Aspire Health Portal Privacy Policy

Aspira Health Global, Inc.

Last updated: October 22, 2026

Summary. This Privacy Policy explains how Aspira Health Global, Inc. collects, uses, discloses, and protects personal information when you use the Aspire Health Portal. We do not sell personal information, share it for cross-context behavioral advertising, or use health information for advertising. If you use the Service through an organization, that organization may control your information and its privacy notices and agreements may also apply.

1. Scope and Our Role

This Privacy Policy applies to the Aspire Health Portal web and desktop applications, related websites, and associated services (collectively, the "Service"). It does not apply to third-party websites, products, or services that have their own privacy notices.

Aspira Health Global may act as a controller or business that determines how personal information is processed, such as for Individual accounts and our own business operations. When an organization provides the Service to you, we generally process information on that organization’s behalf under our agreement with it. The organization determines account access, permitted uses, and how privacy requests relating to its records are handled.

When we process protected health information for a healthcare organization covered by the Health Insurance Portability and Accountability Act (HIPAA), we act as its business associate. The healthcare organization’s Notice of Privacy Practices and our Business Associate Agreement with it govern that information if they differ from this Policy.

2. Personal Information We Collect

2.1 Information you provide

We collect information you provide when you create or manage an account, use the Service, communicate with us, or make a payment. This may include your name, email address, telephone number, login credentials, account type, role, preferred language, general location, date of birth or age range, gender, organization or program relationship, and communications with us.

Depending on how you use the Service, you may provide health and wellness information, including assessment and screening responses, scores, mood check-ins, notes, goals, tasks, messages, saved resources, and Aspire Navigator conversations. Care Team members may also create notes, assignments, and other records relating to Participants.

If you purchase a subscription, Stripe processes payment card information. We receive limited billing and transaction information, such as billing name, plan, payment status, card brand, and the last four digits of the card. We do not store full payment card numbers.

2.2 Information provided by organizations and other users

An organization, Care Team member, parent, guardian, or other authorized user may provide information about you, invite you to the Service, assign you to a program or care team, or create records associated with your account. Organizations are responsible for having authority to provide this information and for giving any notices or obtaining any permissions required by law.

If you complete an assessment through a link provided by an organization, you may not need to create an account. In that case we collect your name, email address, the verification code we send to your email, and your responses, and we make your results available to that organization, including through software systems the organization connects to the Service. The organization is responsible for its own notices to you and, if it is a healthcare provider, for its HIPAA documents with its patients. If you later create an account with the same email address, your earlier results can be connected to your account, and the organization keeps the results it already has.

2.3 Information collected automatically

When you use the Service, we and our service providers may automatically collect device and usage information, such as IP address, browser and device type, operating system, app version, pages or features used, access times, referring pages, approximate location derived from IP address, diagnostic information, and security and activity logs. We use this information to operate, secure, troubleshoot, and improve the Service.

3. How We Use Personal Information

We use personal information to provide and administer the Service; authenticate users; display assessments, history, dashboards, trends, tasks, resources, and messages; support care-team and organization workflows; process subscriptions and payments; provide customer support; send service, security, and billing communications; personalize permitted features; monitor performance; prevent fraud, abuse, and security incidents; maintain records; enforce our agreements; comply with law; and protect the rights, safety, and integrity of users, organizations, Aspira Health Global, and others.

If assessment answers suggest a person may need urgent support, we use that information to alert the crisis contacts and care team members chosen by that person or their organization. The Service is not monitored for emergencies, and an alert does not mean anyone will respond right away.

We may use aggregated or deidentified information to analyze usage, improve the Service, and develop reports. With an organization’s authorization, we may also analyze the information we process for that organization to evaluate the outcomes of its programs and report the results to it. Where we process information for an organization, we use it only as permitted by our agreement with that organization and applicable law.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use health information for advertising. We do not make decisions that produce legal or similarly significant effects about you solely through automated processing unless we provide any notice and rights required by law. We do not use your health information or Aspire Navigator conversations to train artificial intelligence models.

3.1 Legal bases for processing

Where applicable law requires a legal basis, we process personal information based on performance of a contract, consent, compliance with legal obligations, protection of vital interests, and our legitimate interests in operating, securing, supporting, and improving the Service. When we process information on behalf of an organization, that organization determines the applicable legal basis. You may withdraw consent where processing is based on consent, subject to legal and contractual limitations. When you create an account, we ask for your separate consent to collect and use your health information and, where the law requires, your separate consent to share it. You can withdraw your consent at any time in your account settings or by messaging us in the portal.

4. Aspire Navigator

Aspire Navigator is an optional assistant available to all users. It helps you find features, resources, and information within the Aspire Health Portal. When you use it, the questions you type, the responses generated, and limited information needed to guide you within the Service are processed by Anthropic, our AI service provider, to generate a response. Aspire Navigator is designed for navigation help only. Please do not enter your own or another person’s health information, assessment answers, or clinical details into Aspire Navigator.

Aspire Navigator responses are generated automatically and may be incomplete or inaccurate. They are not medical advice, diagnosis, or treatment. Do not rely on Aspire Navigator in an emergency or as a substitute for a qualified professional. Our AI service provider does not use Aspire Navigator conversations to train its models under our commercial agreement with it.

5. How We Disclose Personal Information

We may disclose personal information to cloud hosting, database, authentication, security, communications, customer support, analytics, payment, and AI service providers that process information for us under contractual restrictions. Current providers include Google Cloud and Firebase for infrastructure and authentication, Anthropic for Aspire Navigator, Twilio SendGrid for email delivery, Stripe for payment processing, and Twilio for text messages when that feature is enabled.

