Version 5.1.1 │ July 2026

IMPORTANT NOTICE: INTERPRETIVE HEALTH’S MOBILE APPLICATION AND SITE (“Nucora”) IS A GENERAL WELLNESS AND FITNESS TOOL. Nucora is designed solely to support general health, fitness, and wellness. Nucora is not a medical device. Nucora, including its Artificial Intelligence (AI) features, does not provide medical advice, diagnosis, cure, mitigation, treatment, monitoring, or prevention of any disease. If you have a medical emergency, call 911 immediately.

1. Introduction

Interpretive Health, LLC (“We,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal and health information (“User Data”) when you use the Nucora mobile application and website. User Data includes personal information such as name, email, health history, wellness goals, diet information, and other personal health information.

Nucora is intended for use only by individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, contact us immediately at support@nucora.ai and we will delete that information.

2. Definitions and Scope

To ensure clarity and compliance with the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and the California AI Transparency Act (SB 942), we use the following definitions:

“Consumer Health Data (CHD)” means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status, including data derived from non-health sources if used to infer health status. Residents of certain states have specific rights regarding Consumer Health Data — see Section 10 and our separate Consumer Health Data Privacy Policy.

“Generative AI System” means the artificial intelligence models used to create Nucora’s AI-generated outputs, including chat responses, deep-dive analyses and Health Blueprint reports, personalized podcast episodes, daily briefings, and related AI analysis features. These systems generate content based on your inputted data.

“Connected-Source Data” means data Nucora receives from the third-party platforms and devices you choose to connect or the documents you choose to upload, as described in Section 3.c.

“Epigenetic Data” means data regarding biological age derived from blood-based DNA methylation analysis, distinct from raw genomic sequence data.

“AI-Generated Content” means any report, podcast, analysis, chat response, briefing, or other output produced by Nucora’s AI systems based on your inputted data, as required to be disclosed under the California AI Transparency Act (SB 942).

3. Data We Collect

We collect the following categories of User Data:

a. Personal Information

  • Name and email address
  • Date of birth, height, weight, and sex (used for reference-range calculations)
  • Ethnicity (a response is required to complete profile setup; a “Prefer not to say” option is available; used to provide context for your personalized analysis)

b. Personal Health and Medical Information

  • Health history and wellness goals, including free-text health background you provide (medical conditions, past surgeries, allergies, stress and wellbeing, family medical history)
  • Personal diet and nutrition information, including lifestyle information you choose to record (such as alcohol, tobacco or nicotine, and other substance use)
  • Supplement intake, from your connected nutrition sources and information you provide
  • DEXA body composition scan results
  • Blood and urine biomarkers
  • Gut microbiome test results
  • Blood-based DNA methylation and biological age data
  • Wearable and device metrics, including activity, sleep, heart rate and heart-rate variability, stress, respiration, pulse ox (SpO2), skin temperature, blood pressure, body composition, and environmental and headphone audio-exposure levels (if your connected source provides them)
  • Reproductive and menstrual health data: menstrual status (collected during profile setup where applicable), menstrual period dates and flow duration you choose to log, and menstrual-cycle data from connected devices — including cycle-day, cycle-phase and fertile-window information and pregnancy status where your device provides them (Nucora does not itself predict fertility, ovulation, or pregnancy). Nucora may also derive cycle-phase estimates from this data to provide cycle-aware features you enable.
  • Information you voluntarily provide in free text, including chat messages, diary entries, symptom logs, notes, background fields, and questions you submit with an analysis. Chat messages are analyzed to maintain your profile and memory within Nucora (for example, supplements, goals, and preferences you mention).

c. Data from Connected Third-Party Platforms and Uploaded Documents

When you choose to connect third-party platforms to Nucora (see Section 4 of the Terms of Use for the full list), we receive data from those platforms. Connected platforms send data to Nucora on an ongoing basis while the connection is active. The data we receive depends on the platform you connect and may include:

