Your health data should work for you.

Scope & definitions

This Privacy Policy describes FOURD's principles for personal information processed through FOURD websites, digital services, and future products that expressly link to or adopt this policy. Product-specific notices, consent flows, research documentation, contracts, or jurisdiction-specific disclosures may provide additional or different terms and will control where required by applicable law.

Personal Data / Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an identifiable individual or household, as defined by applicable law. Sensitive Personal Data may include health, genetic, biometric, precise geolocation, government identifiers, account credentials, and other categories treated as sensitive under applicable law. Consumer Health Data means health-related information within the scope of applicable consumer-health privacy laws.

Collection, minimization & purpose limitation

FOURD's policy is to collect and process information that is adequate, relevant, and reasonably necessary for specified and legitimate purposes. We intend to disclose material purposes at or before collection when required and not to further process identifiable information for a materially incompatible purpose without an appropriate legal basis and, where required, additional consent.

Processing, consent & user choice

Where applicable law requires a legal basis for processing, FOURD will rely on an appropriate basis for the relevant activity. Where consent is the basis, FOURD intends consent to be specific, informed, unambiguous where applicable, and capable of prospective withdrawal, subject to legal obligations and processing already lawfully completed. FOURD's consent design is intended to support comprehension, voluntariness, and continuing choice; ordinary consumer consent is not represented as clinical-research informed consent.

Rights

Depending on residence, product, and applicable law, individuals may have rights to know or access personal information; obtain a copy; correct inaccuracies; delete information; withdraw consent; restrict certain processing; opt out of sale, sharing, profiling, or targeted advertising; obtain portability; appeal certain decisions; or lodge a complaint with a regulator. FOURD will provide mechanisms required by applicable law and may need to verify identity before fulfilling certain requests.

Security, retention & de-identification

FOURD uses administrative, technical, and organizational safeguards designed to be reasonable and appropriate to the nature and sensitivity of the information processed. No security measure can guarantee absolute security. Identifiable data is intended to be retained only for as long as reasonably necessary for the disclosed purpose, requested service, legitimate business records, dispute resolution, enforcement, or legal, regulatory, tax, accounting, security, or compliance obligations. When data is represented as de-identified or anonymous, FOURD will apply measures appropriate to the context to reduce reasonable re-identification risk.

Third parties & disclosures

FOURD may disclose limited information to service providers, processors, contractors, professional advisers, infrastructure or security providers, or other parties when reasonably necessary for the requested service, legal compliance, protection of rights or safety, corporate transactions, or another disclosed lawful purpose. Such disclosure is not intended to grant unrestricted reuse rights.

Policy changes

FOURD may update this policy as products, technology, data practices, or legal obligations evolve. Material changes will be communicated as required by applicable law. Where a change introduces a materially new optional use for which consent is required, publication of an updated policy alone will not substitute for required consent or authorization.

The Data Value Charter is an additional FOURD commitment layered on top of privacy. For this Charter, Core Processing means processing reasonably necessary to provide, personalize, maintain, secure, support, or comply with legal obligations relating to a service the user requested. Optional Secondary Use means a use not reasonably necessary to provide that service, particularly a use intended to create unrelated commercial, advertising, external research, model-training, licensing, brokerage, or compensated-disclosure value.

1. You start private

• Private by default. Optional secondary commercial sharing or monetization begins off by default. Silence, inactivity, a pre-checked box, or use of a core service is not treated as consent to unrelated monetization.
• Core processing serves the requested purpose. FOURD may process information reasonably necessary to provide requested features, personalize the requested experience, secure and maintain the service, prevent fraud or abuse, comply with law, or create appropriately de-identified or aggregate outputs.
• No hidden tracking. FOURD will not intentionally use undisclosed advertising cookies, tracking pixels, cross-site or cross-app identifiers, SDKs, device fingerprinting, or comparable technologies to secretly profile users for advertising, data brokerage, or unrelated monetization. Strictly necessary technologies may still be used to operate and secure the service.
• No silent secondary market. FOURD does not intend to sell personal profiles to data brokers or use sensitive health information for hidden cross-context behavioral advertising.

2. You choose

• Specific, informed, voluntary choice. Optional uses should be described before consent in reasonably clear language, including relevant data categories, purpose, recipient or recipient category, expected user benefit, and how permission may be changed or withdrawn where applicable.
• A new purpose means a new question. Permission for one purpose does not automatically authorize a materially different purpose. Where additional permission is required by law or this Charter, FOURD will seek it before the new use begins.
• Tiered participation stays separate. Future data-participation levels will be presented distinctly; choosing one level will not be treated as consent to a higher level.

3. You participate in the value created

When optional participation creates meaningful analytical or commercial value beyond delivering the requested service, FOURD's policy is that participating users should participate in the value created. Depending on the program, that participation may be recognized through personal analytics, capabilities, access, economic participation, monetary or revenue sharing, or another disclosed benefit. The applicable program will describe the nature and terms of that benefit. The Data Value Charter does not promise any particular form, amount, percentage, or allocation of value unless expressly stated for that program.

Access to or receipt of the underlying FOURD service will not, by itself, be treated as the value provided for an optional secondary use unless that relationship is expressly disclosed as part of the applicable participation program.

4. You can see the exchange

• Data Ledger. As supported by the relevant product, FOURD's goal is to maintain an understandable record of material permissions, withdrawals, data categories shared, purposes, recipient categories, and the benefit provided through the applicable value-participation program.
• Restrictions travel with the data. Authorized recipients should receive only information reasonably necessary for the authorized purpose and be subject to appropriate confidentiality, security, purpose, retention, deletion, and reuse restrictions.
• AI and model use is bounded. Personal data may be processed to provide analytics or intelligence requested by the user. FOURD will not use identifiable personal or consumer-health data to train unrelated general-purpose models for third parties, or for materially unrelated purposes, without an appropriate disclosed basis and any required permission.
• De-identification should mean not reasonably linkable. When FOURD represents data as de-identified or anonymous, it will apply measures appropriate to the context to reduce reasonable re-identification risk and will not intentionally attempt to re-identify such data except where permitted by law for security, validation, or compliance purposes.
• Accountability follows the promise. FOURD will maintain governance appropriate to the sensitivity of the data, update practices as products, risks, and law evolve, and provide legally required incident or breach notifications.

Legal interaction

For purposes of this Charter, FOURD may use terms such as sale, sharing, and monetization more broadly than some statutes, including licensing, data brokerage, cross-context behavioral advertising, external commercial model training, compensated disclosure, or other secondary exploitation of identifiable personal or consumer-health data. This broader policy definition does not alter the narrower or different definitions that may apply under particular law.FOURD will honor legally recognized opt-out preference signals where required and obtain separate authorizations where required by applicable law.