Privacy Policy for RewardCare

Last Updated: August 23, 2026

Welcome to RewardCare. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, Web3 protocol, and related services. Because RewardCare operates at the intersection of biometric wellness, decentralized finance, and clinical healthcare, we hold your data to the highest standards of security and privacy.

By accessing or using RewardCare, you consent to the data practices described in this policy.

1. Information We Collect

To power the RewardCare ecosystem, we collect data across four primary pillars: Identity, Biometrics, Finance, and Clinical Healthcare.

Account & Identity Data: When you join the waitlist or create an account, we collect your email address, username, profile picture, and Web3 wallet address (e.g., ENS or 0x address).

Biometric & Health Data: With your explicit permission, we connect to health APIs (such as Apple HealthKit and Android Health Connect) to read specific physical data, including daily step counts, sleep duration, heart rate, and recorded stress levels.

Financial & Banking Data: Through our integration with Stripe Financial Connections, we may request access to link your bank account. Depending on your authorized permissions, this allows us to securely collect:

• Account routing and tokenized account numbers (for ACH transfers).
• Current account balances (to verify funds before wager entries).
• Read-only transaction history (to power our in-app budgeting and financial monitoring tools).

Protected Health Information (PHI): If you choose to utilize our Hospital Page and connect your external medical provider portals, we collect, store, and transmit Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). This may include medical records, diagnoses, lab results, and treatment histories retrieved directly from your healthcare providers.

AI Interaction Data: We collect the contents of your messages, journals, and interactions with our dynamic AI avatars to provide personalized coaching and protocol enforcement.

Location Data: With your explicit operating-system permission, RewardCare accesses your device location (precise and approximate / GPS). While you are using the app, location powers nearby restaurant search, RewardCity dining, and Kai answers about nearby places, weather, safety, and travel. If you start Gym GPS Track, RewardCare also uses background location and a location foreground service so your run, walk, or cycle route keeps recording when the screen is locked or you leave the app. We do not sell location data, use it for advertising, or use it to determine UBI eligibility or rewards. You can deny or revoke location access in your device settings at any time, and you can stop an active GPS Track session in the Gym.

2. How We Use Your Information

RewardCare uses your data strictly to operate and improve the protocol and your personal dashboard:

Calculating Algorithmic Yield: We use your HealthKit data (steps, sleep, stress) to mathematically calculate your daily Universal Basic Income (UBI) multiplier.

Operating Wager Pools: We use your linked financial accounts to process fiat-to-crypto onboarding (USDC) and verify you have sufficient funds before you enter a smart contract wager.

Powering the Budget Engine: We analyze your read-only transaction history to provide you with a personal financial monitoring dashboard.

Dynamic AI Personalization: We feed your current biometric state and wager risk-level into our proprietary AI engine to adjust the tone and urgency of your digital coach.

Location-Aware Features: When enabled, we use authorized location to show nearby restaurants and local context. Gym GPS Track uses background location only while you have started an active workout route. Operational dashboards receive only aggregate freshness and error counts, never individual coordinates.

Care Management: We use your PHI strictly to provide you with a consolidated health dashboard and medical tracking features within the isolated Hospital Page.

Community & Social Features: We use your username and basic progress metrics to populate leaderboards and community activity feeds.

3. Medical Data and HIPAA Compliance

RewardCare takes the protection of your medical data with the highest level of severity. When you connect your healthcare provider accounts via our Hospital Page, the data retrieved is classified as Protected Health Information (PHI).

Strict Segregation: Your PHI is mathematically and logically segregated from our UBI protocol and social features. We do not use your medical records, hospital visits, or clinical diagnoses to calculate your yield multiplier, nor do we share this clinical data with Wager Pool participants.

Permitted Uses of PHI: We only use your PHI to provide you with the personal medical tracking features explicitly requested by you.

Business Associate Agreements (BAAs): Where RewardCare acts as a Business Associate to your healthcare provider, we strictly adhere to the data handling, encryption, and audit requirements mandated by our BAAs and federal law.

4. How We Share Your Information

We do not sell your personal data to data brokers or third-party advertisers. We only share information in the following ways:

The Blockchain (Public Ledger): Because RewardCare utilizes decentralized smart contracts, any on-chain actions (such as joining a Wager Pool, getting slashed, or claiming a USDC payout) are permanently and publicly recorded on the blockchain associated with your wallet address. No biometric or clinical data is ever stored on the public blockchain.

Service Providers: We share necessary data with trusted third-party infrastructure partners, including:

• Stripe: For payment processing, identity verification, and financial connections.
• Google Cloud Platform (GCP): For secure database hosting and serverless functions (data is strictly stored in the United States).
• AI Providers: For processing chat interactions.

Other Users: If you participate in Wager Pools or Premium Guilds, your username, profile picture, and challenge progress will be visible to other participants in that specific group.

5. Special Notice Regarding Apple HealthKit Data

RewardCare respects the highly sensitive nature of your physical data.

• We do not use or share your Apple HealthKit data for advertising, marketing, or use-based data mining.
• Your health data is used solely to provide the core wellness-tracking and yield-calculation features of the app.
• We do not sell your biometric data to third parties under any circumstances.

6. Data Security and Retention

We implement industry-standard security measures, including storing API keys in secure secret managers and utilizing encrypted cloud infrastructure. All PHI is encrypted at rest and in transit using enterprise-grade cryptographic standards compliant with the HIPAA Security Rule. We retain your information only as long as your account is active or as needed to comply with our legal obligations. Financial transactions processed via smart contracts are immutable and cannot be deleted from the blockchain.

7. Your Data Rights & Choices

Under federal law and our platform guidelines, you have the right to:

• Manage Medical Data: Request a copy of your electronic PHI, request corrections, or request an accounting of disclosures.
• Disconnect Financial Accounts: Revoke our access to your bank account at any time via the Stripe interface within our app settings.
• Revoke Health Access: Disable RewardCare’s access to your biometric data directly within your device’s Health settings at any time (Note: this will pause your UBI yield generation).
• Revoke Location Access: Turn off location permission for RewardCare in your device settings, or stop an active Gym GPS Track session. Background location is used only for Gym GPS Track.
• Account Deletion: Request full deletion of your off-chain account data and initiate a compliant deletion of your cached PHI from our active servers by contacting our support team.

8. Contact Us

If you have questions about this Privacy Policy, your HIPAA rights, or how we handle your data, please contact our Privacy Officer at privacy@rewardcare.ai.