Version 1.0. Effective: September 9, 2026
This policy explains how Noor Health Inc. handles consumer health data. The beta is open only to California residents, so it is written to California law, including the CMIA, the CPRA, and California's health data protections. It controls over our Privacy Policy for health data. Noor is a consumer app not covered by HIPAA; these laws exist precisely for services like ours.
We hold ourselves to the strictest consumer-health-data standard in use in the United States, so these protections apply to anyone who uses Noor, wherever they turn out to be.
1. What counts as consumer health data
Information linked to you that identifies your health status, including:
Your care sub-stage (fertility, pregnancy, or postpartum);
Your age range and neighbourhood, in combination with health context;
Your reviews, qualifier answers, care stage, and any shout-out you add;
Your Care Team and logged appointments, which can show you sought care from a specific practitioner;
Anything identifying your attempt to seek care, or inferences drawn from the above.
We do not collect biometric, genetic, precise-location, or prescription data, and we do not use geofencing. If that ever changes, we will obtain any required consent first.
2. Collection and consent
We collect consumer health data only from you, and only after your opt-in consent: a clear, separate, un-ticked affirmative choice that is freely given, specific, informed, and voluntary, never bundled into the Terms. This data is necessary to provide the service you are requesting: Noor's core function is matching you with the experiences of similar women by care stage, age range, and neighbourhood, and it cannot operate without them. Consenting to this collection is therefore required to become a member; if you decline, you cannot use member features, and nothing is collected. During the beta we also require the separate model-development consent described in Section 5, presented as its own distinct choice and withdrawable at any time without losing your account. Marketing email is never a condition of membership, and adding a shout-out is always your choice. Reviews, Care Team saves, and appointments are affirmative actions you take, with notice at each moment. You can withdraw consent anytime in settings; withdrawal stops future collection and use, and because Noor cannot work without this data, it means member features stop working.
3. How we use it
Only to:
Provide the features you use: search, peer signal, Care Team, and reminders;
Build anonymous aggregate peer signal, expressed only as counts and averages;
Curate shout-outs: our team reads each submission in a restricted queue and, under the consent you gave at onboarding, may feature only an anonymized version we write;
Keep Noor safe and lawful;
Improve the Services in aggregate or de-identified form.
Never for marketing or advertising, never into analytics or advertising pipelines, and never for model training or data products without your separate opt-in (Section 5).
4. How we disclose it
We do not sell it, share it for advertising, or give it to any third party for its own use. We disclose it only:
To processors under contract: Supabase and Vercel, plus Brevo for reminders that pair a practitioner with your masked account;
To other members as aggregate peer signal, and, under your onboarding consent, as featured shout-outs: anonymized versions we write, deleted with your account;
To comply with law or protect safety, on a good-faith basis;
With your separate authorization. Anything beyond the above, including any sharing or sale, requires a separate, specific, revocable authorization.
5. Model training and free text
Health data goes into model development or data products only with your separate opt-in consent, given as its own distinct, un-ticked choice. During the beta this consent is required to join, because improving how Noor matches women to practitioners is part of what the beta is building. You can withdraw it anytime in Settings and keep using Noor. If a materially different use emerges we will ask again, because consent must stay specific.
The one free-text field is the optional shout-out of about 200 characters, shipped after legal review. Its handling is part of the collection consent you give at onboarding, and adding one is always your choice: typing and submitting is the affirmative act, and an empty box collects nothing. It is write-only, read by our team by hand, never published automatically, and featured only as an anonymized version we write. It is deleted with your account, including any featured version.
Any broader open-text feature would require its own separate opt-in and guidance before launch.
6. Your rights
Confirm and access your health data and who received it; delete it (aggregate contributions may persist as described in our Terms); withdraw consent; and appeal a denial. We will not discriminate against you for exercising rights. Contact hello@noorhealth.co or use settings.
7. Security and breach notice
Row-level protections limiting each member to her own data, encryption in transit, least-privilege and restricted personnel access, and health data kept out of logs. Breaches are reported as required, including under the FTC Health Breach Notification Rule and state law.
8. California and residency
Health data is sensitive personal information under the CPRA, with limits on its use; we comply with the CMIA where it applies and align with California's health data protections.
The beta is limited to California residents and we take reasonable steps to keep it that way. If you use Noor from another state anyway, the protections in this policy still apply to you, and where your own state gives you a greater right, that right applies.
9. Changes
Updates will be posted with a new date. No new consent-requiring collection, use, or disclosure of health data begins without your consent or authorization.
10. Contact
Consumer health data requests: hello@noorhealth.co
Noor Health Inc., 3126 South Sepulveda Boulevard, Suite 305, Los Angeles, CA 90034, US