  • Apple Health: Activity, workout, sleep, heart rate, audio-exposure, and other health metrics you choose to share from your device
  • Garmin Connect: Activity, sleep, heart rate, stress, body composition, menstrual-cycle tracking, and other wellness metrics — see Section 5.c (“Garmin Connect Data”) for a complete description of how Garmin data is collected, used, processed, stored, and shared
  • Oura: Sleep, readiness, activity, heart rate, and related wellness metrics
  • Withings: Body composition, weight, and related health metrics from Withings devices
  • Google Health (Fitbit): Activity, steps, distance, calories, active minutes, sleep, heart rate and resting heart rate, heart-rate variability, blood oxygen (SpO2), respiratory rate, body temperature, and heart-rhythm notifications from Fitbit and other devices connected to your Google account. Nucora’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use information received from Google APIs for advertising of any kind, and we do not use it to train generalized artificial-intelligence or machine-learning models.
  • Cronometer: Food logs, nutrition data, and dietary intake information
  • Hevy: Weight training logs, exercise history, and workout data

In addition, you may provide data from the following sources by uploading documents or entering results directly:

  • BodySpec (or other DEXA providers): DEXA body composition scan reports you upload
  • Function Health: Blood and urine biomarker reports you upload
  • Blueprint Speed of Aging: Blood-based biological age and DNA methylation reports you upload
  • TinyHealth: Gut microbiome test reports you upload
  • TruDiagnostic: Epigenetic and biological age reports you upload
  • Viome: Gut microbiome results you enter directly in the app

Each of these platforms has its own privacy policy that governs how they collect and handle your data. We encourage you to review the privacy policies of any platforms you connect to Nucora. Once data reaches Nucora, this Privacy Policy governs how we use and protect it.

Please note – a third-party platform may be located outside of the United States and your data may be transmitted outside of the United States. The laws and regulations of the country of the third-party platform govern the privacy of your data located in that country.

We do not sell data received from any connected third-party platform.

d. Usage Data

  • Interactions with AI-powered features (chat, analysis, podcast, briefings, Health Blueprint)
  • Supplement and diet logs
  • User data summaries generated for your use
  • Screens viewed, features used, and app activity, recorded at the account level (see Section 11)
  • Service and request logs generated when the app communicates with our servers (see Section 11)

e. Device and Technical Data

  • Mobile device identifier (IDFV on iOS, ANDROID_ID on Android)
  • Device model, manufacturer, operating system, and version
  • IP address; approximate (city-level) location may be inferred from your IP address by us or by our service providers

f. Epigenetic Data

  • DNA methylation patterns and biological age data as defined in Section 2

g. Connected-Source Data Storage

  • Connected-Source Data (described in Section 3.c above) is stored on Nucora’s infrastructure so that your dashboards, chat, analyses, and reports work across your history. It is retained while the source remains connected and is removed from our active systems when you disconnect the source or delete your account, on the schedule described in Section 9.

4. How We Use Your Data

We use your User Data for the following purposes:

  • To provide AI-generated health analysis, chat responses, daily briefings, personalized podcasts, and Health Blueprint reports based on your inputted data
  • To operate and improve the Nucora platform, including identifying and resolving software errors, improving computational accuracy, and improving the quality of reports, podcasts, and other outputs
  • To recognize when a chat message may indicate a safety crisis and surface crisis-support resources, as required by applicable law
  • To communicate with you about updates, notifications, and service-related matters
  • To generate educational supplements and data summaries for your personal use
  • To comply with applicable laws, including CCPA, CPRA, and other applicable state and federal laws
  • To detect and prevent fraud, unauthorized access, and other illegal activity
  • To enforce our Terms of Use and protect our legal rights
  • To conduct general business analysis and research using aggregated, non-personally-identifiable information

Platform improvement. We use your data to improve Nucora’s platform quality. This includes identifying and resolving bugs in our computational systems, improving the accuracy of our mathematical and analytical algorithms, and improving the quality of reports, podcasts, and other outputs we generate for you. This is internal product improvement, not AI model training. Your data is not used to train any third-party AI models, and Interpretive Health, LLC does not train its own AI models on your data. When your data is used for platform improvement purposes, access is limited to authorized personnel on a need-to-know basis. Administrative changes to user data, and access through our administrative tools, are recorded in an audit log.

5. Data Processing Architecture

a. How Your Data Is Processed

Your User Data is stored on Nucora’s cloud infrastructure, hosted by Amazon Web Services (AWS) in the United States. Data is encrypted at rest using AES-256 encryption via AWS Key Management Service (KMS) or server-side encryption (SSE-S3). Application traffic is served over TLS 1.2 or higher.

