Consumer Health Data Privacy Policy

Effective date: August 11, 2026 Last updated: August 11, 2026

This is a standalone policy about one specific thing: information about your health. It is written to stand on its own, and it says everything it needs to say without sending you somewhere else to find the rest. We also publish a general Privacy Policy that covers everything else we collect.

Gather Bio, Inc. ("Gather Bio," "we," "us," or "our") is a Delaware corporation building research infrastructure for autoimmune disease. This policy applies to every Gather Bio service — GatherChart, GatherMatch, and gatherbio.com — and the same rules apply wherever you meet us.

It does not cover participation in research studies or at-home testing. If we invite you to take part in either, we will present separate consent documents first, including any required by an independent Institutional Review Board, and nothing is collected for those purposes until you have signed them.

1. Who this policy is for

Several states treat health information as a protected category with its own rules — including Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's consumer health data provisions. This policy describes the rights those laws give you and how we handle the information they cover.

We apply it to everyone. If you live somewhere without a consumer health data law, you still get everything described here.

2. What counts as consumer health data

Consumer health data means information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. That is broader than it sounds. It covers conditions and diagnoses, symptoms, medications and treatments, bodily functions and vital signs, measurements from a wearable device, laboratory results, health care you have sought or received, and conclusions we draw about your health from any of the above.

3. The consumer health data we collect, and why

Everything below is collected because you gave it to us or switched on a connection that supplies it. Connections are off until you turn them on, one at a time, and each one collects only what it needs.

• Your self-reported condition — the autoimmune condition you optionally tell us you have when you join a waitlist. Used to understand which conditions people are waiting on and to tailor what we ask you.
• Your conversations — what you tell us in check-ins and chats, which may include how you are feeling, your symptoms, your medications, and anything else you choose to share. Used to keep your record and to continue the conversation with context.
• Voice notes and their transcripts — if you send a voice note, the audio and an automated text transcription of it. Used only to read and respond to what you sent.
• Medical records — if you connect your patient portals or insurance records, the visits, laboratory results, and medications retrieved on your instruction. Used to build your timeline.
• Wearable and Apple Health measurements — if you connect a device, the metrics you authorize, such as sleep, heart rate, and activity. Used for the same purpose.
• Conclusions we draw — the timeline, trends, and summaries we generate from the above. Used to show them back to you.

You can disconnect any source at any time in Settings, which stops new collection from it. You can also ask us to delete what was already collected, as described in Section 9.

4. What we deliberately do not collect

Two connections are built to take less than they could, because the alternative would tell us more about your health than we need to know.

• Your calendar. If you connect it, we request only free and busy intervals — the start and end times of busy periods. We do not receive event titles, descriptions, attendees, or locations, so we cannot see that an appointment was medical. We use the intervals only to time our check-ins considerately.
• Your location. If you turn on environmental context, we store your area only — a city, region, or zip code. Precise coordinates are rounded on your device before anything reaches us, and we never store them.

We also do not buy consumer health data, and we do not collect it from data brokers, advertising networks, or public sources.

5. What we share, and with whom

We share consumer health data only with the categories of recipients below, only for the purposes stated, and only under contracts that require them to protect it and forbid them from using it for their own purposes.

• Hosting, infrastructure, and database providers — the systems that store your information so we can show it back to you.
• A patient records-access provider — retrieves your records from the portals you connect, acting on your instruction.
• A speech-to-text provider — transcribes voice notes you send.
• The data sources you connect — your portals, laboratories, and devices exchange data with us because you told them to.
• Message delivery providers — WhatsApp, operated by Meta Platforms, Inc., and mobile carriers for SMS. See Section 6 for what they do and do not carry.
• Cloudflare, Inc. — bot protection on our forms. It sees your browser and device, not your health information.
• Researchers — only if you join a specific study and sign its separate consent document, and only as that document describes. Joining a waitlist or messaging with us never does this on its own.
• Legal recipients — courts, regulators, or law enforcement, where the law requires us to produce information.
• A successor entity — if Gather Bio is party to a merger, acquisition, or financing, information may transfer, and the recipient stays bound by this policy.

Affiliates. GatherChart, GatherMatch, and gatherbio.com are services operated by Gather Bio, Inc. They are not separate companies, and there is no affiliate outside Gather Bio, Inc. that receives your consumer health data.

Who never receives it. Advertisers, advertising networks, data brokers, and social media platforms. We do not use your health information for advertising, and we do not show you advertising.

6. How we keep health data out of your message thread

We check in with you over WhatsApp or SMS. Those services are run by companies we do not control, so we design the messages we send to avoid carrying your medical records, results, or other health details. When there is something personal to show you, we point you into the service, where you sign in and see it directly from us. The details stay with us; the thread carries the conversation.

What you send us is different. When you answer a check-in by text or voice note, that answer travels through WhatsApp or your carrier the way any message does. Meta can see that you and Gather Bio are messaging, and when. If you would rather not use WhatsApp, write to hello@gatherbio.com and we will switch you to SMS or email.

7. We do not sell your consumer health data

We do not sell consumer health data. Under these laws "sell" means exchanging it for money or for anything else of value, which is broader than it sounds — so to be specific about what we do not do: we do not accept payment, discounts, services, or data in return for anyone's health information.

If that ever changes, the law does not let us proceed on the strength of this policy or a checkbox. We would first have to obtain a separate written authorization from you that spells out exactly what would be sold and to whom, and you could revoke it at any time.

8. Geofencing

We do not use geofences around health care facilities, and we do not use location to identify or infer that you have sought health care.

9. How long we keep it

We keep consumer health data for as long as you have an active relationship with us — an account you use, or a waitlist spot you are waiting on. After that we keep it only as long as the law requires, or as long as the consent document for a study you joined requires.

You can ask us to delete it sooner, at any time, and we will.

10. Your rights, and how to use them

You have the right to:

• Know and access. Confirm whether we collect, share, or sell your consumer health data, see the data itself, and receive a list of every third party and affiliate we have shared it with, together with a way to contact each of them.
• Withdraw consent. Withdraw your agreement to our collection of your consumer health data, or to our sharing of it, as separate choices.
• Delete. Have us delete your consumer health data. When you ask, we delete it from our systems and from our backups on their normal cycle, and we tell every service provider and third party who received it to do the same. You can ask us to delete one thing — a condition you told us, a connected source's data — without deleting your whole record.

Using any of these rights costs nothing, and we will not treat you differently, degrade your experience, or deny you a service because you did.

How to ask. Email hello@gatherbio.com and tell us what you want. We may need to verify that the account is yours before we act, and we will ask only for what verification requires.

How quickly we respond. Within 45 days. If a request is genuinely complicated we may take up to 45 more days, and we will tell you why before the first 45 are up.

If we say no. We will tell you why, and you can appeal by replying to that message or writing to hello@gatherbio.com with the word "appeal." A different person reviews it, and we respond within 45 days. If we deny the appeal, you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the attorney general of your own state.

11. Changes to this policy

If we change this policy we will revise the "Last updated" date above. If a change affects how we handle consumer health data we have already collected from you, we will ask for your consent before applying it to that data, rather than applying it quietly.

12. Contact us

Questions about this policy, or about health information we hold, can be sent to: