consumer Health Data Privacy Notice

1. Who is responsible

Your Personal AI AS (YPAI), organisation number 933 915 778, Lysaker torg 5, 1366 Lysaker, Norway, is responsible for consumer-health processing it determines. Contact contact@ypai.ai, addressed to YPAI Privacy, for questions, requests, withdrawal or complaints.

This notice applies where consumer-health law covers our collection, use or sharing. It supplements our general Privacy Notice. Where we process health information only on another organisation's instructions, that organisation's notice explains its purposes and YPAI assists with relevant requests. HIPAA or another exemption applies only to the information and activity actually within its scope.

2. Categories, sources and purposes

A project-specific notice identifies the categories actually collected before participation. Covered projects can involve the following information where needed and authorised.

Sources are you and your authorised representative; devices used in the activity; a customer, research organisation or healthcare organisation with authority to provide the information; authorised dataset suppliers; and permitted analysis of the supplied information. A source's assertion that information is public is not sufficient authority for unrestricted health-data use.

We do not use contributor health data for targeted advertising or to identify people visiting healthcare facilities through prohibited geofencing. A new health-data category or purpose is disclosed, and any required consent is obtained, before the new processing begins.

3. Collection, sharing and recipients

We obtain the consent required for collection and, separately where required, sharing, unless the particular processing falls within a lawful exception such as what is necessary to provide a product or service you request. We do not treat general acceptance of terms as unlimited health-data consent.

Only the categories relevant to the authorised activity are shared. Recipients can include service providers for secure hosting and processing; authorised clinical or linguistic reviewers; the customer or research organisation identified for the project; and approved AI developers, research organisations, marketplaces or dataset buyers within the disclosed purpose and permissions.

Account credentials, payment details and unnecessary direct identifiers are not included in research or training-data deliveries. A project may require identifiable voice, video or clinical content; this is explained before collection rather than described as anonymous by default.

Any specific affiliate receiving covered consumer health data is identified in the relevant public disclosure before sharing. An unspecified future affiliate is not an authorised recipient merely because it is affiliated with YPAI. You can request the actual recipient list and the available contact route for each relevant third party as provided by law.

4. Sale requires a separate authorisation where applicable

Paid dataset licensing can constitute a sale of consumer health data. Where Washington's sale-authorisation requirement applies, we obtain a separate signed authorisation before selling or offering the covered data for sale. This is distinct from collection or sharing consent.

The authorisation identifies the particular data, YPAI as seller, the specific purchaser, purposes and uses, the withdrawal route, the required redisclosure warning and the statement that goods or services are not conditioned on signing. It expires one year after signature and includes the person's signature and date. A copy is supplied to the person. A new buyer or a new sale outside the authorisation requires the legally appropriate new authorisation.

The seller and purchaser retain the required authorisation evidence for six years from signature or its last effect, whichever is later. That evidence requirement does not justify unrelated continued processing of the underlying health dataset. Where a deletion request and evidence duty intersect, we minimise or redact the retained evidence as permitted by law.

5. Retention, security and deletion

The collection notice states the purpose-specific period or objective end event. Information is not retained indefinitely merely because it could be useful for research or AI training. Access is restricted, identity information is separated where appropriate, and processing and delivery use the safeguards described in our general Privacy Notice.

Deletion requests cover active records, identifiable derivatives and relevant archived or backup copies. We notify the recipients required by law and track their response. Backup handling follows the applicable legal deadline rather than an exception based solely on technical convenience. Our ordinary backup deletion target is no more than 90 days after active deletion; any shorter applicable limit prevails.

6. Your rights, requests and appeals

Where Washington's law applies, you can confirm relevant collection, sharing or sale; access the information and the statutory recipient list; withdraw consent to collection or sharing; and request deletion. You can revoke a sale authorisation through YPAI Privacy. Additional rights under other applicable laws remain available.

Write to contact@ypai.ai, addressed to YPAI Privacy, or use our website's data-request facility. No new account is required. We request only the information reasonably needed to authenticate the request and identify the affected records. Do not send medical records with an initial request unless they are necessary and we have provided a secure channel.

We respond without undue delay and within 45 days where Washington's request timetable applies. A permitted further 45-day extension is explained within the original period. Authentication does not restart that clock.

A refusal explains the reason and how to appeal. To appeal, reply to our decision or contact YPAI Privacy and state that you are appealing. We provide a written appeal decision within 45 days. An unsuccessful appeal includes the appropriate route to complain to the Washington Attorney General. Requests are handled without unlawful discrimination and subject only to the fees or exceptions the applicable law permits.

7. Changes and contact

Material changes are communicated before a new category, purpose or disclosure is introduced, with new consent where required. This notice does not retrospectively expand earlier permissions.

YPAI Privacy: contact@ypai.ai.

Postal address: Your Personal AI AS, Lysaker torg 5, 1366 Lysaker, Norway.