Legal

Privacy Policy

Last updated

1. Who we are

Rox is an AI health companion app for people living with invisible chronic conditions. Rox is operated by Edden Internet Private Limited ("Rox," "we," "us," or "our"), located at F 1321 Rajhans Synfonia, Abhwa Chowk, Vesu, Surat 395007, India. This Privacy Policy explains how we collect, use, share, and protect your information when you use the Rox mobile app, our website at talktorox.com, and related services (together, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. An important note on health and HIPAA

Rox is a consumer wellness and support tool. It is not a medical provider, health plan, or healthcare clearinghouse, so Rox is not a "covered entity" under HIPAA and the information you share with us is generally not protected by HIPAA.

That does not mean your data is unprotected. We treat the health information you share as sensitive, and our handling of it is governed by this Policy and by laws such as the FTC Health Breach Notification Rule and state consumer health data laws. Rox does not provide medical advice, diagnosis, or treatment. See our Terms of Service for the full medical disclaimer.

3. Information we collect

Information you give us directly

  • Account information. Name or display name, email address, password, and similar details you provide when you create an account.

  • Conversations with Rox. The messages, check-ins, and content you share in your conversations with the Rox companion. Because Rox is built for people with chronic conditions, these conversations often include health information you choose to share, such as symptoms, conditions (for example POTS, ME/CFS, fibromyalgia, or Long COVID), how you are feeling, medications, sleep, and daily activity.

  • Health and wellness inputs. Information you log or describe about your health, energy, pacing, flares, and recovery.

  • Support and communications. Information you provide when you contact us for support, give feedback, or respond to surveys.

Information from connected devices (only if you choose to connect them)

  • Wearable and device data. If you connect a device or platform such as Apple Health (HealthKit), Apple Watch, or Oura, we receive the specific metrics you authorize, which may include heart rate, heart rate variability, sleep, readiness, body temperature trends, steps, and activity. When you connect Oura, we receive this data from your Oura account through Oura's API after you sign in and grant permission. We only access this data with your explicit permission, and you can revoke access at any time in your device settings or by disconnecting the integration in the app.

Information we collect automatically

  • Usage data. How you interact with the Service, features used, session length, and similar analytics.

  • Device and technical data. Device type, operating system, app version, language settings, and a unique device or installation identifier.

  • Diagnostic data. Crash logs and performance data that help us keep the app working.

Information from payments

  • Subscription information. If you subscribe, your purchase is processed through the Apple App Store. We receive confirmation of your subscription status. We do not receive or store your full payment card number.

4. How we use your information

We use your information to:

  • Provide the core Service, including powering your conversations with the Rox companion and personalizing its responses to you.

  • Generate features such as pacing insights and recovery scoring based on what you share and any device data you connect.

  • Remember context across your conversations so Rox can be more helpful over time.

  • Maintain, secure, debug, and improve the Service.

  • Respond to your support requests and communicate with you about the Service.

  • Send you service messages and, where permitted and with any required consent, product updates you can opt out of.

  • Comply with legal obligations and enforce our Terms of Service.

A note on AI model training. We do not use the content of your conversations to train foundation models, and we use our AI providers under terms that prohibit them from using your content to train their models. We do not use your health information to build advertising profiles.

5. How your information is processed by AI and third parties

Rox uses third-party AI providers to process your conversations and generate responses. When you message Rox, the content of that message is sent to our AI provider(s) to produce a reply. We work with providers under agreements that require them to protect your data and to act only on our instructions. Our AI providers are Anthropic, PBC (Claude), OpenAI, LLC (a subsidiary of OpenAI Group PBC), and Google LLC (Gemini).

We also rely on other service providers ("subprocessors") to run the Service, such as:

  • Cloud hosting and storage: Amazon Web Services, Inc. (AWS), Google LLC (Google Cloud), and Supabase, Inc.

  • Authentication: Firebase Authentication, a service of Google LLC

  • Payments and subscription management: Apple App Store

We may add or change subprocessors as the Service evolves, and we will update this list when we do. These providers may access your information only as needed to perform services for us and are bound by confidentiality and data protection obligations.

