Legal

Privacy Policy

Privacy Policy

The Exposome Intelligence Company ("EXPIN")

Effective date: June 15, 2026

Last updated: June 15, 2026

Important context

EXPIN AI is an investigative research tool, not a medical, diagnostic, or therapeutic product, and EXPIN is not a HIPAA-covered entity. Even though HIPAA does not generally apply to us, we handle your information, including your health information, with care and security practices aligned to healthcare-industry standards. This Privacy Policy explains what we collect, how we use and share it, the choices and rights you have, and the protections that apply.

Washington residents and certain other consumers: see our separate Consumer Health Data Privacy Policy (linked from our homepage) and the Consumer Health Data section below for additional rights and commitments.

1. Who we are and scope

This Privacy Policy applies to personal information we collect through the EXPIN AI platform, the expotype analysis and report, related consultations, and our websites at expin.ai and related subdomains (the "Service"). The data controller is:

The Exposome Intelligence Company

1111 Oakfield Dr

Ste 115 PMB 3255

Brandon, FL 33511-4948

Privacy and data-rights requests: our customer contact portal, available on our website at https://www.expin.ai/contact and within the EXPIN app.

2. Information we collect

(a) Information you provide directly

  • Contact and application information: name, email address, mobile phone number, home address, and the information you submit in our application and contact forms (including how you heard about us and any subreddit or referral source).
  • Health information: your diagnosis and diagnostic history (e.g., Hashimoto's/hypothyroidism), antibody and other lab results you choose to share, symptoms, medications, other autoimmune or chronic conditions, and related information.
  • AI-interview content: your responses during the AI-guided interview, which may include detailed life, residence, occupational, dietary, environmental, infection, reproductive, lifestyle, stress/trauma, and substance-use history.
  • Consultation information: information exchanged during consultations with our team.
  • Healthcare provider contact information: if you choose to share your expotype with your healthcare provider, the name and contact details (such as email and/or phone number) you enter for that provider so we can send them an access link.
  • Feedback: your feedback about the Service.

(b) Information you provide about another person

If you use the Service on behalf of another person (a "Represented Individual"), we collect the information you provide about them. You represent that you have authority to provide it. See the Terms of Service.

(c) Information collected automatically

  • Device and usage data (e.g., IP address, browser type, pages viewed, interactions, timestamps).
  • Cookies and similar technologies (see Cookies).
  • Data processed by reCAPTCHA to protect our forms (subject to the Google Privacy Policy).

(d) Information from third-party sources

To build your expotype, we combine your information with data from external sources, which may include:

  • geographic and environmental databases (e.g., air and water quality, local contamination and health patterns) associated with your residence history;
  • toxicological and regulatory resources (e.g., EPA, ATSDR);
  • public-health data sources; and
  • curated peer-reviewed scientific literature.

We do not currently ingest an individual's electronic health-record or insurance-claims data. If we offer that in the future, we will obtain it only with your authorization (or another lawful basis) and will update this Privacy Policy to describe the source and how the data is used before doing so.

3. Sensitive and health information; your consent

Much of the information above is sensitive personal information, including health information and precise location/address information. We collect and process it to provide the Service to you, and, where required by law, only with your consent. By providing health and other sensitive information and agreeing to this Privacy Policy and the applicable consent prompts, you consent to our processing of that information as described here. You may withdraw consent as described in Your rights and choices; withdrawal may limit or end your ability to use the Service.

4. How we use your information

We use your information to:

  • create your expotype and deliver your report;
  • conduct the AI-guided interview and any human review;
  • provide consultations and respond to your inquiries;
  • at your request, share your expotype with a healthcare provider you designate, including sending the provider an access link and contacting them to deliver it;
  • communicate with you by email, SMS/text message, telephone, and physical mail, including service messages and, where permitted, promotional messages (see Communications);
  • operate, secure, debug, maintain, and improve the Service, including reviewing and inspecting your information as needed to deliver, troubleshoot, personalize, and refine your reports and longitudinal insights over time (this is part of providing the Service to you);
  • comply with legal obligations and enforce our Terms; and
  • with your separate, opt-in consent, develop and train our models and improve the Service for users generally. That is, uses that go beyond providing and refining the Service for you (see Service delivery, product improvement, and model development).

5. Legal bases for processing (where applicable)

Where the GDPR/UK GDPR or similar laws apply, we rely on: performance of a contract (to provide, maintain, and refine the Service you request, including reviewing your information to deliver and improve your own reports and longitudinal insights); your consent (including explicit consent for health/special-category data, and for developing our models and improving the Service for users generally); our legitimate interests (e.g., security, fraud prevention, and operating the Service, applied to non-special-category data and where not overridden by your rights); and legal obligation. You may withdraw consent at any time without affecting prior processing.

