Future Health AI Privacy Policy

Effective Date: October 27, 2026 (App version 1.1.0)

Last Updated: October 27, 2026

Future @I LLC ("we," "us," or "our") operates the Future Health AI mobile application ("App"). This Privacy Policy describes how we collect, use, store, and protect your information when you use our App. This policy is designed to comply with the Health Insurance Portability and Accountability Act (HIPAA), the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

By using the App, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the App.

Table of Contents

1. Overview
2. Information We Collect
3. How Your Data Is Stored
4. How Your Data Is Used
5. Data Sharing and Disclosure
6. On-Device AI Processing
7. App Telemetry
8. Permissions
9. Data Security
10. Your Rights
11. Consent Framework
12. Audit Logging
13. Children's Privacy (COPPA Compliance)
14. Emergency Features
15. Data Retention and Deletion
16. Health Data Privacy Notice
17. Third-Party Services
18. Changes to This Policy
19. Contact Information

1. Overview

Future Health AI is a health data coordination application for Android devices. The App helps you organize, track, and manage your personal health information. The App does not provide medical diagnoses, prescriptions, or treatment recommendations. All AI features function strictly as a health data coordinator.

Key Privacy Principle: Your health data never leaves your device. All health records, profile information, and personal data are stored exclusively on your device using encrypted local storage. We do not operate cloud servers that store your health data, and we do not transmit your health data to any third party.

2. Information We Collect

2.1 Health Data (Stored Locally Only)

The following categories of information are collected and stored exclusively on your device:

• Health timeline entries (appointments, events, notes, observations)
• Medication records (names, dosages, schedules, refill dates)
• Vital signs (blood pressure, heart rate, temperature, weight, glucose)
• Allergies and conditions
• Profile information (name, date of birth, blood type, medical conditions)
• Emergency contacts (names, phone numbers, relationships)
• Family links (parent/guardian, caregiver, and dependent relationships)
• Consent records (your privacy and sharing preferences)
• Audit logs (records of all data access within the App)

None of the data listed in Section 2.1 is transmitted to our servers, any cloud service, or any third party.

2.2 App Telemetry (Sent to the Future @I FM Hub)

The following non-health information is transmitted to our FM Hub server for app management purposes. Telemetry events are deleted automatically after 90 days and session records after 30 days:

• Installation identifier (a randomly generated anonymous ID)
• A device identifier based on your phone's Android ID (a 16-character value that Android gives this app on this phone). It is used to enforce the free daily limit on AI questions and to detect abuse, so it stays the same if you reinstall the app. It is sent each time the app starts, together with the number of AI questions asked today and the dates the app was first and last seen. It is never combined with your name, email or health data. Records are deleted automatically after 180 days without activity (360 days if flagged for abuse)
• App version number
• Device platform (Android)
• Operating system version
• Device model name
• The time and size of a backup, when you create one (never its content)
• Messages you choose to send to support, and anonymous diagnostic events

This telemetry is sent over an encrypted HTTPS connection to our FM Hub server (fm.futureati.app). It contains no health data and no sign-in details, and no name or email address. The only identifiers sent are the anonymous installation ID and the device identifier described above. Support messages contain only what you type into them.

2.3 Information We Do NOT Collect

• We do not collect your name, email, or contact information on any server
• We do not collect or transmit health records, vitals, medications, or any Protected Health Information (PHI)
• We do not use third-party analytics services that access health data
• We do not show advertisers your health data. The App shows banner ads through Google AdMob, which receives the technical information listed in Section 17.3 (never your health records)
• We do not sell, rent, or trade any user data

3. How Your Data Is Stored

3.1 On-Device Storage

All health data is stored in a database inside the app's private storage on your Android device. Android keeps that storage isolated from other apps, and your phone's lock screen and device encryption protect it when the phone is locked. In this version the app does not add its own encryption to the database file. Backup files created by the app are encrypted with AES-256.

