Privacy Policy for RewardCare

Last Updated: October 7, 2026

Welcome to RewardCare. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, Web3 protocol, and related services. Because RewardCare operates at the intersection of biometric wellness, decentralized finance, and clinical healthcare, we hold your data to the highest standards of security and privacy.

By accessing or using RewardCare, you consent to the data practices described in this policy.

Medical disclaimer: RewardCare and Kai do not diagnose, treat, or replace professional medical care. Information in the app is educational only. Seek a doctor’s advice before making medical decisions. Health sources Kai cites (MedlinePlus, CDC, Mayo Clinic) and the OpenAI permission live in Settings → Health & Safety, not on the city page.

Bank Premium is not offered. There is no paid bank subscription or extra bank benefit.

1. Information We Collect

To power the RewardCare ecosystem, we collect data across four primary pillars: Identity, Biometrics, Finance, and Clinical Healthcare.

Account & Identity Data: When you join the waitlist or create an account, we collect your email address, username, profile picture, and Web3 wallet address (e.g., ENS or 0x address).

Biometric & Health Data: With your explicit permission, we connect to Apple Health (HealthKit) on iPhone and Health Connect on Android. We read steps, calories, active minutes, distance, sleep, heart rate, resting HR, HRV, and workout summaries, and we sync that data to RewardCare servers for wellness tracking and rewards.

Financial & Banking Data: Through our integration with Stripe Financial Connections, we may request access to link your bank account. Depending on your authorized permissions, this allows us to securely collect:

• Account routing and tokenized account numbers (for ACH transfers).
• Current account balances (to verify funds before wager entries).
• Read-only transaction history (to power our in-app budgeting and financial monitoring tools).

Protected Health Information (PHI): If you choose to utilize our Hospital Page and connect your external medical provider portals, we collect, store, and transmit Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). This may include medical records, diagnoses, lab results, and treatment histories retrieved directly from your healthcare providers.

AI Interaction Data: We collect the contents of your messages, journals, and interactions with our dynamic AI avatars to provide personalized coaching and protocol enforcement.

Location

Location Data: With your explicit operating-system permission, RewardCare accesses your device location (precise and approximate / GPS). While you are using the app, location powers nearby restaurant search, RewardCity dining, and Kai answers about nearby places, weather, safety, and travel. When you allow background location, RewardCare keeps Kai location-aware in the background and uploads location fixes to RewardCare servers about every 60 seconds or 100 meters, and records an active Gym GPS Track route when the screen is locked or you leave the app. We do not sell location data, use it for advertising, or use it to determine UBI eligibility or rewards. You can deny or revoke location access in your device settings, turn off Kai Location Awareness in Privacy & Security, or stop an active GPS Track session in the Gym.

2. How We Use Your Information

RewardCare uses your data strictly to operate and improve the protocol and your personal dashboard:

Calculating Algorithmic Yield: We use your synced health data (steps and sleep) from Apple Health and Health Connect to mathematically calculate your daily Universal Basic Income (UBI) multiplier.

Operating Wager Pools: We use your linked financial accounts to process fiat-to-crypto onboarding (USDC) and verify you have sufficient funds before you enter a smart contract wager.

Powering the Budget Engine: We analyze your read-only transaction history to provide you with a personal financial monitoring dashboard.

Dynamic AI Personalization: We feed your current biometric state and wager risk-level into our proprietary AI engine to adjust the tone and urgency of your digital coach.

Location-Aware Features: When enabled, we use authorized location to show nearby restaurants and local context and to keep Kai location-aware in the background. Gym GPS Track records a route while you have started an active workout. Operational dashboards receive only aggregate freshness and error counts, never individual coordinates.

Care Management: We use your PHI strictly to provide you with a consolidated health dashboard and medical tracking features within the isolated Hospital Page.

Community & Social Features: We use your username and basic progress metrics to populate leaderboards and community activity feeds.

3. Medical Data and HIPAA Compliance

RewardCare takes the protection of your medical data with the highest level of severity. When you connect your healthcare provider accounts via our Hospital Page, the data retrieved is classified as Protected Health Information (PHI).

Strict Segregation: Your PHI is mathematically and logically segregated from our UBI protocol and social features. We do not use your medical records, hospital visits, or clinical diagnoses to calculate your yield multiplier, nor do we share this clinical data with Wager Pool participants.

Permitted Uses of PHI: We only use your PHI to provide you with the personal medical tracking features explicitly requested by you.

Business Associate Agreements (BAAs): Where RewardCare acts as a Business Associate to your healthcare provider, we strictly adhere to the data handling, encryption, and audit requirements mandated by our BAAs and federal law.

4. How We Share Your Information

We do not sell your personal data to data brokers or third-party advertisers. We only share information in the following ways:

The Blockchain (Public Ledger): Because RewardCare utilizes decentralized smart contracts, any on-chain actions (such as joining a Wager Pool, getting slashed, or claiming a USDC payout) are permanently and publicly recorded on the blockchain associated with your wallet address. No biometric or clinical data is ever stored on the public blockchain.

Service Providers: We share necessary data with trusted third-party infrastructure partners, including:

• Stripe: For payment processing, identity verification, and financial connections.
• Google Cloud Platform (GCP): For secure database hosting and serverless functions (data is strictly stored in the United States).
• OpenAI: When you allow it in the app, we send your spoken or typed question and the health context you already stored so Kai can reply. We do not send this data until you tap Allow on the in-app permission card. You can revoke this in Privacy & Security.

Other Users: If you participate in Wager Pools or Premium Guilds, your username, profile picture, and challenge progress will be visible to other participants in that specific group.

5. Special Notice Regarding Apple Health and Health Connect

RewardCare respects the highly sensitive nature of your physical data.

• We do not use or share your Apple Health or Health Connect data for advertising, marketing, or use-based data mining.
• Your health data is used solely to provide the core wellness-tracking and yield-calculation features of the app.
• We do not sell your biometric data to third parties under any circumstances.

6. Data Security and Retention

We implement industry-standard security measures, including storing API keys in secure secret managers and utilizing encrypted cloud infrastructure. All PHI is encrypted at rest and in transit using enterprise-grade cryptographic standards compliant with the HIPAA Security Rule. We retain your information only as long as your account is active or as needed to comply with our legal obligations. Financial transactions processed via smart contracts are immutable and cannot be deleted from the blockchain.

7. Your Data Rights & Choices

Under federal law and our platform guidelines, you have the right to:

• Manage Medical Data: Request a copy of your electronic PHI, request corrections, or request an accounting of disclosures.
• Disconnect Financial Accounts: Revoke our access to your bank account at any time via the Stripe interface within our app settings.
• Revoke Health Access: Disable RewardCare’s access to your biometric data directly within your device’s Health settings at any time (Note: this will pause your UBI yield generation).
• Revoke Location Access: Turn off location permission for RewardCare in your device settings, turn off Kai Location Awareness in Privacy & Security, or stop an active Gym GPS Track session.
• Account Deletion: Request full deletion of your off-chain account data and initiate a compliant deletion of your cached PHI from our active servers by contacting our support team.

8. Contact Us

If you have questions about this Privacy Policy, your HIPAA rights, or how we handle your data, please contact our Privacy Officer at privacy@rewardcare.ai.