Nucora uses proprietary algorithms and artificial intelligence to analyze your data and generate your requested reports, podcasts, and other outputs. As part of this process, your data is transmitted to OpenAI and Google Cloud AI services for AI-powered analysis and content generation. OpenAI processes your data under a business associate agreement with Interpretive Health, LLC and does not use your data to train its models. Chat requests are not stored by OpenAI for application purposes; for asynchronous analyses (such as deep-dive reports), OpenAI temporarily stores processing results so the analysis can complete, and retains them until they expire under OpenAI’s stored-response retention schedule (approximately 30 days) or are deleted earlier. Consistent with OpenAI’s API data-usage policies, OpenAI may also retain API content for up to 30 days for trust-and-safety monitoring, subject to the safeguards of our agreement. Only HIPAA-eligible API services are used for AI data transmission. Google Cloud AI services (text-to-speech, used to produce podcast audio) operate under a data processing addendum and HIPAA business associate agreement with enterprise-grade data protections; Google does not use your data to train its AI models.

b. Third-Party Data Ingestion

When you connect a third-party data source (such as Garmin Connect or Cronometer), data flows from that platform to Nucora’s servers via the platform’s API, including ongoing updates the platform sends while the connection is active. Nucora does not share your data back to those platforms except as necessary to maintain the integration connection. Each third-party platform is an independent data controller responsible for its own data handling practices.

c. Garmin Connect Data

This section describes specifically how we handle data received from Garmin Connect when you choose to connect your Garmin account to Nucora.

What we collect. When you authorize Nucora through Garmin’s consent screen, Garmin sends us the wellness data you have permitted via the Garmin Health API. Depending on your Garmin device and permissions, this may include: daily activity summaries (steps, distance, calories, floors), activity and workout records, sleep data, heart rate and heart-rate variability, stress, respiration, pulse ox (SpO2), skin temperature, blood pressure, body composition (including Garmin Index smart-scale measurements), fitness metrics such as VO2 max and fitness age, health snapshots, menstrual cycle tracking data (if you use that Garmin feature), and related wellness metrics. We receive this data via push notifications from Garmin’s servers; we do not access your Garmin account credentials.

How we use it. Garmin data is used solely to provide Nucora’s features to you: your dashboard and detail screens, trend and recovery analysis, AI-generated health analysis, daily briefings, reports, and podcasts, and cross-source comparisons with your other connected data. Where Garmin data contributes to a display or analysis, Nucora attributes it to Garmin in the user interface. We do not use Garmin data for advertising, we do not sell it, and we do not use it to train AI models (ours or anyone else’s).

How it is processed, including AI processing. Garmin data is processed on Nucora’s cloud infrastructure as described in Section 5.a. Portions of your Garmin data (typically pre-computed summaries and metrics rather than raw device streams) are transmitted to OpenAI and Google Cloud AI services to generate your requested analyses, briefings, reports, and podcasts, under the agreements and safeguards described in Section 5.a. This is the AI transparency statement required by our agreement with Garmin: the nature of the processing is automated analysis and content generation from your own data; its purpose is to produce the outputs you request in the app.

Your consent and how to withdraw it. Connecting Garmin to Nucora is your explicit authorization for this collection and processing — you grant it on Garmin’s own consent screen, and Nucora additionally obtains your in-app consent before its AI features generate content from your data. You can withdraw at any time, easily: you may withdraw AI-processing consent in the app’s Settings (which disables AI-generated features while leaving your data viewable), and you may disconnect Garmin in Nucora’s data-source settings (or revoke Nucora’s access from your Garmin Connect account — Garmin notifies us and we treat it the same as an in-app disconnect). Disconnecting stops all new Garmin data collection immediately.

How it is stored and deleted. Garmin data is stored on AWS infrastructure in the United States, encrypted at rest (AES-256) and in transit (TLS 1.2+), as described in Sections 5.a and 7.b. When you disconnect Garmin (from either side), your Garmin data is removed from Nucora’s active systems and is no longer used in any feature; backup copies are purged on the schedule in Section 9. Account deletion follows the retention timeline in Section 9.

Sharing. Garmin data is shared only with the service providers listed in Section 8.a (cloud hosting and the AI processors described above), under contracts restricting them to providing services to us. We never sell Garmin data, never share it for advertising, and never send your Nucora data back to Garmin except as necessary to maintain the integration connection.

