Consumer Health Data Privacy Policy

Last modified: 9/17/2026

Elstori, Inc. (“Elstori,” “we,” “us,” or “our”) is committed to respecting your privacy.
Our  general Privacy Policy  describes how we handle your personal data generally. This
supplemental Consumer Health Data Privacy Policy (“Health Data Privacy Policy”)
explains our practices for “Consumer Health Data” as such term is defined by applicable
health privacy laws, as each are amended and as and when they become effective
including any regulations thereunder (“U.S. Health Privacy Laws”).

“Consumer Health Data” is broadly defined to mean personal information that is linked
or can be reasonably linked to a consumer and that identifies past, present or future
physical or mental health status. Consumer Health Data does not include information
pertaining to individuals with whom we have an employment relationship.
Please read this Health Data Privacy Policy carefully to understand our policies and
practices regarding your Consumer Health Data and how we will treat it. If you do not
agree with our policies and practices, you should not use our sites, products,
applications, platforms, or services that are linked to this Health Data Privacy Policy
(collectively, “Services”).

If we make any material updates to this Health Data Privacy Policy, we will notify you as
required by U.S. Health Privacy Laws, including by either notifying you at the time of
collecting Consumer Health Data, or by updating this Health Data Privacy Policy earlier
than required. We reserve the right to amend this Health Data Privacy Policy at our
discretion and at any time. 

Categories of Consumer Health Data that We May Collect

We only collect, use and disclose your Consumer Health Data as needed to provide you
with the Services that you request or with your consent.

We may collect Consumer Health Data related to the following categories of Consumer
Health Data:

Reproductive and Parenting Stage Data. Information about your reproductive health
and parenting status, including your pregnancy status, expected due date, baby's birth
date, and parenting stage. This information about ways you have grown your family (i.e.
IVF, natural, adoption, surrogacy, fostering parent, etc).

Emotional Wellness Data. Information you provide in response to questions about
your postpartum emotional health: such as identifying your current emotional state, your
support needs, what feels hardest for you right now, what you wish you had more of,
coping strategies, and activities you enjoy.

Journal Entries and Self-Reported Reflections. Information you voluntarily provide
through our journaling feature, including written reflections about your emotional state,
mental health, parenting experiences, and personal well-being. Journal entries may
contain information about your mental health history, symptoms, coping strategies, and
other aspects of your physical or emotional health that you choose to disclose.

Community and Peer Support Data. Information you share through our Circles (group
chat), our AI empowered companion, direct messaging features, including messages,
profile information (name, email, number of children, etc) and any health-related
information you choose to disclose in communications with other users.

Other Data. Other information that could identify your attempt to seek health care
services or information, or any inferences of the above categories of health data derived
or extrapolated from non-health information.

For any Consumer Health Data that constitutes “Sensitive Data” as defined under
applicable U.S. Health Privacy Laws, we will first obtain your affirmative consent before
collecting, using, or sharing that health data in compliance with those privacy laws.

For all other Consumer Health Data, we will not collect, use, or share additional
categories of Consumer Health Data disclosed in this Health Data Privacy Policy
without first disclosing the additional categories and obtaining your affirmative consent
prior to the collection, use, or sharing of that health data.

Please note that Consumer Health Data does not include data that cannot reasonably
be used to infer information about, or otherwise be linked to, you (“deidentified data”).
We take reasonable measures to protect deidentified data, and we only process such
data in a deidentified fashion without attempting to reidentify such data. We will
contractually obligate any recipients of deidentified data to also take reasonable
measures and process such data in the same fashion we do.

Purposes for Collecting Consumer Health Data and How We Use It
We may use these categories of Consumer Health Data for the following purposes:
To provide and maintain the Services.
To personalize AI responses and emotional support based on your intake,
wellness, and mood data.
To generate insights and recommendations tailored to your parenting stage.
To improve and develop our Services and related features.
To communicate with you about your account and service updates.
To carry out our obligations and enforce our rights arising from any contracts
entered into between you and us, including for billing and collection.
To promote our Services, business, and offerings by publishing advertising on
our own Services and by placing ads on third parties’ services.
To notify you when Services updates are available and about any changes to the
products or services we offer or provide through our Services.