• Database file: Stored in the app's private storage, isolated from other apps by Android; not separately encrypted by the app in this version
• Key storage: Backup and secret keys are kept in Android KeyStore-backed encrypted storage
• Backup file: AES-256 with a random key and an integrity check (HMAC-SHA256)
• Data at rest: Protected by Android app isolation and your phone lock screen; backup files are encrypted
• Data in transit: Not applicable for health data (health data is never transmitted)

3.2 No Cloud Storage

Your health data is never uploaded to any cloud service, remote server, or external storage system. If your device is lost or destroyed, your health data can only be recovered from an export you previously created (see Section 10.3).

4. How Your Data Is Used

Your health data is used for the following purposes, all of which occur entirely on your device:

1. Health record organization -- displaying your health timeline, medications, and vitals
2. Medication reminders -- sending local notifications for scheduled medications
3. Emergency preparedness -- preparing emergency data packets for first responders (transmitted only with your explicit confirmation)
4. AI-assisted coordination -- the on-device AI summarizes, organizes, and tracks your health data (see Section 6)
5. Data export -- generating FHIR R4-compliant exports at your request
6. Family coordination -- sharing selected health data with linked family members or caregivers, subject to your consent

5. Data Sharing and Disclosure

5.1 We Do Not Share Health Data

We do not share, sell, rent, or disclose your health data to any third party. Your health data exists only on your device.

5.2 User-Initiated Sharing

You may choose to share your health data in the following ways:

• Emergency packet sharing -- During an emergency, you may authorize the App to share a summary of critical health information with emergency contacts or first responders. This requires your explicit confirmation at each step.
• FHIR data export -- You may export your health records in FHIR R4 JSON format to share with healthcare providers of your choosing.
• Family/caregiver access -- You may grant specific family members or caregivers access to portions of your health data, subject to the consent framework described in Section 11.

5.3 Legal Requirements

We may be required to disclose information if compelled by law, regulation, or legal process. However, because we do not store your health data on any server, we do not possess your health data and therefore cannot produce it in response to legal requests. Only the data on your device is subject to any such requirements, and access to your device is protected by device-level encryption and authentication.

6. On-Device AI Processing

6.1 How AI Works in This App

Future Health AI includes an artificial intelligence feature powered by large language models (LLMs) that run entirely on your device. The AI processes your health data locally using the llama.cpp inference engine.

• No data is sent to any AI cloud service (e.g., OpenAI, Google, Anthropic, or any other provider)
• No internet connection is required for AI features after the initial model download
• AI model files are downloaded once from HuggingFace (see Section 16) and stored locally

6.2 AI Health Guidance

The AI in this App provides helpful health guidance — like a knowledgeable friend who has medical knowledge. When you have shared your health profile (age, conditions, medications), Aria can provide more tailored guidance.

Aria is designed to:

• Explain health topics, medical terms, and how conditions or medications generally work
• Suggest lifestyle changes, questions to ask your doctor, and when to seek care
• Recommend follow-up actions and monitoring steps
• Analyze health trends from your logged data
• Summarize your health records
• Coordinate appointment information
• Notify you of medication schedules
• Organize your health timeline
• Prepare emergency data packets
• Record health observations

The AI does not and cannot:

• Make definitive diagnoses ("you have [disease]")
• Prescribe specific prescription medications or exact dosages
• Replace emergency services
• Override physician instructions

AI-generated health information is clearly labeled. We do not store or share your health queries with third parties. AI responses are generated locally on your device and never transmitted to any external server.

LIMITATION ON AI ADVICE: By using this App, you acknowledge that AI health guidance is informational only. Always consult a qualified physician before making medical decisions. AI guidance does not constitute a medical diagnosis, prescription, or treatment plan.

All AI responses related to health topics include a mandatory disclaimer advising you to consult a qualified healthcare professional before acting on the information.

7. App Telemetry

7.1 What Is Collected

The App sends minimal, non-health telemetry to our FM Hub server for the purpose of app management, update distribution, and usage analytics:

7.2 What Is NOT Collected

The following are never included in telemetry:

• Health records, vitals, medications, or any PHI
• Names, email addresses, or contact information
• Location data
• Usage patterns related to health features (apart from the daily AI question count described in Section 2.2)
• AI conversation history
• Any content you enter into the App

7.3 Telemetry Server

Telemetry is transmitted over HTTPS to our FM Hub server (fm.futureati.app). This data is used for app version management, support and anonymous diagnostics. Telemetry events are deleted automatically after 90 days and session records after 30 days.

