Privacy Policy

A. Information you provide directly

B. Practitioner information

If you are a Practitioner or Clinic, we may collect:

C. Connected services

With your authorization, we may receive information from:

D. Automatically collected data

We collect:

A. Provide and personalize Services

• —Generate meal plans and protocols
• —Provide AI-powered recommendations
• —Support practitioner workflows
• —Facilitate patient adherence tracking
• —Integrate third-party services

B. Improve and develop the platform

• —Conduct analytics
• —Improve personalization systems
• —Train and refine AI systems (see Section 7)

C. Communicate

• —Send service-related messages
• —Provide onboarding support
• —Send educational or marketing content (you may opt out)

D. Protect and comply

• —Detect fraud or misuse
• —Enforce agreements
• —Comply with legal obligations

A. Direct AI users (no practitioner)

If you use the Tera Health Coach app or other consumer-facing services independently (no practitioner):

• —Tera acts as a data controller.
• —Your data is processed under consumer privacy laws.
• —Health information is treated as personal wellness information, not as medical records.

B. Patients using Tera under a practitioner

If you use Tera Patient Copilot under supervision of a healthcare provider:

• —Your health information may constitute Protected Health Information (PHI).
• —Tera may act as a Business Associate under HIPAA pursuant to a Business Associate Agreement (BAA) with your provider.
• —Your provider's Notice of Privacy Practices may apply.
• —Tera processes PHI on behalf of your provider.
• —We do not make independent clinical decisions regarding your care.

C. Practitioners and clinics

If you use TeraPro:

• —Tera acts as a service provider or processor.
• —If you are a Covered Entity under HIPAA, Tera may act as your Business Associate.
• —You are responsible for obtaining appropriate patient consents.

D. Enterprise Customers

If you are an Enterprise Customer integrating Tera AI Clinical Modules into your platform via APIs or SDKs:

• —Tera typically acts as a processor or sub-processor on your behalf.
• —Data flows, data ownership, and processing roles are governed by the enterprise services agreement and applicable Data Processing Agreement (DPA).
• —Where PHI is involved, use and disclosure are governed by the Business Associate Agreement (BAA) between Tera and you, and applicable law.
• —You are responsible for the legal basis for processing your end users' data and for providing any required notices or obtaining any required consents from those users.

We may share information with:

• —Cloud hosting and infrastructure providers
• —Analytics providers
• —Payment processors
• —Retail or fulfillment partners
• —Lab or health data partners (with authorization)
• —Corporate affiliates or acquirers
• —Legal authorities where required

• —Certain health information may be PHI.
• —Tera safeguards PHI in accordance with HIPAA requirements.
• —Use and disclosure of PHI is governed by the BAA and applicable law.
• —You may have additional rights under your provider's Notice of Privacy Practices.

We may use:

• —Aggregated data
• —De-identified data
• —Usage analytics

• —While your account is active
• —As required by law
• —As required under HIPAA obligations
• —As specified in enterprise agreements

• —Encryption in transit and at rest
• —Access controls
• —Audit logging
• —Administrative safeguards

• —Access your information
• —Correct inaccuracies
• —Request deletion
• —Opt out of marketing
• —Restrict certain processing
• —Request data portability