Privacy Policy

This Privacy Policy applies to the HEII Platform and all associated digital properties operated by:

We are the data controller for personal information collected through this platform. By using our services, you acknowledge that you have read and understood this policy.

Information You Provide Directly

• Survey responses including health-related questions, environmental concerns, and demographic information
• Name and contact information submitted through platform forms
• Feedback, inquiries, or messages submitted to our team

Information Collected Automatically

• Device type, browser version, operating system, and screen resolution
• IP address and approximate geographic location
• Pages visited, time spent on pages, navigation paths, and clicks (via Google Analytics)
• Referring URLs and search terms used to find the platform
• Session identifiers and browser cookies

Information We Do Not Currently Collect

• Protected Health Information (PHI) — the platform is not yet a covered entity under HIPAA
• Payment or financial information — no transactions are processed on this platform
• Biometric or genetic data

• To operate, maintain, and improve the HEII Platform and 360REGISTRY demonstration
• To analyze survey responses for product development and research purposes
• To understand how users interact with the platform using aggregated analytics data
• To communicate with you in response to inquiries or feedback
• To detect, prevent, and address technical issues or security threats
• To comply with applicable laws including the Virginia Consumer Data Protection Act (VCDPA) and other federal and state regulations
• To inform future platform development including clinical integrations, predictive modeling via N.A.I.D.A., and public health reporting features

We do not sell your personal information. We may share data in the following limited circumstances:

• Service Providers: Third-party vendors who assist us in operating the platform (e.g., Google Analytics for usage analytics) under contractual data processing obligations
• Legal Requirements: When required by law, subpoena, court order, or government authority with jurisdiction
• Business Transfers: In connection with a merger, acquisition, or sale of assets — users will be notified in advance
• Safety: To protect the rights, safety, or property of 360D.AI, our users, or the public

360D.AI is building toward full HIPAA compliance as the platform evolves toward clinical operations. At present:

• The platform does not transmit, store, or process Protected Health Information (PHI) as defined under HIPAA
• Survey responses may include general health-related questions but are not used for clinical diagnosis or treatment
• Prior to any clinical data processing, this policy will be updated and users will be notified
• A formal Notice of Privacy Practices will be issued when HIPAA-covered services launch

As a Virginia-incorporated entity, we honor the rights granted to Virginia residents under the VCDPA:

• Right to Know: You may request confirmation of whether we process your personal data and access a copy
• Right to Correct: You may request correction of inaccurate personal data
• Right to Delete: You may request deletion of personal data we hold about you
• Right to Data Portability: You may request your data in a portable, machine-readable format
• Right to Opt Out: You may opt out of the sale of personal data (we do not sell data) and targeted advertising
• Right to Appeal: If we decline your request, you may appeal our decision

To exercise any of these rights, contact privacy@360d.ai. We will respond within 45 days as required by law.

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit using TLS/HTTPS
• Access controls limiting data access to authorized personnel only
• Regular review of data handling practices and vendor agreements

No system is completely secure. If you discover a potential vulnerability, please report it immediately to security@360d.ai.

The HEII Platform is not directed to children under the age of 13. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a child, contact privacy@360d.ai and we will delete it promptly.

We may update this Privacy Policy as the platform evolves. We will notify users of material changes by posting the updated policy with a new effective date. Continued use of the platform after changes take effect constitutes acceptance of the revised policy.