8. Permissions

The App requests the following Android permissions, each for a specific and limited purpose:

Permission Principles:

• Location is accessed only during emergency activation and only with your explicit consent
• Phone/SMS permission is used only to dial 911 and only after you press the explicit "Call 911" confirmation button -- the App never places calls automatically
• All permissions can be revoked through Android system settings at any time

9. Data Security

We implement the following technical safeguards to protect your data:

9.1 Encryption

• At rest: Health data is in the app's private storage (the database is not separately encrypted by the app in this version); backup files are AES-256 encrypted
• Key management: Backup and secret keys stored in Android KeyStore-backed encrypted storage

9.2 Authentication

• Biometric authentication: Fingerprint or facial recognition via Android BiometricPrompt API
• Session timeout: Automatic lock after 5 minutes of inactivity
• No account or password: The App has no sign-in. It does not create an account, collect an email address or store a password. Access to your records is protected by your phone and, if you turn it on, by biometrics.

9.3 Application Security

• Screenshots: Allowed, so you can capture and report problems; the app does not block screen capture
• Root/tamper detection: The App detects rooted or tampered devices and warns users of increased risk
• No data caching: Sensitive data is not written to Android system caches
• Memory protection: Sensitive data is cleared from memory after use

9.4 Audit Trail

Every access to your health data within the App is recorded in an immutable, append-only audit log (see Section 12).

10. Your Rights

You have the following rights regarding your personal data:

10.1 Right to Access

You may view all data stored by the App at any time through the App's profile and health record screens. The audit log is also accessible, showing every instance of data access.

10.2 Right to Amend

You may correct or update any health record, profile information, or other data stored in the App at any time. Amendments are logged in the audit trail.

10.3 Right to Export (Data Portability)

You may export your complete health record at any time in FHIR R4 (Fast Healthcare Interoperability Resources) JSON format. This industry-standard format is accepted by most healthcare providers and electronic health record systems.

10.4 Right to Delete

You may delete your data at any time with Profile > Delete my data. This erases every health record, setting, reminder, your display name and the App's identity and FM keys from your phone. This process is irreversible. The App keeps only the key that protects its (now empty) local database. Uninstalling the App also removes its data from your phone. The App has no account, and we hold no health data on any server. We do keep a small technical record on our FM server (the anonymous installation ID and the device record used for the free AI question limit, described in Section 2.2). You cannot delete that record from the App. It is deleted automatically after 180 days without activity (360 days if it was flagged for abuse). To ask for earlier deletion, write to privacy@futureati.app; because the record is not linked to your name, we may need your installation ID or device details to find it.

10.5 Right to Revoke Consent

You may revoke any previously granted consent at any time through the App's privacy settings. Consent revocation takes effect immediately and is recorded in the immutable consent log.

10.6 Right to Restrict Processing

You may disable any AI processing features at any time. You may also disable telemetry, medication reminders, or any other feature through the App's settings.

10.7 Right to Be Informed

This Privacy Policy, along with in-app consent prompts, provides clear notice of all data practices. You will be notified of any material changes to this policy (see Section 17).

10.8 HIPAA Rights

If your health data qualifies as Protected Health Information (PHI) under HIPAA, you additionally have the right to:

• Receive an accounting of disclosures
• Request restrictions on certain uses of your data
• Request confidential communications
• File a complaint if you believe your privacy rights have been violated

11. Consent Framework

11.1 Granular Consent

The App uses a granular consent model. You are asked to provide separate consent for each type of data processing:

• Health data storage and encryption
• AI-assisted health coordination
• Medication reminder notifications
• Emergency contact sharing
• Family member data access
• App telemetry

11.2 Consent Records

All consent decisions are recorded with:

• Timestamp of consent action
• Specific scope of consent
• Cryptographic proof of integrity
• Whether consent was granted or revoked

Consent records are immutable -- they cannot be modified or deleted. This creates a verifiable audit trail of your privacy choices.

11.3 Withdrawal of Consent

You may withdraw consent for any purpose at any time. Withdrawal is recorded as a new consent event (the original grant is preserved for audit purposes). Features dependent on withdrawn consent are immediately disabled.

