Consumer Health Data Privacy Policy

This policy applies where Washington, Nevada, Connecticut or another applicable consumer health-data law protects your data. These laws can apply regardless of business size. Their coverage includes qualifying residents and individuals whose consumer health data is collected in those states. This policy explains which consumer health data FilesPal may process, why, and how you exercise your rights. Our general Privacy Policy describes everything else.

Each law’s definition of “consumer” and its exclusions apply. Washington covers individuals acting in an individual or household context and excludes an employment context. Nevada covers qualifying individuals who have requested a product or service from a regulated entity; it excludes individuals acting in an employment context or as an agent of a governmental entity.

Which consumer health data we may process

FilesPal does not ask for health information. Documents, email and scans submitted to the service may contain it, however, and so may questions, voice commands and support messages. Examples are medical bills, explanations of benefits, insurance cards, prescriptions and letters from doctors. This can include information about past, present or future physical or mental health, treatments, medications and health insurance. Results generated by requested features may also contain or infer health information.

Why and how we use it

We use consumer health data only to provide the service you ask for. This includes requested document features, delivery services and answers to support requests. Document features include answers, filing and name suggestions, search by meaning, document comparisons and translations, reminders such as due dates, voice input and read-aloud. Please do not send documents containing health data to our support email address. If you do, we use them only to answer your request and retain them under the email periods below.

Before the app first transfers document content to our server or an AI provider, we require explicit consent for sensitive-data processing. It also covers emails sent to your inbox address and emails filed from Outlook. The app does not ask for consent for phone scans: they are end-to-end encrypted, and our server cannot read their content. This is consent to collection of consumer health data and includes processing by our processors. We disclose consumer health data only to our processors and only to provide the service you request. Under Washington law, these processor disclosures are not sharing. Nevada law permits them without a separate sharing consent where they are necessary for a service the consumer requested. Consent does not override a legal prohibition or a requirement to limit processing to what is necessary. Where the GDPR applies, we rely on Art. 6(1)(b) for your own data and Art. 9(2)(a) for your explicit consent to special-category processing. For other people’s personal data in your documents, the Art. 6 basis is Art. 6(1)(f): your interest in managing your documents and our interest in providing the requested service. Safeguards include no own use of the content, no training through our document-AI provider accounts and the stated deletion periods.

Your consent covers your own data and data for which you may legally give consent as an authorized representative. It does not automatically cover another person mentioned in a document or message. For another person’s special-category data, you need a valid legal basis, such as that person’s explicit consent or lawful representation. The Art. 6 legitimate-interest basis alone does not satisfy Art. 9. Applicable U.S. consent requirements also concern the person whose health data is involved.

For services we provide directly, we meet the duties of a regulated entity where applicable. For content processed on a Business customer’s behalf, we act as its processor under the Data Processing Agreement. The Business customer determines and documents the applicable legal basis and any required consent. A managed company policy can authorize cloud processing without the app’s personal consent checkbox; that is not evidence of the affected people’s consent. We process Business content on the customer’s lawful instructions and help it meet its obligations.

The app records sensitive-data consent locally and sends proof to our server. A grant that cannot be recorded does not enable cloud mode. Pending proof is retried at startup and during maintenance. Withdrawal stops content transfers even if saving the withdrawal fails; in that case the app displays a warning. The server records the installation ID, consent version, grant or withdrawal, server receipt time and an optional event ID for duplicate detection. App consent evidence is kept for three years after the end of the calendar year in which consent was withdrawn or the processing relying on it ended, then deleted. Locally the app stores, for each decision, the version, grant or withdrawal, time, event ID and whether the server confirmed it. If the app sends the time of your decision, the server stores it as well. For each version the server keeps the wording, purpose and scope of the consent unchanged. The app asks during setup and under Settings › “How AI works” with its own checkbox, which is not pre-ticked, before content first goes to our server or an AI provider, an inbox address is set up or Outlook is connected. The wording is: “I consent to FilesPal and its AI service providers processing health and other sensitive information in my documents, voice recordings and emails (sent to my forwarding address or from the Outlook add-in) in the cloud for the AI features I use, such as filing, answers, dictation and email intake.” The app does not ask for phone scans, because they are end-to-end encrypted and our server cannot read them. To withdraw, untick the box at the same place.