6. How we share your information

We do not sell your personal information, and we do not share your health information with third parties for their own advertising. We share information only as described here:

  • With service providers who process data on our behalf, as listed above.

  • For legal reasons, when required by law, subpoena, or government request, or to protect the rights, safety, and security of our users, the public, or Rox.

  • In a business transfer, such as a merger, acquisition, or sale of assets, in which case we will require the recipient to honor the commitments in this Policy and will notify you of any material change.

  • With your direction or consent, when you ask us to share information or agree to a specific sharing activity.

7. Health and device data we treat with extra care

Apple Health (HealthKit) data. If you connect HealthKit, we will not use HealthKit data for advertising or marketing, will not sell it, and will not share it with data brokers or with any third party for their own purposes. We use HealthKit data only to provide features inside Rox that you have asked for, consistent with Apple's requirements.

Data from Oura. If you connect Oura, we treat the data we receive the same way. We use it only to provide the features you have asked for, and we do not use it for advertising, sell it, or share it with data brokers.

Consumer health data. We treat the health information you share, including inferences we draw about your health, as sensitive consumer health data. We collect and use it to provide the Service you requested. We will obtain your separate, opt-in consent before collecting or sharing this data for any purpose beyond providing the Service, and we will never sell it. Washington residents and others can read more in our separate Consumer Health Data Privacy Policy linked on our homepage.

8. Data retention

We keep your information for as long as your account exists. We retain your data until you delete your account. After you delete your account, we delete or de-identify your personal information within 30 days, except where we are required to keep limited records to comply with law, resolve disputes, or enforce our agreements. Backups containing your data are purged on a rolling cycle within six months.

9. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and least-privilege access for staff. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting your unsecured health information, we will notify you and the relevant authorities as required by law.

10. Your privacy rights and choices

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you and request a copy.

  • Correct inaccurate information.

  • Delete your information.

  • Withdraw consent you previously gave, including for health data and connected devices.

  • Opt out of certain processing, and obtain a list of the categories of third parties and the specific affiliates with whom we have shared your consumer health data.

  • Appeal a decision we make about your request.

To exercise any of these rights, email us at founders@talktorox.com or use the in-app controls. You can delete your account directly in the app, or by emailing founders@talktorox.com. We will respond within the time required by law, generally 45 days. We will not require you to create a new account to exercise your rights, and we will not discriminate against you for exercising them.

You can also disconnect any wearable or HealthKit integration at any time through your device settings, and you can turn off optional notifications in the app.

11. California residents

If you are a California resident, you have rights under the CCPA/CPRA, including the rights to know, delete, correct, and limit the use of sensitive personal information. We do not sell or share your personal information as those terms are defined under California law. To make a request, contact us at founders@talktorox.com. You may use an authorized agent to submit a request on your behalf.

12. Washington, Nevada, and other state health data laws

Because Rox collects consumer health data, additional rights and protections may apply to you under laws such as the Washington My Health My Data Act and similar state laws. These are addressed in our separate Consumer Health Data Privacy Policy, which is linked on our homepage and within the app.

13. Age requirement

Rox is intended for people aged 16 and older. We do not knowingly collect personal information from anyone under 16. If you are between 16 and 18, or under the age of majority where you live, you should review this Policy with a parent or guardian. If you believe someone under 16 has provided us with information, contact us at founders@talktorox.com and we will delete it.

14. International users and data location

Rox is operated by Edden Internet Private Limited, a company based in India, and is offered to users in the United States. Your information is processed and stored by our providers in data centers located in the United States and potentially other regions where those providers operate, and it is accessed and managed by our team in India. By using the Service, you understand and consent to your information being transferred to, processed in, and accessed from both the United States and India, and you authorize this transfer. We protect your information consistent with this Policy wherever it is processed.

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the app or by email and update the "Last updated" date above. If a change involves collecting or sharing your health data in a new way, we will obtain your consent first.

16. Contact us

Questions about this Policy or your information? Contact us at:

Edden Internet Private Limited F 1321 Rajhans Synfonia, Abhwa Chowk, Vesu, Surat 395007, India founders@talktorox.com