Privacy Policy

Introduction

Welcome to XHalo360! Protecting your privacy is really important to us. With this in mind, we're providing this privacy policy (this “Privacy Policy” or “Policy”) to explain our practices regarding the collection, use, and disclosure of information, including health information, that we receive through this Website and our Services. Please note that, unless we define a term in this Privacy Policy, all capitalized terms used in this Privacy Policy have the same meanings as in our Terms of Service. So, please make sure that you have read and understand our Terms of Service.

This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website www.XHalo360.com (our “Website”), and our practices for collecting, using, maintaining, protecting, and disclosing that information. This Privacy Policy does NOT cover the information and data that XHalo360 collects in the performance of the services it provides to its customers, which is covered under a separate agreement between XHalo360 and its customers.

This Policy applies to information we collect:

• On this Website.
• In email, text, and other electronic messages between you and this Website.
• Through mobile and desktop applications you download from this Website or from the Apple App Store or Google Play Store, which provide dedicated non-browser-based interaction between you and this Website or Mobile Application.
• When you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this policy.

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by the Company or any third party (including our affiliates, subsidiaries, or customers); or
• Any third party (including our affiliates, subsidiaries, or customers), including through any application or content (including advertising) that may link to or be accessible from or through the Website.

If you do not agree with our policies and practices, your choice is not to use our Website and Services. By accessing or using this Website and our Services, you agree to this Privacy Policy.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or home address. We (or service providers on our behalf) may then send communications and marketing to these email or home addresses.

Information We Collect

• Personal Information: We may collect personal information such as your name, contact information, and professional credentials when you create an account or use our Service.
• Usage Information: We collect information about your use of the Service, including log data, device information, and usage patterns.
• Health Information: XHalo360  may process health-related data that you provide or that is generated through your use of the Service, strictly in accordance with applicable laws and regulations.
• Cookies and Similar Technologies: We use cookies and similar technologies to collect information about your browsing and interaction with the Service.
• Recommendations: We may use information collected to make automatic, non-diagnostic suggestions or health tracking reminders within the app, which do not constitute medical advice.

How We Use Your Information

• Provide and Improve the Service: We use your information to deliver and enhance the functionality of  XHalo360, personalize your experience, and improve our services.
• Third-Parties: We may share health-related data with healthcare professionals or third-party applications only when you give us explicit authorization to do so.
• Communication: We may contact you with important information about the Service, such as updates, security notices, or support.
• Research and Analytics: We may use your data for research and analytical purposes while ensuring your privacy is protected.
• Compliance: We process personal and health information to comply with legal obligations.

Data Sharing and Disclosure

XHalo360 and MyWellnest are committed to protecting your privacy. We do not sell, rent, or share your personal information, including Protected Health Information (PHI), with third parties for marketing or commercial purposes.

Your information is only used or disclosed in the following limited and compliant circumstances:

Service Operations (HIPAA-Compliant Processing):
Your information may be processed by trusted infrastructure providers (e.g., cloud hosting, messaging delivery, and analytics systems) solely to operate and maintain the platform. All such vendors operate under strict data protection agreements, including Business Associate Agreements (BAAs) where applicable, and are only permitted to use your data on our behalf—not for their own purposes.

Healthcare Communication (User-Directed and Consent-Based):
Your information, including health-related data, is only shared with your selected healthcare provider or care team to facilitate care delivery, appointment coordination, and clinical communication. SMS and other communications are sent only after explicit opt-in consent, and you may opt out at any time.

No Unauthorized Third-Party Access:
We do not provide third parties with access to your personal data or PHI unless you have explicitly authorized it or it is required for your direct care.

Legal and Regulatory Compliance:
We may disclose information only when required to comply with applicable laws, regulations, HIPAA obligations, lawful requests, or to protect the rights, safety, and security of our users, providers, and platform.

Business Transfers (Protected Continuity):
In the event of a merger, acquisition, or restructuring, your data may be transferred strictly for continuity of service. Any successor entity will be required to maintain the same level of privacy protection and comply with all applicable regulations, including HIPAA.

