Privacy Policy

What this covers

Nari is a remote therapeutic monitoring platform. Clinicians use it to follow how their patients are doing between appointments. This policy describes what we collect about patients who are enrolled by their clinician, and about the clinicians who use the platform.

Your clinician or their practice decides what to monitor and remains responsible for your clinical record. We hold the data on their behalf.

What we collect

What you tell us

Account details: your name, email address, date of birth, phone number and time zone.
Questionnaire answers, including validated instruments such as the PHQ-9, GAD-7, PCL-5, EPDS, AUDIT, WSAS, MDQ and C-SSRS, and questionnaires your clinician writes themselves.
Daily check-ins: mood, energy, stress, cravings, loneliness, isolation and social drainage.
Things you write: journal entries, reasons a dose was missed, notes on a safety check-in.
Substance use and craving logs, where your clinician monitors these.
Meals, sleep, physical activity and social activity that you record yourself.
Your medications, and whether you took them.

What your phone collects, if you allow it

Every item here depends on a permission you grant on your own device, and you can withdraw any of them in your phone settings at any time.

Steps, active minutes and workouts, through Apple Health or Health Connect.
Sleep timing and sleep stages.
Location. We use it to work out the places you regularly spend time and how much you moved on a given day. We store the places as your own private list, not as a continuous record of where you have been.
Screen on and off events, and battery level.
How long you spend in categories of app, such as messaging or social media.
Movement from your phone’s motion sensor.
Communication activity: whether a call or message happened, in which direction, how long it lasted and roughly how long a message was.
Nearby Bluetooth devices and Wi-Fi networks, as a way of telling whether you were somewhere familiar or around other people. We never see a network or device name.

What we never collect from your phone. We do not collect the content of your messages or calls, and we never see who you contacted. Contact identifiers, Bluetooth devices and Wi-Fi networks are converted into scrambled values before they are stored, so we can tell that the same contact or place recurs without being able to tell who or where it is. We do not read your photos, your email, or the contents of other apps.

What connected devices send, if you connect them

If you connect a wearable such as an Oura ring, we receive only the categories you authorize when you connect it, and only for as long as the connection lasts. Disconnecting stops any new data reaching us. We never send your information back to the device maker, and we do not use these connections to obtain anything beyond what you approved.

What comes from your care

Appointments, treatment goals, and interventions your clinician assigns.
Notes your clinician writes, and the sessions they record for billing.
Pharmacy dispensing records, where those are available to your practice.
Insurance and billing records relating to your monitoring.

How we use it

To show your clinician how you are doing, to highlight changes from your own usual patterns, and to support the billing your practice submits for monitoring your care. That is the whole purpose. We do not use your information to make decisions about you by ourselves, and nothing the platform surfaces is a diagnosis.

Things we do not do

We do not sell your information. Not to anyone, in any form, ever.
We do not use it for advertising, and we do not allow advertising on the platform.
We do not feed anything you write into an artificial intelligence language model. Your journal entries and free text are read by your care team and by nobody and nothing else.
We do not share your information with your employer, your insurer beyond the claim your practice submits, or your family, unless you ask us to.

Who can see your information

Your clinician.
Other members of your care team, where your clinician has granted them access. You can see who has access, that access can be withdrawn, and every time your record is opened it is logged.
A small number of Nari staff, where it is necessary to operate or repair the service. This is logged in the same way.
Service providers who host and run the platform for us, under contracts that restrict them to that purpose.
Anyone else you explicitly ask us to share with, and no one else, except where the law requires it.

Substance use records

If your care includes treatment for substance use, records relating to it may be protected by United States federal law at 42 CFR Part 2, which is stricter than ordinary medical privacy rules. Where that applies, those records are not disclosed without your written authorization or a court order, they may not be used against you in legal proceedings on the basis of a general medical release, and anyone who receives them is bound by the same restriction. Your clinician will ask for a separate consent covering this.

Safety information

If you tell the platform about thoughts of suicide or self-harm, that goes to your clinician promptly and is treated as urgent. It is not suppressed, delayed or weighed against anything else.

Nobody is watching in real time. Nari is not an emergency service and no one monitors it overnight or around the clock. If you are in danger, call 988 in the United States, or your local emergency number.

How long we keep it

Your information is part of a clinical record, and how long your practice must keep that record is set by the law where they operate, typically several years after your last appointment. We keep it for as long as your practice requires and then delete it. Raw sensor readings, such as individual location points, are kept for a shorter period than the daily summaries derived from them.

Your choices

You can ask to see everything we hold about you.
You can ask us to correct anything that is wrong.
You can withdraw your consent to monitoring at any time. Your care does not depend on agreeing to it.
You can revoke any device permission, or disconnect a wearable, without withdrawing from monitoring entirely.
You can ask for your information to be deleted, subject to the record-keeping your practice is legally required to maintain.

Security

Information is encrypted in transit and at rest, access is restricted to those who need it, and every access to a patient record is written to an audit log that cannot be quietly altered. No system is perfectly secure, and we will tell you and your clinician promptly if we ever believe your information has been exposed.

Children

Nari is used under the direction of a clinician. Where a patient is a minor, their parent or guardian consents on their behalf according to the law where the practice operates.

Changes to this policy

We will update this page when what we collect changes, and the effective date at the top will change with it. Where a change materially affects what we collect or who can see it, we will tell you rather than relying on you noticing.

Contact

Questions about this policy, or about your information, go to dev@nari-health.com.