12. Audit Logging

12.1 What Is Logged

Every access to your health data generates an audit log entry containing:

• Timestamp of access
• Type of action performed (view, create, update, export)
• Category of data accessed
• User role performing the action
• Success or failure of the action

12.2 Immutability

Audit logs are INSERT-only. The database enforces this constraint at the storage engine level -- no audit log entry can ever be modified or deleted. This ensures a tamper-evident record of all data access.

12.3 Your Access

You may view the complete audit log at any time through the App's privacy settings.

13. Children's Privacy (COPPA Compliance)

Future Health AI takes the privacy of children seriously and complies with the Children's Online Privacy Protection Act (COPPA).

13.1 Children Under 13

• A parent or legal guardian must create and manage the profile
• The parent or guardian has full access to all health data
• The parent or guardian provides all required consents on behalf of the child
• The parent or guardian may review, export, or delete the child's data at any time

13.2 Teenagers (Ages 13-17)

• A parent or guardian retains limited access to the teenager's health data
• The following categories are blocked from parental access to protect the teenager's privacy:
• Mental health records
• Reproductive health records
• Substance abuse records
• The teenager may independently manage consent for these protected categories
• All other health data remains accessible to the parent or guardian

13.3 Adults (Age 18+)

• Parental access is automatically revoked when the user turns 18
• The user has full, independent control over all data and consent decisions
• Former parental accounts retain no access to the adult's health data

13.4 Age Verification

Age is determined from the date of birth provided during setup. The App enforces age-based access controls automatically based on this date.

14. Emergency Features

14.1 Emergency Data Sharing

During an emergency, the App can share a summary of critical health information (allergies, medications, conditions, emergency contacts) with first responders or emergency contacts. This sharing:

• Requires your explicit confirmation at every step
• Shows you exactly what data will be shared before transmission
• Creates an audit log entry for every share action
• Expires the shared data after the emergency session ends

14.2 911 Calling

The App can assist in calling 911. This feature:

• Never activates automatically -- you must press an explicit "Call 911" confirmation button
• Requires a visible, deliberate user action
• Creates an audit log entry

14.3 Location Sharing in Emergencies

If you have granted location permission, the App may include your current location in emergency data packets. This occurs only during an active emergency and only with your explicit confirmation.

15. Data Retention and Deletion

15.1 Health Data

Health data is retained on your device indefinitely until you choose to delete it. We do not impose automatic deletion periods on health records, as longitudinal health history has ongoing value.

15.2 Audit Logs

Audit logs are retained for as long as the data is on your phone. They cannot be selectively deleted but are erased along with all other data when you use Delete my data.

15.3 Consent Records

Consent records are retained on your phone for compliance and audit purposes until you use Delete my data.

15.4 Telemetry Data

Anonymous telemetry data retained on the FM Hub server does not contain health information, names or email addresses and is kept for app management purposes only: telemetry events for up to 90 days and session records for up to 30 days, then deleted automatically.

15.5 Deleting Your Data

When you use Profile > Delete my data:

1. Every row of every table in the local database is deleted (health records, audit logs, consent records and settings)
2. The App's preferences, scheduled reminders and onboarding state are cleared
3. Your display name, device identity and FM keys are removed from secure storage
4. The App restarts its first-run setup

This action does not remove the technical records on our FM server (see Section 10.4).

This process is irreversible. We recommend exporting your data first. AI model files you downloaded are not removed by this action; uninstalling the App removes them.

16. Health Data Privacy Notice

This section provides additional information about how we handle health-related data, following best practices established by leading AI application providers.

16.1 Health Data Definition

"Health Data" means any information you enter into the App that relates to your physical or mental health, including but not limited to: vital signs, medications, allergies, medical conditions, symptoms, lab results, appointment records, and health timeline entries.

16.2 Health Data Protections

Your Health Data receives the highest level of protection available in the App:

• On-device only: Health Data is stored exclusively on your device in the app's private storage.
• Not used for AI training: Your Health Data is never used to train, fine-tune, or improve AI models. The AI models used in the App are pre-trained open-source models downloaded once and used locally.
• Not sold or shared: We do not sell, rent, license, or trade your Health Data to any third party for any purpose, including advertising, marketing, or research.
• Not analyzed remotely: All AI analysis of your Health Data occurs on your device. No Health Data is sent to any remote AI service (including OpenAI, Google, Anthropic, or any other provider).