Security of Your Information

We use a combination of physical, technical, and administrative safeguards to protect your personal and health information against unauthorized access, disclosure, alteration and destruction. These measures include data encryption, secure servers, limited access controls, and regular security assessments.

In the event of a data breach that compromises your personal information, we will notify you and any applicable authorities as required by law.

Your Rights and Choices

• You have the right to request access to the personal data we have collected about you.
• You have the right to correct inaccurate or incomplete personal data.
• You have the right to request the deletion of your personal data, subject to certain legal and operational limitations.
• You may withdraw your consent to data processing where we rely on consent as the lawful basis.
• You can adjust your communications and notification preferences within your account settings.

If you want us to delete your Personal Information and your Account (if applicable), please contact us at support@xhalo360.com with your request. We'll take steps to delete your Personal Information as soon as we can, but some information may remain in archived/backup copies for our records or as otherwise required by law.

No Medical or Legal Advice

The information provided through our Website,Desktop and Mobile applications and Services, including any health-related content, Artificial Intelligence (AI) recommendations, analytics, or notifications, is for general informational purposes only and is not intended to constitute or substitute for professional medical advice, diagnosis, treatment, or legal advice.

You should always seek the advice of a qualified healthcare provider or legal professional with any questions you may have regarding a medical condition or legal matter. Never disregard or delay seeking professional advice because of information made available through our Services.

XHalo360 does not offer medical or legal services and does not assume any responsibility for decisions made based on information obtained through the Website or Services.

Consent for AI-Based Processing

We use automated tools, including artificial intelligence (“AI”), to provide non-diagnostic health tracking and suggestions. By downloading the app or using our services, you provide your implied consent to the use of AI tools in connection with your sensitive personal information.

• Personal Information: refers to any data that identifies or can be reasonably linked to an individual.
• Health Information: includes data related to your physical or mental health, such as medications, symptoms, or treatment history.
• Sensitive Personal Information: includes data such as health, biometric, or geolocation data, which we treat with enhanced protections under applicable laws.
• Service: means the software and any related tools, websites, or communications provided by XHalo360.

Mobile Device Data Collection

When you use the XHalo360 mobile app, we may collect certain information automatically, including but not limited to the type of mobile device you use, your device operating system, your device ID, mobile network information, and interactions with the app’s features.

Permissions and Sensor Access

With your permission, the app may access your device’s camera, microphone, or location services to support specific health-tracking or user-experience features. You can disable access at any time through your device settings.

Push Notifications

We may send you push notifications through the mobile app to provide updates, reminders, or health prompts. You may opt out of these communications by adjusting your device notification settings.

In-App Analytics and Crash Reporting

We use mobile analytics tools to better understand how users interact with the mobile application. This includes information such as app usage frequency, performance diagnostics, and crash reports. These tools help us improve the stability and functionality of the app.

Third-Party Health Integrations

If you choose to connect third-party services such as Apple Care, we may receive health-related data including steps, sleep data, heart rate, and other metrics. This data is processed in accordance with this Privacy Policy and is not shared without your explicit authorization.

Third-Party Links and Services

• Our Service may include links to external websites or services that are not governed by this Privacy Policy. We are not responsible for the privacy practices of third-party services, and we encourage you to review their privacy policies before submitting personal data.

Mobile App Log Data

Our mobile app may log technical information including timestamps of activity, feature usage, and error logs. This information is collected to help us diagnose issues and enhance user experience

International Transfer

Please note that your Personal Information may be transferred to, and maintained on, computers located outside of your state, province, country or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction. If you're located outside the United States and choose to provide your PII to us, we may transfer your PII to the United States and process it there.

Authorized Access to Data

Only authorized employees, contractors, and agents who need access to personal data to perform their duties may access such data. All personnel are bound by confidentiality obligations.

Data Retention

We retain your personal and health information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. After this period, we securely delete or anonymize the data.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or technological developments. If we make material changes, we will notify you through the Service or via email. The “Effective Date” at the top of the policy indicates when the most recent changes were made.