We may also disclose personal information to the organization through which you use the Service, including software systems that organization connects to the Service; to other users at your direction or as enabled by your organization; to professional advisers and auditors; to government authorities or other parties when required by law or reasonably necessary to protect rights, safety, and security; and in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable confidentiality and contractual obligations. We may disclose aggregated or deidentified information that cannot reasonably be used to identify you. We do not permit service providers to use personal information for their own advertising purposes.

6. Organization Accounts and Access

If you use the Service through an organization, the organization controls its workspace, assigns user roles, and determines which personnel may access information. Depending on the organization’s configuration and your role, Organization Admins, Care Team members, billing personnel, program sponsors, or other authorized users may be able to view or manage account, program, billing, aggregate, or Participant information.

Access is intended to be limited to the organization, program, care team, or function assigned to the user. Your organization is responsible for configuring access appropriately and responding to questions about its use of your information. Authorized Aspira Health Global personnel may access information when reasonably necessary to provide support, maintain and secure the Service, investigate misuse, administer accounts, or comply with law.

7. Cookies and Similar Technologies

The Service may use cookies, local storage, software development kits, and similar technologies to keep you signed in, remember settings, protect accounts, understand Service performance, diagnose errors, and support core functionality. We do not use third-party advertising cookies to target advertisements based on health information. You can control cookies through your browser or device settings, but disabling necessary technologies may prevent parts of the Service from working. Where required by law, we honor applicable browser-based privacy preference signals, including Global Privacy Control, for processing that is subject to an opt-out right.

8. International Data Transfers

Aspira Health Global and its service providers may process personal information in the United States and other countries where we or they operate. These countries may have privacy laws that differ from those in your location. Where required, we use contractual, organizational, and technical safeguards designed to provide an appropriate level of protection for cross-border transfers.

9. Data Retention

We retain personal information for as long as reasonably necessary to provide the Service, maintain your account, fulfill the purposes described in this Policy, comply with legal and contractual obligations, resolve disputes, enforce agreements, and protect the Service. Retention periods depend on the type of information, the nature of the account, the organization’s instructions, applicable law, and operational needs.

When information is no longer needed, we delete, deidentify, or securely dispose of it. Information may remain for a limited period in backups, logs, legal holds, or records required for security, fraud prevention, accounting, or compliance. Information processed for an organization is retained and deleted according to that organization’s instructions and our agreement with it.

10. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, encryption in transit and at rest where supported, authentication controls, monitoring, and security procedures appropriate to the nature of the information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your credentials and for promptly notifying us or your organization of suspected unauthorized access. If a security incident requires notice, we will notify affected individuals, organizations, and regulators as required by applicable law and our contractual obligations.

11. Your Privacy Choices and Rights

Depending on your location and the context in which we process your information, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent; to opt out of certain disclosures or targeted advertising; to limit certain uses of sensitive information; to appeal a decision; and to complain to a privacy or data protection authority.

To submit a request, email info@aspirahealth.global or use in-portal messaging. We may verify your identity and authority before acting. If we process your information for an organization, we may direct your request to that organization. We will not discriminate against you for exercising a privacy right. An authorized agent may submit a request where permitted by law, subject to verification.

You may update certain account information in the Service, manage communications through available settings, and request account deletion. Some information may be retained where permitted or required by law or where deletion would affect the rights of others, the integrity of organizational records, security, or our legal obligations.

12. United States Privacy Disclosures

Residents of certain U.S. states may have additional rights regarding the categories and sources of personal information we collect, our business purposes for collecting and disclosing it, the categories of recipients, and available privacy choices. The relevant categories are described throughout this Policy. We do not sell personal information or share it for cross-context behavioral advertising. Health and wellness information may be considered sensitive personal information or consumer health data under some state laws. Where a law requires a separate consumer health data notice, consent, authorization, or deletion process, we will provide the additional notice or choice at or before the relevant collection or processing. Rights and exemptions vary by state and may differ when information is governed by HIPAA or processed for an organization.

13. Children and Students

Individuals must be at least 18 years old to create an Individual account. A minor may use the Service only through a parent or guardian or through an approved organization, such as a school or healthcare provider, that is responsible for obtaining any permission required by law and for supervising the minor’s use.

For children under 13, we collect personal information only with the consent of a parent or guardian or, where the law allows, a school acting for the parent for educational purposes. A parent or guardian may review the child’s information, ask us to delete it, and refuse further collection or use by contacting the school or emailing info@aspirahealth.global. We do not require a child to provide more information than is reasonably necessary to use the Service.

When we provide the Service to a school, we process student information for authorized educational purposes and under the school’s direction and applicable agreements. We do not use student information for targeted advertising or to create profiles unrelated to the authorized educational purpose. Parents, guardians, and eligible students should direct school-record requests to the school unless the school instructs otherwise.

14. HIPAA and Other Health Information

HIPAA does not apply to all health or wellness information. Information in an Individual account may not be protected by HIPAA unless it is created, received, maintained, or transmitted on behalf of a HIPAA covered entity. When we act as a business associate, we use and disclose protected health information only as permitted by the applicable Business Associate Agreement and law.

If you have questions or requests about information held by a healthcare organization, contact that organization first. Its Notice of Privacy Practices explains how it uses protected health information and how to exercise HIPAA rights.

15. Changes to This Policy

We may update this Policy to reflect changes to the Service, our practices, or applicable law. We will post the updated Policy and revise the date above. If changes are material, we will provide additional notice through the Service, by email, or by another appropriate method before the changes take effect when required by law.

16. Contact Us

Aspira Health Global, Inc.

4929 Del Monte Ave, #106, San Diego, CA 92107, United States

Email: info@aspirahealth.global

You may also contact us through messaging within the Aspire Health Portal.