6. AI Transparency Disclosures (California SB 942)

Consistent with the California AI Transparency Act (SB 942), we make the following disclosures:

a. AI-Generated Content

Nucora produces AI-generated reports, podcasts, chat responses, briefings, and analyses. All outputs produced by Nucora’s Generative AI Systems are generated from the data you provide and are identified as AI-generated as described in Section 6.b. These outputs are for educational and informational purposes only and do not constitute medical advice. AI-generated outputs are not a substitute for the services of properly trained and licensed healthcare professionals.

b. How to Identify AI-Generated Content

All Nucora reports, podcast episodes, chat responses, briefings, and analyses are AI-generated. Each visible output is accompanied by an in-app disclosure, accessible with the output, indicating its AI-generated and informational nature. Personalized podcast episodes additionally include an audible AI-generation disclaimer at the beginning of each episode.

Before Nucora’s AI features generate content from your data, you provide explicit in-app consent. You can withdraw this consent at any time in the app’s Settings, which disables AI-generated features in your account while leaving your data stored and viewable.

For questions about how Nucora’s AI systems work or how AI-generated content was produced, contact us at support@nucora.ai.

7. Data Security and Privacy Standards

a. Regulatory Status

Interpretive Health, LLC is not a HIPAA Covered Entity, and Nucora is not subject to the HIPAA Privacy Rule or Security Rule. However, we recognize that the health and wellness data you entrust to us deserves strong protection regardless of regulatory classification. We have adopted security and privacy practices consistent with HIPAA standards and contractually require the service providers that process your health and wellness data to do the same.

b. Security Measures

We implement the following security measures to protect your User Data:

  • Encryption at rest: User data is encrypted at rest using AES-256 encryption via AWS Key Management Service (KMS) or server-side encryption (SSE-S3)
  • Encryption in transit: Application traffic is served over TLS 1.2 or higher
  • Infrastructure security: We implement AWS security measures including Virtual Private Cloud (VPC) isolation, subnets, security groups and network access controls, and monitoring via CloudTrail and CloudWatch
  • Access controls: Access to your data is limited to authorized employees, contractors, and service providers who need it to perform their functions, on a need-to-know basis
  • Vendor security requirements: All service providers that process your health and wellness data operate under agreements that require security safeguards consistent with or exceeding HIPAA standards, including Amazon Web Services (cloud infrastructure and email delivery), OpenAI (AI analysis, under business associate agreement with HIPAA-eligible services), Google Cloud AI services (podcast audio generation, under data processing addendum and HIPAA business associate agreement), Google Workspace (support communications), and Cronometer (food and nutrition log data, under HIPAA business associate agreement). Service providers that support app operations and are not sent your health records or measurements — payment processing, push-notification delivery, and crash and error reporting — receive only the limited operational and diagnostic data described in Section 8.a and operate under their standard data protection agreements.

c. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities after becoming aware of the breach, in accordance with applicable laws. Notification will be provided via your registered email address or in-app notification. Because we rely on third-party service providers for certain infrastructure and processing functions, the time required to detect and investigate a breach may vary depending on when our service providers notify us.

d. Your Responsibility

You are responsible for maintaining the confidentiality of your login credentials. We are not liable for unauthorized account access resulting from your failure to protect your credentials. USERS ASSUME ALL RESPONSIBILITY FOR ANY LOSS OF PRIVACY OR OTHER HARM RESULTING FROM THEIR VOLUNTARY DISCLOSURE OF PERSONALLY IDENTIFYING INFORMATION.

8. Sharing Your Information

We do not sell your personal information. We may share your User Data in the following limited circumstances:

a. Third-Party Service Providers

We share data with authorized service providers who perform services on our behalf, including:

  • OpenAI — AI analysis and content generation (under a business associate agreement; OpenAI does not train on your data; chat requests are not stored for application purposes, and asynchronous analysis results and trust-and-safety logs are retained by OpenAI only temporarily, as described in Section 5.a)
  • Google Cloud AI services — podcast audio generation via text-to-speech (under data processing addendum and HIPAA business associate agreement; Google does not use your data to train its AI models)
  • Amazon Web Services (AWS) — Cloud infrastructure, data storage, and delivery of service emails (under HIPAA business associate agreement with encryption and audit requirements)
  • Google Workspace — Support email communications (under HIPAA business associate agreement)
  • Cronometer — Food and nutrition log data integration (under HIPAA business associate agreement)
  • Stripe — Payment processing for paid subscriptions (receives your name, email address, and subscription status; payment card details are entered on Stripe-hosted pages and are not received or stored by Nucora)
  • OneSignal — Push notification delivery (receives device identifiers, push tokens, IP address, an account identifier used for addressing, and notification text; notification content is limited to generic prompts and status messages — your health information is never included in notifications)
  • Sentry (Functional Software, Inc.) — Crash and error reporting and app diagnostics (receives device information, IP address, app logs, crash data, user-submitted feedback, and sampled screen-interaction recordings in which text and images are masked by default)

To enrich nutrition data, we may also look up food and supplement product names — without your identity — against public government databases (such as the NIH Dietary Supplement Label Database and the USDA FoodData Central).

