Version 1.0. Effective: September 9, 2026
This policy explains how Noor Health Inc. ("Noor," "we") handles your personal data. Read it with our Consumer Health Data Privacy Policy, which controls for health data. The beta is open only to California residents aged 18 or older in the Los Angeles area.
1. What we collect
From you directly:
Account data: your email and any display name.
Health data (opt-in, required to join): your care sub-stage, age range, and neighbourhood, collected only after your opt-in consent. Noor's matching cannot work without this data, so consenting to its collection is required for membership; declining means not joining, and nothing is collected. During the beta, the separate model-development consent described below is also required to join, though you can withdraw it anytime and keep your account. Marketing email is never required, and adding a shout-out is always your choice.
Reviews: tap-through qualifier answers, the care stage, and an optional shout-out of about 200 characters. The shout-out is write-only, never displayed automatically, and read by our team by hand.
Care Team and appointments: practitioners you save or review and appointments you log. These can reveal who you sought care from, so they are treated as health data.
Practitioners you add, and messages you send us.
We deliberately collect nothing else at onboarding.
Automatically:
Device, browser, and IP address; usage data; limited logs. We use no third-party error tracking, and we design our systems to keep health data out of logs and error messages.
Only the cookies needed to run the Services. No advertising cookies, and no personal or health data to analytics or advertising providers.
From other sources: practitioner directory data from public sources, mainly NPPES. That is information about practitioners, not about you.
2. How we use it
Run the Services: accounts, search, peer signal, Care Team, review reminders, support.
Build anonymous aggregate peer signal: counts and averages only, never your identity or individual score on any practitioner-facing surface, and we do not attempt re-identification.
Curate shout-outs: our team reads each one in an access-restricted queue and, if featuring it, writes the anonymized version other members see. Raw submissions are never published.
Keep Noor secure, prevent fraud and abuse, and comply with law.
Improve the Services, using aggregate or de-identified data where possible.
Model training. For ordinary account and usage data, we may use it to improve our Services and models; you can opt out in settings. For consumer health data (sub-stage, age range, neighbourhood, reviews including shout-outs, Care Team, appointments), we use it for model development or future data products only with your separate opt-in consent. That consent is a distinct, un-ticked choice, and during the beta it is required to join; you can withdraw it anytime in settings and keep using Noor. Silence is never consent for health data. If a materially different use emerges, we will ask again.
3. How we disclose it
We do not sell personal data or share health data for advertising. We disclose only to:
Service providers under contract: Supabase (database, authentication, hosting), Vercel (hosting), Brevo (service email), and Google Forms (optional off-platform feedback forms; please do not include health detail in them).
Other members: aggregate peer signal, and, under the consent you give at onboarding, featured shout-outs as anonymized versions we write. Featured versions are deleted with your account.
Legal and safety: to comply with law or protect people, on a good-faith basis.
A successor in a merger or sale, bound by these commitments.
Anyone you direct, or, for health data, only with your separate authorization.
4. Your rights
You can: know and access your data, delete it, correct it, withdraw any consent, opt out of sale, sharing, and targeted advertising (we do none, and we honor Global Privacy Control), non-discrimination, and appeal of a denial. Contact hello@noorhealth.co or use settings. We may verify your identity and will respond within the legally required time.
5. Storage
Data is stored and processed in the United States.
6. Retention, deletion, and security
Account data: kept while your account is active.
Reviews: permanent, and immediately part of aggregate signal. Account deletion removes your identifiable link and deletes your shout-out text and any featured versions; anonymous aggregate signal may persist.
Safety screens: when a crisis screen appears, nothing about the search is stored.
Deletion: request it in settings or at hello@noorhealth.co. We delete or de-identify within 30 days, except where law requires retention.
Security: row-level protections limiting each member to her own data, encryption in transit, least-privilege access, and health data kept out of logs. No system is perfectly secure. Breaches of health data will be reported as required, including under the FTC Health Breach Notification Rule.
7. Children
Not for anyone under 18. Report suspected under-18 data to hello@noorhealth.co.
8. California and residency
The beta is open only to California residents, so California law is our primary frame: the CCPA and CPRA (under which health data is sensitive personal information, with limits on its use), the CMIA where it applies, and California's health data protections. We do not sell or share personal information for behavioral advertising, and we honor Global Privacy Control.
We ask you to confirm California residency and take reasonable steps to keep the beta to California. If you reach Noor from another state anyway, we still apply the protections in this policy and our Consumer Health Data Privacy Policy to you, and we will honor any greater right your own state gives you.
9. Changes
We will post updates with a new date and give extra notice for material changes. No new consent-requiring use of health data begins without your consent.
10. Contact
Privacy requests and support: hello@noorhealth.co
Noor Health Inc., 3126 South Sepulveda Boulevard, Suite 305, Los Angeles, CA 90034, US