16.3 Health Data and AI

When you interact with Aria (the AI assistant), your Health Data may be included in the on-device AI context to provide relevant health guidance. This processing:

• Occurs entirely on your device
• Is not transmitted over the internet
• Does not result in a definitive diagnosis or prescription of specific medications
• Includes a mandatory disclaimer for all health-related responses: "Please consult your doctor or healthcare provider before acting on this information. This is guidance only, not a diagnosis."

AI health guidance is clearly identified. We do not store or share your health queries with any third party. All AI processing happens locally on your device using downloaded model files.

LIMITATION ON AI ADVICE: By using this App, you acknowledge that AI health guidance is informational only. Always consult a qualified physician before making medical decisions based on AI responses.

16.4 FTC Health Breach Notification

In the unlikely event of a data breach affecting your Health Data, we will:

• Notify affected users within 60 days of discovering the breach
• Notify the Federal Trade Commission if 500 or more users are affected
• Provide details about the nature of the breach and steps you can take
• Document all breach response actions in accordance with the FTC Health Breach Notification Rule

16.5 Comparison to Cloud-Based AI Services

Unlike cloud-based AI services, Future Health AI provides stronger health data privacy because:

17. Third-Party Services

17.1 FM Hub

• Purpose: App telemetry and version management
• Data sent: Anonymous installation ID, device identifier based on the Android ID, daily AI question count, app version, platform, OS version, device model
• Data NOT sent: Any health data, personal information, or user-generated content
• Network: Encrypted HTTPS connection to fm.futureati.app

17.2 HuggingFace

• Purpose: One-time download of AI model files
• Data sent: Standard HTTP request headers (IP address, user agent)
• Data NOT sent: Any health data, personal information, account details, or user-generated content
• When used: Only during initial AI model setup
• Privacy policy: https://huggingface.co/privacy

17.3 Google AdMob (advertising)

• Purpose: The App shows banner advertising (currently on the Home screen). Ads help keep the App available.
• Provider: Google LLC (AdMob / Google Mobile Ads SDK).
• Data sent to Google: your phone's advertising ID, IP address, device and operating-system information, ad and app interaction records, and crash/performance diagnostics. This is the data Google describes at https://developers.google.com/admob/android/privacy/play-data-disclosure . Google may use it for advertising, analytics and fraud prevention under Google's Privacy Policy (https://policies.google.com/privacy).
• Data NOT sent: your health records, vitals, medications, conditions, notes or profile information.
• Ad personalization: The App asks for non-personalized ads only.
• Your control: You can reset or delete your advertising ID, or opt out of ads personalization, in your Android settings (Settings > Google > Ads, or Settings > Privacy > Ads).

17.4 Google Play (purchases)

• Purpose: Optional paid features are bought through Google Play Billing.
• How it works: Google Play handles the payment, card details and receipts. We do not see or store your payment card. The App only learns whether a purchase is active.

17.5 No Other Third Parties

The App does not integrate with any other third-party services. There are no analytics platforms, crash-reporting services or social media SDKs with access to your data, other than those listed in this Section.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will notify you through an in-app notification
• We will request renewed consent if the changes affect how your health data is processed
• The previous version of the policy will remain available for your review

Your continued use of the App after notification of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your data as described in Section 15.5, or uninstall the App.

19. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Future @I LLC San Francisco, CA United States

Privacy inquiries: privacy@futureati.app

HIPAA-related requests: privacy@futureati.app

Mailing address: Future @I LLC Attn: Privacy Team San Francisco, CA 94105 United States

For HIPAA-related complaints, you may also contact:

U.S. Department of Health and Human Services Office for Civil Rights https://www.hhs.gov/ocr/complaints/index.html

Summary of Key Privacy Commitments

This Privacy Policy is effective as of October 27, 2026.

Future Health AI is developed by Future @I LLC, San Francisco, CA.

Package: com.futureai.health