Providers that process your health and wellness data are contractually prohibited from using it for any purpose other than providing services to us or as required by law. The operational providers identified above process the limited data described under their own agreements and privacy notices.

b. Aggregated and De-Identified Data

We may share aggregated, de-identified information that cannot reasonably identify you with third parties, including advisors and investors, for general business analysis, research, and platform development.

We may disclose User Data when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, prevent fraud, or protect the safety of our users or the public.

d. Business Transfers

In the event of a merger, acquisition, or sale of assets, your User Data may be transferred to the successor organization. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

We may share your information for other purposes with your explicit consent.

Nucora includes an in-app “Store” of curated products, and nucora.ai may also contain product links. Some of these are affiliate links. If you click an affiliate link and make a purchase, we may earn a commission from the merchant or affiliate network, at no additional cost to you. Affiliate revenue helps support Nucora. An affiliate link is something you choose to click; it takes you to a third-party website, and we do not disclose your User Data to these networks in order to place the link.

Affiliate networks and partners. We participate in affiliate programs including the Amazon Associates Program and CJ Affiliate (Commission Junction), including for partners such as Naked Nutrition, and we have direct affiliate relationships with certain of our data-source partners, including Viome, Function Health, Blueprint, and TinyHealth. As an Amazon Associate, we earn from qualifying purchases.

What is and isn’t shared. Affiliate links do not transmit your health or wellness data, or your Nucora account information, to the merchant or network. The outbound link carries only an affiliate tracking token that identifies Nucora, not you, as the referring source, so that a resulting purchase can be attributed for commission. When you click an affiliate link and are taken to a third-party site, that site and its affiliate network may set cookies in your browser and receive standard click information (such as the fact that a visitor was referred from Nucora and, in some cases, which product was viewed) in order to attribute the purchase. In particular, CJ Affiliate uses tracking technologies and cookies to record referrals; you can learn more about, and opt out of, CJ’s tracking through the opt-out described in CJ Affiliate’s privacy notice.

Their policies govern. Once you leave Nucora by clicking an affiliate link, the destination merchant and affiliate network collect and use data under their own privacy policies, not this one. We encourage you to review the privacy policies of Amazon, CJ Affiliate, and any merchant you buy from. We do not control, and are not responsible for, the data practices of these third parties.

Not medical advice; not an endorsement. Products in the Store or reached through affiliate links are selected editorially and are not personalized to your health or wellness data, biomarkers, or analyses. An affiliate link is not medical advice, a diagnosis, a treatment recommendation, or a determination by Nucora that a product is right for you. Consult a qualified healthcare provider about any product or change to your health routine.

No sale of your information. We do not sell your personal information, and we do not share your health or wellness data with affiliate networks. Earning a commission when you choose to make a purchase is not a sale of your data.

9. Data Retention

We retain your User Data for as long as your account is active or as needed to provide services. Specifically:

  • Active account data is retained for the duration of your account
  • Data from a connected source is retained while the source remains connected; when you disconnect a source, its data is removed from our active systems and is no longer used in any feature
  • When you delete your account, your account is closed immediately and your data is removed from use in all features; deletion of your data from our active systems is completed within 30 days
  • Backup copies are purged automatically as backups rotate, no later than 90 days after deletion from active systems, and in any event within the timelines required by applicable law; operational database snapshots are reviewed and deleted on the same 90-day schedule
  • Reports and other outputs previously generated for you remain available in your account after you disconnect a source, and are deleted with your account
  • We retain limited categories of records after account deletion where required by law or for legitimate business purposes: security and audit logs (including records of consent and administrative access), subscription and billing records (including records retained by our payment processor), and operational service logs and records of our AI-service requests and app usage, used for security, fraud prevention, and service integrity (see Section 11)
  • Aggregated, de-identified insights that cannot reasonably be linked back to you may be retained indefinitely
  • Data transmitted to OpenAI for AI analysis is handled as described in Section 5.a (never used for training; retained by OpenAI only temporarily, for processing and trust-and-safety purposes)