SMS Opt-In Consent Language

This text should appear when the patient enters their phone number in the XHalo360 app or intake form.

Example Consent Text

By providing your mobile phone number and selecting this option, you consent to receive SMS messages from XHalo360 related to appointments, care coordination, treatment updates, and account notifications. Message frequency may vary. Message and data rates may apply. Reply STOP to opt out and HELP for assistance.

Important Rules

• Checkbox must not be pre-checked
• Must link to Privacy Policy and Messaging Terms
• Must clearly explain STOP opt-out

Example UI

I agree to receive SMS notifications from XHalo360

SMS Privacy Policy Addendum

SMS Communications

If you opt in to receive SMS messages from XHalo360, we may send you messages related to your healthcare services and account activity.

These messages may include:

• Appointment reminders
• Treatment notifications
• Lab order alerts
• Care coordination updates
• Account verification codes
• Support communications

SMS consent is not shared with third parties or affiliates for marketing purposes.

Standard message and data rates may apply depending on your mobile carrier plan.

Users may opt out of SMS messages at any time by replying STOP.

SMS Help and Opt-Out Messages

Opt-Out Response

When a user replies STOP:

You have successfully unsubscribed from XHalo360 SMS notifications. You will no longer receive messages. Reply START to opt in again.

Help Response

When a user replies HELP:

XHalo360 Messaging Support: For assistance please contact
support@xhalo360.com. Reply STOP to unsubscribe.

Patient Intake SMS Consent (Clinic Use)

For clinics using XHalo360 intake forms:

Consent Statement

I consent to receive SMS messages from my healthcare provider through the XHalo360 platform regarding appointments, care updates, and account notifications. Message frequency may vary. Message and data rates may apply. I understand I may opt out at any time by replying STOP.

Messaging Use Case Description (For Twilio Registration)

Use Case

XHalo360 sends transactional healthcare communications including appointment reminders, care coordination messages, treatment updates, and account notifications between patients and providers.

Messages are triggered by patient activity, provider communication, or system notifications within the XHalo360 platform.

The platform supports two-way messaging allowing patients to respond to providers or clinic staff.

Message Examples (Carriers Require This)

Appointment Reminder

XHalo360: Reminder — Your appointment with Dr. Smith is scheduled for tomorrow at 10:00 AM. Reply C to confirm or call the clinic if you need to reschedule.

Care Coordination Message

XHalo360: Your provider has updated your treatment plan. Please log into your patient app to review the details.

Account Verification

XHalo360: Your verification code is 483921. Do not share this code with anyone.

Consent Audit Log (Recommended System Design)

Your system should store the following information for SMS consent records:

This is required for carrier audits and compliance.

Developer Compliance Rules

For the XHalo360 engineering team:

• All outbound SMS must verify opt-in status
• STOP messages must trigger automatic opt-out
• HELP must return support information
• No marketing messages without separate consent
• Sensitive PHI should be sent via secure messaging when possible

Messaging Frequency Disclosure

All messaging pages should include the following disclosure:

Message frequency varies. Message and data rates may apply.

Website Messaging Disclosure (Required)

Add the following disclosure to your website footer or messaging policy page:

By providing your phone number, you agree to receive SMS messages from XHalo360 related to your healthcare services. Message frequency may vary. Message and data rates may apply. Reply STOP to unsubscribe and HELP for assistance.

Account Deletion

Users of the XHalo360 Patient Mobile Application may request deletion of their account and associated personal information.

XHalo360 accounts are typically created and managed by participating healthcare providers as part of the patient onboarding process. Because these accounts may contain healthcare information and clinical records, account deletion must be requested through one of the following methods:

• Contact your healthcare provider directly
• Email XHalo360 support at privacy@xhalo360.com

Once a deletion request is received and the user's identity is verified, XHalo360 will process the request and delete the user account and associated personal data within 30 days, except where retention is required for medical, legal, billing, or regulatory compliance.

If certain health records must be retained to comply with applicable laws or provider policies, those records will be securely stored and no longer accessible through the XHalo360 mobile application.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at support@xhalo360.com