6. How we share information

We do not sell your personal information for money, and we never use or disclose your health information, consumer health data, or any genetic data for advertising. We do use limited, non-health information for interest-based advertising as described below and in Cookies and tracking; under some U.S. state laws this counts as "sharing" (and our use of advertising cookies may count as a "sale"), and you can opt out as described in Your rights and choices, including through the Global Privacy Control. We share information as follows:

  • Service providers / subprocessors who process information on our behalf under contract, including:
    • AI / large-language-model providers that power the interview and assist analysis. We contractually require that these providers do not use your information to train their own models and process it only to provide services to us. We refer to our AI providers and other subprocessors generally and maintain a current subprocessor list, available on request.
    • cloud hosting and storage providers;
    • communications providers (email and SMS);
    • analytics providers; and
    • security and anti-abuse providers (e.g., reCAPTCHA/Google).
  • Our clinical and scientific advisors/consultants who review results as part of providing the Service.
  • Healthcare providers you designate (at your direction) — if you choose to share your expotype with your healthcare provider, we disclose your expotype and related information to the provider whose contact details you provide, by sending an access link, at your request.
  • Advertising and analytics partners. To run interest-based advertising, we and our partners use cookies and similar technologies and may share non-health identifiers and online-activity data with advertising partners and networks. We do not share health information, consumer health data, or genetic data with these partners, and none of that data is used for interest-based advertising. You can opt out as described in Sections 9 and 10.
  • Legal, safety, and compliance recipients where we believe disclosure is required by law or necessary to protect rights, safety, or the integrity of the Service.
  • Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy or successor protections and any required notice/consent.

7. Service delivery, product improvement, and model development

We distinguish between using your information to provide the Service to you and using it to improve our product and models more broadly.

Providing the Service to you (no separate consent required). Delivering the Service includes reviewing and inspecting your information to create, maintain, troubleshoot, personalize, and refine your own reports and longitudinal insights over time, and to keep your data accurately processed. This is part of the Service you request; it is covered by your use of the Service and the consent in Section 3 and does not depend on the separate consent below.

Developing our models and improving the Service for users generally (separate, opt-in consent). Using your information to develop, evaluate, and train our models, or to improve the product in ways that benefit users generally rather than delivering or refining the Service for you, is a separate purpose. Because it involves sensitive data, we rely on your affirmative, opt-in consent, obtained separately from your acceptance of the Terms.

  • Wherever feasible, we de-identify your information before using it for these purposes (see De-identification).
  • You may withdraw this consent at any time through our customer contact portal (available on our website and in the EXPIN app). Withdrawal stops future use for these purposes and triggers deletion of associated data going forward; however, information already incorporated into a trained model generally cannot be removed from that model. Withdrawing this consent does not affect your ability to use the core Service.
  • We record your consent choices (including version and date).

8. De-identification and aggregation

We may create de-identified and aggregated information that does not reasonably identify you and use it for research, analytics, and improving the Service. We de-identify using methods consistent with a recognized standard: either the HIPAA Safe Harbor method (removing specified identifiers) or expert determination that the risk of re-identification is very small. We maintain de-identified information without attempting to re-identify it, except as permitted by law to test our de-identification.

9. Cookies and tracking

We use cookies and similar technologies to operate the Service, remember preferences, understand usage, and support interest-based advertising on our marketing pages. We do not place advertising or third-party tracking technologies on the pages where you provide health information, and we do not allow trackers that would transmit your health information, consumer health data, or genetic data. You can control cookies through your browser settings and the opt-outs in Your rights and choices. We honor the Global Privacy Control (GPC) signal as an opt-out of "sale"/"sharing" for browsers that send it.

10. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

  • Access / know the personal information we hold about you;
  • Correct inaccurate information;
  • Delete your information;
  • Portability to receive a copy in a usable format;
  • Withdraw consent, including for health-data processing and product improvement;
  • Limit the use or disclosure of sensitive personal information;
  • Opt out of targeted/interest-based advertising and of any "sale" or "sharing" of personal information (we limit this to non-health information; we never sell or share health, consumer health, or genetic data for advertising); and
  • Non-discrimination for exercising your rights, and to appeal a denied request.

To exercise your rights, submit a request through our customer contact portal (available on our website and in the EXPIN app). To opt out of interest-based advertising, you can also use the cookie controls described in Section 9, send the Global Privacy Control signal from your browser, and use ad-industry opt-outs (for example, the NAI and DAA opt-out pages and your device's advertising-ID settings). We will verify your request and respond within the time required by applicable law. An authorized agent may submit a request on your behalf where permitted.

11. Consumer health data rights

Applies to residents of Washington (My Health My Data Act) and certain other states with consumer-health-data protections (e.g., Nevada, Connecticut).

  • We collect and process "consumer health data" (which can include your interview responses, conditions, symptoms, location associated with health, and related data) to provide the Service.
  • We obtain your consent before collecting consumer health data and obtain separate consent (authorization) before any sharing or sale that would require it. We do not sell consumer health data, and we never share or use it for advertising.
  • You have the right to confirm whether we process your consumer health data, to access it, to withdraw consent, and to have it deleted. To exercise these rights, submit a request through our customer contact portal (available on our website and in the EXPIN app). You may also appeal a denial.
  • We restrict employee and contractor access to consumer health data to those who need it to provide the Service, under contractual confidentiality and access controls.