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your User Data:

a. California Residents (CCPA/CPRA)

California residents have the following rights:

  • Right to Know: You may request information about the categories and specific pieces of personal information we collect, use, and disclose.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions permitted by law.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive personal information, including health data, to purposes necessary to provide the services you requested.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

b. Consumer Health Data — Washington, Nevada, Connecticut, Virginia, and Other States

Nearly all data Nucora collects is Consumer Health Data. If you reside in Washington or Nevada, or your Consumer Health Data is collected there, you have specific rights — including the rights to confirm, access, and delete your Consumer Health Data (including from backups, on the statutory schedule), to withdraw consent, and to appeal a refusal — described in our separate Consumer Health Data Privacy Policy, linked in the footer of nucora.ai and in the app. Connecticut residents’ health data is sensitive data under the Connecticut Data Privacy Act and is collected and processed only with your consent; you may access, correct, delete, and obtain a copy of your data and appeal a refusal. We collect and disclose reproductive or sexual health information only with your consent, as required by Virginia law. We do not sell Consumer Health Data.

c. Residents of Other States

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, and others) may have similar rights to access, delete, correct, and opt out of certain uses of their personal data under applicable state law. Contact us at the information in Section 13 to submit a request; we will respond in accordance with the law applicable to your location.

d. How to Exercise Your Rights

To exercise any of these rights, contact us at support@nucora.ai or through your account settings. We will respond to verified requests within 45 days. We may extend this period by an additional 45 days where necessary, in which case we will notify you of the extension within the initial 45-day period. We may need to verify your identity before processing your request. If we decline to act on your request, you may appeal our decision by replying to our response or emailing support@nucora.ai with “Appeal” in the subject line; we will respond to appeals in writing within 45 days.

11. Mobile Device, Analytics, and Service Logs

  • Device Identifiers: We collect a standard mobile device identifier (IDFV on iOS, ANDROID_ID on Android) to secure your account and manage device sessions. Our push-notification provider assigns its own device and subscription identifiers to deliver notifications.
  • Location: We do not access or track precise location information from your mobile device. We collect your IP address when the app communicates with our servers; approximate (city-level) location may be inferred from it by us or by our service providers.
  • Push Notifications: We send push notifications for service-related matters if you opt in, delivered through OneSignal (see Section 8.a). Notification content is limited to generic prompts and status messages and never includes your health information. You may disable push notifications in your device settings. The app may also receive silent, content-free notifications used to keep your data in sync. Our push provider receives device and account identifiers when the app starts, even if you do not enable push notifications.
  • Biometric Unlock: If you enable biometric unlock (such as Face ID or fingerprint), verification is performed entirely on your device by its operating system. Nucora never receives or stores biometric data.
  • Usage Analytics: We collect first-party usage analytics — such as screens viewed, features used, and app activity — recorded at the account level on our own infrastructure. We use this information to understand how Nucora is used, improve the product, and diagnose issues. We do not use third-party analytics or advertising SDKs in the Nucora app, and we do not share your usage data with third-party analytics providers. Crash and error reporting is provided by Sentry as described in Section 8.a.
  • Affiliate Link Cookies: When you tap an affiliate link in the Store or on nucora.ai, you are taken to a third-party website, and that website and its affiliate network may set their own cookies in your browser to attribute a resulting purchase, as described in Section 8.f. These cookies are set by the third party after you leave Nucora, not by tracking technology embedded in the Nucora app.
  • Service Logs: Our servers keep request logs — including IP address, device and browser information, and the content of requests to our services — for security, fraud prevention, debugging, and service integrity. These logs are retained as described in Section 9.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the app and by email to your registered address. The date of the most recent revision appears at the top of this document. Continued use of Nucora after changes constitutes acceptance of the updated policy.

13. Contact

For questions about this Privacy Policy, to exercise your privacy rights, or to submit a data deletion request:

Interpretive Health, LLC

c/o Northwest Registered Agent Service Inc.

2108 N St, Ste N, Sacramento, CA 95816

Email: support@nucora.ai

Nucora.ai provides a contact form for submitting privacy rights requests.

Effective Date: 2026-07-15 │ © 2026 Interpretive Health, LLC

Request Beta Access