Your original documents and search index are stored locally. In Fast mode, cloud features send the text, metadata or audio needed for the feature to AI processors. Naming may include example file names even when “Learn filing style” is off; that switch is on by default and controls separate style adaptation. Our AI proxy forwards requests and returns results. It can keep answer text in an in-memory cache and store batch results. Cache reuse lasts up to ten minutes. Expired entries are removed no later than eleven minutes after they expire. Local batch results are deleted 24 hours after delivery, otherwise seven days after completion; provider deletion is requested at the same time. Providers may retain copies under the endpoint and configuration schedule in Annex 2 of our DPA. A provider’s general retention policy does not remove your applicable deletion rights.

Optional phone scans, inbox delivery and Outlook delivery use our server in either AI mode. The phone-scan protocol and Outlook submissions use encrypted envelopes. The phone browser encrypts each page before upload (ECDH P-256, HKDF-SHA256, AES-GCM); the Outlook add-in encrypts with the app's inbox key before sending. The private keys exist only in the app on the target device: for scans in the memory of the window, for the inbox encrypted with Windows data protection in its settings. Incoming email is parsed in memory and encrypted with your device’s public key before the mail pipe writes its item file. If delivery fails, plaintext may remain in the mail server’s queue for at most 72 hours, then is deleted. Fetching an inbox item does not delete it; an explicit deletion request or expiry does. Scan access expires after 29 minutes and deletion occurs within 30 minutes. Inbox and Outlook item access expires seven days minus one minute after acceptance and deletion occurs within seven days. Cleanup runs at least every 60 seconds. Associated metadata, mail-delivery queues and backups have separate periods in the service retention schedule.

We have never sold personal information, including consumer health data, or shared it for cross-context behavioral advertising. We do not use cross-context behavioral advertising or health data for advertising. We do not set up geofences around places where health care is provided. Sensitive personal information is used only to provide the service you ask for.

Sources

Sources include users and their devices, senders of incoming email, organizations submitting authorized content, and people contacting support. We also process information generated in response to requested features, such as answers, document metadata, transcripts and summaries.

Sharing

All recipients of document content under our provider accounts are our processors. We disclose relevant content to them only to provide the requested service on our instructions. These disclosures can include the health-data categories described above. Under Washington law, they are not sharing. Nevada law permits them without a separate sharing consent where they are necessary for a service the consumer requested. We do not disclose consumer health data to our affiliates. Germany and the EEA are adequate destinations under UK law. Transfers from the UK to recipients in the USA rely on the UK Extension to the EU-U.S. Data Privacy Framework where the recipient is certified, otherwise on the UK Addendum to the standard contractual clauses in the recipient’s data processing agreement.