To enforce our Terms, this Privacy Policy, or other policies or agreements with you.

For any other purpose with your consent, consistent with applicable law.
For any other purpose we may describe when you provide the information.

The usage information we collect, whether connected to your Personal Information or
not, helps us improve our Services and deliver a better and more personalized
experience by enabling us to:

Estimate our audience sizes and usage patterns.
Store information about your preferences, allowing us to customize the Services
according to your individual needs and interests.
Speed up your searches.
Recognize you when you return to our Services.

Sources of Consumer Health Data
We may collect your Consumer Health Data from the following sources:
Voluntarily provided information may include your name, email address, phone or
mobile number, account information, your date and place of birth, your location,
parenting stage (such as a due date or baby’s birth date), onboarding and intake
questionnaire responses, mood check-ins, journaling entries, support needs, parenting
challenges, and any content you send to us when you contact us, subscribe to updates,
or submit content through the Services.

For instance, through mood check-ins, journaling features, and similar wellness
tools, you may voluntarily provide mood selections, contributing factors, written
reflections, and other information relating to your emotional or mental wellness.
Elstori treats this self-reported wellness data as consumer health data and,
where applicable, as protected health information or medical information under
applicable law.

Please note that if you participate in Circles or direct messaging, your messages
and certain profile information, such as your name and avatar, will be visible to
the other participants in those features.

If you interact with Elstori’s AI companion, the messages you send, together with
relevant intake and wellness information, may be processed to generate responses and maintain conversational context.

Automatically collected information may include log data, device information, app activity, usage details, session information, device type, time and date of access, error reports, and similar technical details that your device or app
provides when you use the Services.

Log data. When you access our Services through the app, we may automatically
log standard data provided by your device. This may include your Internet
Protocol (IP) address, device type and version, activity within the app, the time
and date of access, and other information about your usage. If you encounter an
error while using the app, we may automatically collect information about the
error and the circumstances surrounding it.

Device data. Depending on how you use the app and the permissions you grant,
the app may access information and capabilities through your device’s built-in
tools, including your identity, microphone, calendar, phone/SMS functions,
storage, photos and media, notifications, voice assistant, background app
refresh, mobile data, device or app history, and Bluetooth. When required, we will
ask for permission before accessing these features.

Chat and artificial intelligence technologies.
Our AI is uniquely crafted using insights and interviews from a dedicated network of
doulas, midwives, OB-GYNs, postpartum coaches, and mental health specialists. It is
designed to act as an informational resource to help navigate the postpartum journey.
However, it does not provide medical diagnoses, clinical treatment plans, or emergency
services. If you are experiencing a medical emergency, please contact your healthcare
provider or local emergency services immediately.

To provide you with real-time, personalized text responses, any health conditions,
symptoms, or thoughts you share in the chat are securely logged and processed by our
AI infrastructure. To deliver this service safely, your encrypted text inputs may be
processed through trusted third-party cloud infrastructure (such as OpenAI/ChatGPT).
Additionally, we utilize secure artificial intelligence (“AI”) technologies provided by
OpenAI. These services employ cookies and software code to operate the chat features
and process your prompts.

Please note that your interactions with these AI features are also subject to the
respective privacy policies, data processing terms, and terms of service of these third-
party providers (e.g., OpenAI Business Terms / Privacy Policy). We encourage you to
review their policies to understand how they manage and protect data. These third
parties may access and use the personal information you share within the chat solely to
help facilitate, maintain, and improve the services. For additional details regarding the
terms of use of our AI companion, please see our Terms of Service at
https://elstori.com/terms-of-service.

Disclosure of Consumer Health Data
We do not sell for money your Personal Information or consumer health data. We do not
share health or wellness data with third parties for marketing or advertising purposes,
and we do not use your information to make automated decisions that produce legal or
similarly significant effects.

