Privacy Policy

SOUND HSA, Inc. ("SOUND HSA", "we", "our", or "us") and its affiliates (collectively, SOUND) respect your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect the information you provide when you interact with any of our services, including:

• the SOUND General Services (website, Move to Earn health data driven bitcoin rewards, mobile app, self-custodial lightning wallet, wait‑list sign‑up, support interactions).
• the SOUND HSA Platform (website app, mobile app, and related services that enable the Health Savings Account ("HSA") product.

By accessing or using any of these services you acknowledge that you have read, understood, and agree to the practices described below. If you do not agree, you must not use the Services.

Note: Information that is subject to higher‑security handling (e.g., Social Security Numbers, bank‑account details, medical receipts, and other health‑sensitive data) is collected only from users who open an HSA account. All other users (e.g., those using only the public Nostr features or the website) provide a minimal set of data as described in Section 2.

This policy is written in English. In the event of a conflict between an English version and a translated version, the English version controls.

3.1 General‑User Purposes

• Service operation – enable account creation on the public Nostr protocol, self-custodial bitcoin lightning wallet username, provide support, and send wait‑list and newsletter updates.
• Rewards – calculate and deliver bitcoin "sats" rewards for step‑based challenges (only if you opt‑in).
• Security & analytics – detect fraud, improve performance, and understand aggregate usage trends.
• Communications – respond to support requests and send service‑related announcements.

3.2 HSA‑Customer Purposes (higher‑security data)

• Account creation & management – open, fund, and maintain your Health Savings Account; process contributions, distributions, and Bitcoin trades.
• Regulatory compliance – satisfy Know‑Your‑Customer (KYC), Anti‑Money‑Laundering (AML), IRS tax reporting, and Bank Secrecy Act retention requirements.
• Health‑expense reimbursements – verify medical receipts and other health‑plan documentation (treated as protected health information).
• Rewards for health activity – verify step counts and calculate "Move‑to‑Earn" rewards.
• Communications – send account statements, security alerts, and required regulatory notices.

• Medical receipts & reimbursement documentation: Used only to substantiate HSA distribution requests. Not used for marketing or shared outside the custodial/compliance workflow. While the content is encrypted, certain connection metadata (like IP addresses and timestamps), is collected for security monitoring (as mentioned in Section 2).
• Fitness/step‑count data: Used only for the optional "Move‑to‑Earn" rewards program. We never sell or license this data to insurers, advertisers, or other entities.
• Encryption of health data: All health‑related data (both "SOUND Health Data" and "Third‑Party Health Data") is encrypted end‑to‑end before it leaves your device and is stored on our Nostr Secure Web‑Socket Relay. Only you (via your private key) can decrypt it. Your private key (nsec) is never known to us.

• General‑User Data: Retained for as long as your account remains active or as needed to provide the Services (typically 2 years after inactivity). SOUND can delete data from its own systems/relays, but has no control over data that persists on the decentralized Nostr network by third parties.
• HSA‑Customer Data: Retained indefinitely for the life of the account plus minimum 7 years after account closure, as required by federal banking, tax, and anti‑money‑laundering statutes.
• Technical logs: Kept for up to 90 days unless needed for security investigations, compliance, or legal holds.

• The Services are not intended for individuals under 18.
• We do not knowingly collect personal information from children.
• If we become aware that we have inadvertently collected such data, we will delete it promptly.

• Right to Know – request the categories of personal information we have collected, the sources, business purposes, and third parties with whom we share it.
• Right to Delete – request deletion of your personal information, subject to statutory exemptions (e.g., financial record retention).
• Right to Opt‑Out of Sale – we do not sell personal information; you will be notified if that changes.
• Non‑Discrimination – we will not treat you differently for exercising any CCPA right.

Requests can be sent to support@soundhsa.com. We will verify your identity before fulfilling any request.

We may update this Privacy Policy from time to time. When we make material changes we will:

1. Post the revised policy on our website and update the "Last Updated" date.
2. Provide a notice within the App or via email (for HSA customers).

Your continued use of the Services after the changes become effective constitutes your acceptance of the revised terms.