• Anthropic Ireland, Limited, Ireland – processor under its incorporated DPA for document-AI text and batch processing. The server configuration sets the routes; the routes in operation follow. Naming, full analysis, answers, comparisons and general help use Anthropic first on the fast route, after OpenAI on the best route and first on the economy route. The assistant uses the fast route. Search rewriting uses only Anthropic; translation uses Anthropic, then OpenAI. Processing takes place in the USA and other countries of its sub-processors, with standard contractual clauses for transfers. Its commercial terms prohibit training on Customer Content. Ordinary API inputs and outputs are deleted within 30 days; flagged content can be retained for up to two years and trust-and-safety scores for up to seven years, with longer retention where required by law. We send no feedback data.
• OpenAI Ireland Ltd, Ireland – processor under its API DPA for text, checking, transcription, embeddings and read-aloud. For naming, full analysis, answers, comparisons and general help, OpenAI follows Anthropic on the fast and economy routes and comes first on the best route. The assistant uses OpenAI if Anthropic fails. Answer and folder checks use only an OpenAI decision model through Chat Completions. Finished recordings go to its transcription API if Mistral AI fails, streamed speech to its realtime API. Whether speech is streamed is set by the server configuration. If streaming does not start or breaks off, the app sends the whole recording once as a finished recording. Embeddings and read-aloud use OpenAI only. Recordings are transcribed by Mistral AI in the EU first and by OpenAI if that fails; streamed transcription uses OpenAI only. Processing takes place in the USA and other countries of its sub-processors; our account has no EU data residency. Transfers rely on standard contractual clauses or an applicable adequacy decision, including the EU-U.S. Data Privacy Framework. We have not opted in to training. Neither our service nor the app sets a storage field for responses. Retention varies by endpoint, as set out in the AI retention schedule. The listed text, embedding, speech and realtime services have abuse-log periods of up to 30 days. The recording-transcription API has no abuse logs or stored state. Legal and harm-prevention exceptions apply. All routes, fallbacks and batch rules are set out in Annex 2 of the DPA.
• Mistral AI SAS, 15 rue des Halles, 75001 Paris, France – processor for speech recognition of finished recordings (Voxtral Small) under its DPA effective July 27, 2026. Mistral receives the audio, the language and the recognition context. Processing takes place through Mistral’s EU endpoint in data centers in the EU and EFTA countries; transfers outside the EEA require an adequacy decision or standard contractual clauses. Mistral keeps inputs and outputs for 30 days for abuse monitoring; zero data retention is not activated. Our training opt-out is enabled, and we use no preview or Labs models, to which it does not apply.
• Contabo GmbH, Welfenstrasse 22, 81541 Munich, Germany – processor hosting the FilesPal service, including its document-inbox mail delivery, in its data center in St. Louis, Missouri, USA, under our data processing agreement with the EU Standard Contractual Clauses. Retention follows the service retention schedule. Our ordinary @filespal.com mailboxes and outgoing service mail use netcup, as described below.
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – our previous hosting provider, processor under our data processing agreement. Until that contract ends, it still stores a copy of service data from before the move in its data center in Nuremberg, Germany.

Support email: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, processes our email under a data processing agreement. Its mail server is in Nuremberg, Germany. Outgoing FilesPal service mails use info@filespal.com as sender. Incoming mail to our @filespal.com addresses, including support messages, is stored in our netcup mailbox. Ordinary email is kept for at most three years after the end of the year in which the matter was concluded. Email that is a commercial letter is kept for six years under section 257 HGB. We ask you not to email documents containing health data. If you do, we use them only to answer and keep them under these email periods.

Backups: Cloudflare, Inc., USA, is our processor for encrypted main-service database and configuration backups in an R2 bucket with EU jurisdiction. Its incorporated DPA includes standard contractual clauses, and it is certified under the EU-U.S. Data Privacy Framework. Cloudflare has no encryption key. These backups can contain health information in stored results or free-text submissions, and related registration, consent, delivery and contractual identifiers. Under the documented default paths, they do not include original desktop documents, scan image files, the separate mailbox database, encrypted mail items or system logs. Local service copies are kept for 14 days and R2 copies for 30 days from creation. There are no monthly copies and no backup is older than 31 days. Deleted data remains in these copies until expiry. Backups are used only to recover from failures. Deletions and consent withdrawals are recorded outside them and re-applied, with all deletion periods, before the restored FilesPal service goes online. The nightly job saves only the service database, the service configuration and a copy of the deletion log, encrypted the same way and kept for the same periods. Creating and checking a backup produces temporary unencrypted working files, which the regular run removes. If they remain after a crash, the next run removes them once the process that created them has ended or they are older than 24 hours; the retention check runs hourly. Encryption does not remove a deletion obligation.

Third-party collection across services: optional app usage measurement requires a separate opt-in. Its random installation identifier is created only after consent. Withdrawal deletes it; a new identifier is created only after renewed consent. Reports contain that identifier, date, app and Windows versions, language, plan, feature counts and optional numeric quality counts. The report fields contain no document content, file names, email, license key or Windows machine identifier. The random identifier still links reports. Raw reports are deleted after 30 days; totals are kept for 13 months without an installation identifier. These pages reference a FilesPal-hosted font, icon, stylesheet and main script, and use browser storage for the selected display theme. We use no external fonts, scripts, images, check services such as Turnstile or analytics; the only exception are the Outlook add-in pages, which load Microsoft's Office library from appsforoffice.microsoft.com, so Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, receives the IP address and request. Besides the theme setting, your browser stores only the “lang” cookie for one year if you choose a language. No embedded third-party service collects consumer health data on these pages.