For full details, see our separate Consumer Health Data Privacy Policy, which is linked from our homepage and supplements this Privacy Policy.

12. State-specific disclosures (United States)

California (CCPA/CPRA). In the past 12 months we have collected the categories of personal information described in Section 2, including sensitive personal information (health information and precise geolocation), from the sources in Section 2, for the purposes in Section 4, and disclosed them to the categories of recipients in Section 6. We do not sell personal information for money. We use limited non-health information for interest-based advertising, which may be considered a "sale" or "share" under California law; you may opt out as described in Sections 9 and 10, including via the Global Privacy Control. We do not sell or share sensitive personal information (including health information) for advertising, and we honor opt-outs of the use of sensitive personal information beyond permitted business purposes. California residents have the rights described in Section 10 and may designate an authorized agent. Shine the Light: California residents may request information about disclosures of personal information to third parties for those third parties' direct-marketing purposes; submit such requests through our customer contact portal.

Other states. Residents have rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, and we obtain opt-in consent to process sensitive data. Contact us to exercise these rights and to appeal.

13. International users

The Service is operated from the United States, and your information is transferred to and processed in the United States, where privacy laws may differ from those in your country. If you use the Service from outside the United States, you do so on your own initiative and are responsible for compliance with your local laws.

We do not offer the Service to residents of the European Economic Area (EEA), the United Kingdom, or Switzerland. Because we do not target those regions, we do not currently appoint an EU or UK representative or rely on EU/UK cross-border transfer mechanisms. If we begin offering the Service there, we will update this Privacy Policy to add an EU/UK representative, an appropriate transfer mechanism (such as the Standard Contractual Clauses or the UK Addendum), and the related GDPR/UK GDPR disclosures and rights.

Regardless of where you are located, we apply the protections described in this Privacy Policy, rely on explicit consent for health and other sensitive data, and honor the data-subject rights in Section 10 to the extent they apply to you.

14. Data retention

We retain your personal information for as long as you have an account and for as long as needed to provide the Service , including maintaining and refining your expotype and longitudinal insights over time. Canceling a subscription does not by itself delete your information; we keep it so you can resume, unless and until you ask us to delete it. You may request deletion of your information at any time through our customer contact portal, and we will delete it except where we must retain certain records to meet legal, accounting, security, or dispute-resolution obligations, or where we hold it in de-identified form. Backups are deleted or overwritten on a rolling basis.

15. Data security

We use administrative, technical, and physical safeguards aligned to healthcare-industry standards, including encryption (in transit and at rest), access controls and least-privilege access, logging, and vendor due diligence, to protect your information. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

16. Data breach notification

If a breach affecting your personal or health information occurs, we will notify you and applicable regulators as required by law, including under the FTC Health Breach Notification Rule and applicable state and international breach-notification laws, within the required timeframes.

17. Children's privacy

The Service is intended for adults (18+) and is not for use by or on behalf of anyone under 18. We do not knowingly collect personal information from or about anyone under 18. If we learn that we have collected such information, we will delete it. If you believe we have collected information about a minor, contact us through our customer contact portal.

18. Communications

We use the contact information you provide to communicate with you by email, SMS/text message, telephone, and physical mail. These include service and transactional messages (for example, about your application, account, expotype, scheduling, billing, and security) and, where permitted, informational and promotional messages. Calls and texts may use automated technology, including autodialers and prerecorded or artificial-voice messages. Message frequency varies, and message-and-data rates may apply. You can opt out of promotional messages at any time — reply STOP to a text (reply HELP for help), use the unsubscribe link in an email, ask to be placed on our internal do-not-call list, or contact us through our customer contact portal — though we may still send service messages needed to provide the Service. Our communications practices are governed by applicable law, including the TCPA, CAN-SPAM, and Do-Not-Call rules; see the Terms of Service for the consent that applies. [Marketing call/text consent should be obtained as a separate, conspicuous opt-in and is not a condition of using the Service.]

19. Third-party links and services

The Service may link to or rely on third-party websites and services (such as Google reCAPTCHA). Their privacy practices are governed by their own policies, and we are not responsible for them.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy with a new effective date and notify you by email and/or an in-app notice, and, where required, obtain your consent.

21. Contact us

The Exposome Intelligence Company

1111 Oakfield Dr

Ste 115 PMB 3255

Brandon, FL 33511-4948

All inquiries and privacy/data-rights requests: our customer contact portal, available on our website at https://www.expin.ai/contact and within the EXPIN app.

EXPIN

EXPIN is a research and educational tool for understanding what may be driving your condition. It is not a medical device, and it does not diagnose, treat, or cure disease. It works best alongside your doctor, and is never a substitute for professional medical care.

© 2026 The Exposome Intelligence Company