We may disclose categories of your Consumer Health Data described above in the
following circumstances:
To contractors, service providers, and other third parties we use to support our
organization and the Services, including providers of hosting, IT support,
maintenance, communications, analytics, transcription, and payment processing,
and who are permitted to use the information only for the purposes for which we
disclose it.

To our employees, contractors, and related entities on a need-to-know basis.
To courts, regulators, or law enforcement when required by law.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by us when you provide the information.
With your consent, consistent with applicable law.
To enforce or apply our Terms of Use and other agreements, including for billing
and collection purposes, and this Privacy Policy.

To protect the rights, property, or safety of our organization, our customers, or
others. This includes exchanging information with other companies and
organizations for the purposes of fraud protection and credit risk reduction.
To a buyer or other successor if all or substantially all our business or assets are
transferred, including for diligence purposes related to the same.

We also use third-party AI providers to generate responses in our application and for
speech-to-text transcription. In addition, messages and intake data used for AI features
are sent to OpenAI to generate responses, subject to applicable data processing
arrangements. Audio used for voice transcription is sent to ElevenLabs solely for
transcription purposes. According to the information provided, these AI providers do not
use your data to train their models.

We do not disclose consumer health data to third parties for marketing or advertising
purposes. Nor do we store audio after transcription is completed, and voice data is not
used for biometric identification.

Your Privacy Rights
You have specific rights with respect to your Consumer Health Data.
You have the right to know if we are collecting, using or disclosing your Consumer
Health Data, to access that consumer health data, including receiving a list of the
entities and affiliates with whom we have shared or sold your information, though
currently we do not sell your Consumer Health Data with third parties.

You have the right to request that we delete your Consumer Health Data
If you think some of the personal information we have about you is incorrect, you have
the right to request that we correct the personal information in compliance with
applicable U.S. Health Privacy Laws.

If we are processing your Consumer Health Data with your consent, you have the right
to withdraw that consent. Withdrawing your consent will effectuate a deletion request.
We will not discriminate against you for exercising any of your rights. However, if you
withdraw consent for collection and/or request deletion of your Consumer Health Data,
we may remove you from certain marketing programs that rely on your Consumer
Health Data to provide you the Services.

To exercise these rights, you may submit a request by emailing us at support@elstori.com.

We will respond to your request as required by applicable law.
When you submit a request regarding your Consumer Health Data, we reserve the right
to verify your identity in connection with any requests regarding Consumer Health Data
to help ensure that we provide the information we maintain to the individuals to whom it
pertains and allow only those individuals to exercise rights with respect to that
information.

To help us respond to your request, all communications to us should include the
sender’s name and contact information (such as email address, phone number or
mailing address), and a detailed explanation of the request. We will endeavor to
respond to all reasonable requests in a timely manner, and in any case, within any time
limits prescribed by applicable local law.

Any questions, concerns, complaints, or appeals regarding handling of Consumer
Health Data, or related to revocation of consent to collect, process, transfer, or disclose
your Consumer Health Data should be directed by email to support@elstori.com. If your
appeal is unsuccessful, you can file a complaint with the relevant government body in
your state, including:

Connecticut State Attorney General at https://portal.ct.gov/ag/sections/privacy/ the-
privacy-and-data-security-department
Maryland State Attorney general at https://www.marylandattorneygeneral.
gov/Pages/CPD/Complaint.aspx
New York State Attorney General at
https://formsnym.ag.ny.gov/
OAGOnlineSubmissionForm/faces/
OAGBITHome;jsessionid
=nTa5_PBH7sqdmLWS5TgpF0e2x
glVNgd8vqiflAYw1No0KqmyVUBp!548137084
Nevada State Attorney General at
https://ag.nv.gov/About/Consumer_Protection/
Bureau_of_Consumer_Protection/
Washington State Attorney General at  www.atg.wa.gov/file-complaint .

Please  contact us directly with any questions or concerns you may have about your
Consumer Health Data privacy or this Health Data Privacy Policy. You may also contact
us by email at support@elstori.com, or by mail at the following address:

3723 Greenville Avenue
Dallas, Texas 75206, United States