ZenXGuard Privacy Policy

This Policy applies to:

• Users (patients, caregivers, clinicians, support group members) who create accounts or otherwise interact with ZenXGuard.
• Visitors to our public-facing websites or marketing pages.
• Third parties who connect to ZenXGuard via integrations (e.g., wearable devices, EHR/EMR platforms) to the extent their data touches our systems.

This Policy does not govern third-party websites or services you access through ZenXGuard (see Section 11).

We collect information in three main ways: (A) you provide it, (B) it’s collected automatically, and (C) it’s obtained from third parties.

A. Information You Provide Directly

• Account Data: Name, email, phone number, date of birth, address, profile photo, preferred language, relationship to other users (e.g., caregiver/clinician).
• Biometric & Behavioral Inputs: Heart rate, sleep patterns, step counts, wearable sensor outputs, device motion, phone usage metrics (call/text metadata, screen time), and other metrics you authorize.
• Journaling & Survey Data: Mood logs, symptom trackers, free-form journal entries, crisis plans, medication adherence confirmations, self-assessments.
• Clinical & Health Data: Diagnoses, care plans, medication lists and schedules, provider notes, lab results—only if you or your clinician upload/enter them or you integrate with an EHR.
• Support Group Communications: Messages, posts, reactions, shared files within encrypted support groups.
• Contact Lists / Designated Contacts: Emergency contacts or shared access details for caregivers/clinicians.
• Customer Support Communications: Messages, emails, attachments, or feedback submitted to us.

B. Information Collected Automatically

• Device & Usage Data: IP address, device identifiers, OS/browser type, app version, crash logs, performance metrics, pages/screens viewed, referring URLs, timestamps, and in-app actions.
• Cookies & Similar Technologies: Cookies, SDKs, pixels, local storage (see Section 14).

C. Information From Third Parties

• Wearables & Connected Services: Fitbit, Apple Health, Google Fit, etc., when linked.
• Healthcare Integrations: EHR/EMR systems, telehealth partners, pharmacies—if enabled.
• Analytics / Security Partners: Aggregated/pseudonymized data for analytics or fraud prevention.
• Referral Sources / Marketing Partners: Limited info if you arrive via a campaign or referral.

We process personal data for the following purposes:

• Provide & Improve the Platform: Account management, authentication, journaling, risk scoring, reminders; debugging and performance enhancement.
• AI-Based Risk Assessments & Insights: Analyze data to produce risk scores and insights; refine ML models using de-identified/aggregated data.
• Token (Zen Coins) Program Administration: Track qualifying actions; grant or revoke tokens per rules.
• Crisis Alerts & Notifications: Alert designated contacts/caregivers; deliver reminders and notifications.
• Security & Fraud Prevention: Detect suspicious activity, protect accounts, maintain platform integrity.
• Compliance & Legal Obligations: HIPAA/GDPR/CCPA/PIPEDA compliance; respond to lawful requests; enforce Terms.
• Research & Development (R&D): Conduct studies with de-identified/aggregated data; publish non-identifying insights.
• Marketing & Communications (Limited): Service-related announcements; optional educational or product emails (no selling of personal data).

• Consent (Art. 6(1)(a), Art. 9(2)(a))
• Contract (Art. 6(1)(b))
• Legal Obligation (Art. 6(1)(c))
• Legitimate Interests (Art. 6(1)(f))

We do not sell personal information. We may share with:

• Service Providers / Processors
• Clinicians & Caregivers You Authorize
• Support Group Members (for data you intentionally share)
• Third-Party Integrations (you connect)
• Legal / Safety Exceptions
• Business Transfers (e.g., merger or acquisition)

We also share aggregated or de-identified data for research/analytics.

We retain data as long as needed for the purposes above, or longer if required by law (e.g., HIPAA). When no longer needed, we delete or de-identify it.

• Encryption: AES-256 or equivalent at rest; TLS/HTTPS in transit.
• Access Controls: Role-based, least privilege, audit logs.
• Monitoring & Testing: Reviews, anomaly detection, penetration tests.
• Incident Response: Formal plan for investigation, containment, notification.

No system is 100% secure; use strong passwords and protect your devices.

• Access/Update Account Info
• Manage Data Sharing
• Opt Out of Marketing Emails
• Control Device Permissions
• Request Deletion or Portability

Some core features may require minimal data use; disabling them can limit functionality.

A. United States (CCPA/CPRA, etc.)

• Right to know/access
• Right to delete (with exceptions)
• Right to correct
• Right to limit sensitive data use/disclosure
• Right to opt out of “sale”/“sharing” (we do not sell)
• Right to non-discrimination

Submit requests by [contact method]; we will verify your identity.

B. HIPAA (U.S. Health Information)

If applicable, you may have rights to access/amend PHI and receive an accounting of disclosures. A HIPAA Notice of Privacy Practices will be provided where required.

C. EU/UK/EEA/Swiss (GDPR/UK GDPR)

• Access, rectification, erasure
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

D. Canada (PIPEDA/Provincial Laws)

• Access and correct information
• Withdraw consent (subject to limits)
• Challenge compliance with PIPEDA principles

Exercising Your Rights

Contact us at privacy@zenxguard.com or via the in-app privacy request form.

ZenXGuard is headquartered in [Insert Country/State]. Your data may be processed in countries with different laws. We use safeguards like Standard Contractual Clauses where required.

• Outputs are informational, not diagnoses/treatment plans.
• They may influence alerts/recommendations.
• Models are reviewed to minimize bias/error.

You can request human review of significant automated decisions where required by law.

• Authenticate sessions
• Remember preferences
• Analyze usage

Manage cookies in your browser/device. Disabling may affect functionality. See our [Cookie Policy] if separate.

ZenXGuard Privacy Office
[ZenXGuard]
Email: admin@zenxguard.com

EU/UK users: Contact our DPO (if appointed) at [DPO email/contact]. You may lodge complaints with your local authority.

• “Personal Data” / “Personal Information”: Info about an identified/identifiable individual.
• “Protected Health Information (PHI)”: Health info protected under HIPAA (U.S.).
• “Processing”: Any operation on personal data (collection, storage, use, disclosure, etc.).
• “De-identified Data”: Data that cannot reasonably identify a person.
• “Zen Coins”: Non-monetary, non-transferable tokens earned within the Platform.