Consumer Health Data Privacy Policy

• Recnovo is a recording and transcription app. We do not ask for health information, but it can appear in what you record — for example when you record your own doctor’s appointment.
• We use it only to provide the features you ask for. We do not sell it, use it for advertising, or analyse your content to infer your health.
• Cloud storage, transcription and AI features stay off until you give a separate consent, which you can withdraw at any time in Settings.
• Recnovo is not a service for health care providers. Our Terms (Article 18) prohibit using it as, or for, a HIPAA covered entity or business associate.

We collect consumer health data only as part of content you create:

• health information that you or other people say in a recording — symptoms, conditions, diagnoses, medications, treatments or appointments, for example;
• the transcript of that recording, and the AI output made from it at your request (summaries, organized notes, translations, answers and study materials), which may restate that information;
• health information in text or documents you import or type in;
• information in the recording that could be read as relating to health, such as a mention of a visit to a clinic.

We do not collect your location, contacts or calendar, and we do not collect health information from any other source — no wearables, health apps, data brokers or advertising networks.

From you, when you record, import or type content; from other people who speak in a recording you make; and from our processors, which generate transcripts and AI output from your content at your request.

• to store your content encrypted and sync it between your devices;
• to transcribe it and, when you ask, to produce AI output and answer searches over it;
• to keep the service secure and to comply with the law.

We do not use it to train our AI models, to profile you, to target advertising, or for any purpose you have not asked for.

Recording on your own device does not send the recording to us. Before your recordings, transcripts or notes reach our servers or processors — for cloud storage, transcription or AI features — the app and the web app ask for a separate Consent to the Processing of Sensitive Information. Until you give it, “AI features” stay off and that content is not uploaded for storage or processing. One thing works independently of that switch: a credit-funded cloud search sends the query you type for processing, so a query is processed even if it mentions your health. You can withdraw the consent at any time in Settings or by writing to hello@recnovo.com; “AI features” then turn off, and you can also ask us to delete the content.

Your consent covers you. If other people’s health information is in a recording, you are responsible for having their consent to record and process it.

We do not sell consumer health data. We disclose it only to the processors below, which handle it on our instructions and only to provide the Service. We have no affiliates that receive it.

• Eleven Labs Inc. — speech recognition and, if used, speaker separation: receives the recording’s audio and returns the transcript.
• OpenAI, L.L.C. — AI text processing and search indexing: receives the text of transcripts and questions, never audio.
• Anthropic, PBC — AI Studio (slides and quizzes): receives text only.
• Supabase Pte. Ltd. — storage and sync: receives only content that has already been encrypted on your device.

What each of them keeps, and for how long, is in the Processors table of our Privacy Policy. Apart from these processors, the only people who can see your content are those you choose to send a share link to. We disclose information to authorities only when the law requires it.

• In your library: until you delete the recording (then 30 days in the trash) or your account (then a 7-day grace period). Our backups roll over after 7 days.
• At the speech-recognition provider: once we have received and saved the transcript, we ask the provider to delete it, and we ask again for anything remaining when you delete your account. A copy may remain in the provider’s backups for up to about 30 days after deletion.
• At the AI text providers: up to about 30 days for abuse monitoring, then deleted (longer for a request they flag under their usage policies).

You have the right to:

• confirm whether we collect, share or sell your consumer health data (we never sell it), and access it;
• get a list of the third parties and affiliates it has been shared with, and how to contact them — the processors above;
• withdraw your consent;
• have it deleted — in the app (delete a recording, empty the trash, or delete your account) or by asking us. When we delete it, we also ask the speech-recognition processor to delete its transcript record; the other processors keep request data only for the periods listed in our Privacy Policy, after which it is deleted.

To make a request, use Settings in the app or web app, or email hello@recnovo.com with “Health data request” in the subject. We verify requests from the email address on the account and respond within 45 days (extendable once by 45 days, with notice). If we decline, we tell you why, and you can appeal as described in the United States section of our Privacy Policy. If your appeal is denied, you may contact your state’s Attorney General. We will not treat you differently for exercising these rights.

You can write to us even if you do not use Recnovo. Stored recordings are encrypted on the account holder’s device and we do not read them, so we cannot search for you in them. If you tell us which recording or share link is involved, we will pass your request to the account holder, disable a share link that exposes you, and handle a deletion request as the law requires.

Recnovo Inc. (주식회사 레크노보), Room Ga-846, 8F, 191, Dongbaekjungang-ro, Giheung-gu, Yongin-si, Gyeonggi-do, 17006, South Korea · hello@recnovo.com. If we change this policy materially, we will tell you in the app or by email at least 7 days before the change takes effect, and ask for your consent again where the law requires it.