Your control

In Private mode, AI and speech recognition run on your computer. They can work offline after the required components are installed. Personal cloud AI requires the app’s consent setting and is disabled in Private mode or when your organization requires Private mode. These controls also apply when you use your own AI provider key. A managed Business policy can authorize cloud processing without the personal checkbox; the Business customer remains responsible for the required legal basis.

Selecting Private mode stops cloud AI. Optional phone scans, inbox delivery and Outlook delivery can use our server independently of AI mode. Withdrawing sensitive-data consent in the app stops all transfers relying on it at once, including inbox and Outlook transfers and queued work, and ends open phone-scan sessions. Mode, consent and company-policy changes stop affected later and in-flight transfers. Work queued under an earlier authorization is not resumed after re-enabling or restarting. You can also exclude individual folders from cloud AI. You disconnect an Outlook connection in the app with “Disconnect”. If you close the scan window, the app discards the session key; the session ends after 29 minutes at the latest. Withdrawing consent also ends the inbox address and all Outlook connections. You can ask for removal of a device by email to info@filespal.com.

You may withdraw consent in the app through Settings › “How AI works” (untick the box) or by emailing info@filespal.com with the subject “Health data request”. The app setting takes effect at once. We record an emailed withdrawal like a withdrawal in the app and confirm it. When a withdrawal arrives, our server blocks the functions based on it at once and aborts running speech transfers. A durable deletion job then ends phone-scan sessions, open AI batches, the inbox address with waiting emails and all Outlook connections; it is repeated until it succeeds. If it fails for 12 hours, the operator is alerted. You can also use that address to ask us to stop an optional delivery feature. A request or consent withdrawal is available even if you have no app account or device with us. Withdrawal does not affect the lawfulness of completed processing and cannot retract data already received by a provider. We then delete data that depends on that consent without undue delay. Copies that our AI providers keep for abuse monitoring are deleted automatically within 30 days. You may also request deletion of other data.

We notify you before material changes as described under Changes to this policy.

Your rights

We currently meet none of the thresholds of the CCPA or other comprehensive U.S. state privacy laws: our revenue and consumer numbers are below the applicable thresholds, and we do not buy, sell or share personal information. We voluntarily offer the rights listed here to all U.S. users, by email to info@filespal.com, in addition to rights required by applicable consumer health-data laws. You may:

• confirm whether we collect, share or sell your consumer health data;
• access it and obtain the required list of specific third parties and affiliates with which it has been shared, together with the contact details required by law;
• have it deleted, including by the relevant processors and other recipients;
• withdraw consent to collection or any sharing and request that the affected processing stop.

You may also request review and correction of your consumer health data by emailing info@filespal.com with the subject “Health data request”. Use the same address to exercise the other rights described here. We use verification proportionate to the request and the information we hold. We ask for additional information only when necessary and do not require you to create an account.

We check the relevant systems and processors when responding to your request. This includes queued encrypted items, support email, retained provider copies and backups. We provide access and carry out deletion as required by law, instruct the relevant processors and other recipients, and explain any applicable legal exception. A provider’s standard retention policy is not, by itself, such an exception.

We respond within one calendar month and no later than 30 days after receipt. We explain any legally permitted extension and its reasons within that period. Nevada deletion requests are completed within 30 days after authentication. An extension of the response period does not override an earlier deletion deadline. Requests are free.

Washington deletion requests and notifications to recipients follow Washington’s statutory deadlines. Any legally permitted deferral for deletion from archives or backups ends no later than six months after authentication of the deletion request. Any shorter retention or deletion period promised for the affected records still applies.

If we decline your request, you can appeal by replying to our decision with the subject “Appeal”, or by emailing info@filespal.com with that subject. We decide within 45 days after receiving the appeal, or sooner if applicable law requires, and explain our reasons in writing. If we deny your appeal, our response includes the applicable attorney general’s complaint link or other required contact mechanism.

Changes to this policy

We maintain dated versions and review this policy at least annually. We notify you in the app or by email before a material change takes effect. Before materially different processing begins, we provide any required notice and obtain any consent required by law. This includes required consent for new health-data categories, recipients or purposes. Posting or notifying a change does not substitute for that consent.

Contact

Umbolement UG (haftungsbeschränkt), Ulmenweg 10, 85221 Dachau, Germany. Email: info@filespal.com

Effective date: October 14, 2026. Last updated: November 6, 2026