SOUND HSA Privacy Policy

SOUND HSA – PRIVACY POLICY

Last Updated: 12 / 22 / 2025

1. INTRODUCTION

SOUND HSA, Inc. (“SOUND HSA”, “we”, “our”, or “us”) and its affiliates (collectively, SOUND) respect your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect the information you provide when you interact with any of our services, including:

• the SOUND General Services (website, Move to Earn health data driven bitcoin rewards, mobile app, self-custodial lightning wallet, wait‑list sign‑up, support interactions).
• the SOUND HSA Platform (website app, mobile app, and related services that enable the Health Savings Account (“HSA”) product, and

By accessing or using any of these services you acknowledge that you have read, understood, and agree to the practices described below. If you do not agree, you must not use the Services.

Note: Information that is subject to higher‑security handling (e.g., Social Security Numbers, bank‑account details, medical receipts, and other health‑sensitive data) is collected only from users who open an HSA account. 

All other users (e.g., those using only the public Nostr features or the website) provide a minimal set of data as described in Section 2.

This policy is written in English. In the event of a conflict between an English version and a translated version, the English version controls.

2. INFORMATION WE COLLECT

We collect only the data necessary to provide, improve, and secure our Services, and to meet legal and regulatory obligations. The categories below are divided between (A) General‑User Data (collected from anyone who accesses the non‑HSA portions of our Services) and (B) HSA‑Customer Data (collected only from users who open an HSA).

How we collect it

• Directly from you – via forms, app settings, or uploads.
• Automatically – via cookies, device logs, and usage analytics.
• From third parties – fitness‑app APIs (with your permission), custodians, identity‑verification providers (e.g., Plaid, Onfido).

3. HOW WE USE YOUR INFORMATION

3.1 General‑User Purposes

• Service operation – enable account creation on the public Nostr protocol, self-custodial bitcoin lightning wallet username, provide support, and send wait‑list and newsletter updates.
• Rewards – calculate and deliver bitcoin “sats” rewards for step‑based challenges (only if you opt‑in).
• Security & analytics – detect fraud, improve performance, and understand aggregate usage trends.
• Communications – respond to support requests and send service‑related announcements.

3.2 HSA‑Customer Purposes (higher‑security data)

• Account creation & management – open, fund, and maintain your Health Savings Account; process contributions, distributions, and Bitcoin trades.
• Regulatory compliance – satisfy Know‑Your‑Customer (KYC), Anti‑Money‑Laundering (AML), IRS tax reporting, and Bank Secrecy Act retention requirements.
• Health‑expense reimbursements – verify medical receipts and other health‑plan documentation (treated as protected health information).
• Rewards for health activity – verify step counts and calculate “Move‑to‑Earn” rewards.
• Communications – send account statements, security alerts, and required regulatory notices.

4. SHARING YOUR INFORMATION

We do NOT sell your personal information to advertisers, data brokers, or other third parties.

5. HEALTH‑DATA & SENSITIVE INFORMATION (HIPAA & Related)

• Medical receipts & reimbursement documentation – Used only to substantiate HSA distribution requests. Not used for marketing or shared outside the custodial/ compliance workflow. While the content is encrypted, certain connection metadata (like IP addresses and timestamps), is collected for security monitoring (as mentioned in Section 2).
• Fitness/step‑count data – Used only for the optional “Move‑to‑Earn” rewards program. We never sell or license this data to insurers, advertisers, or other entities.
• Encryption of health data – All health‑related data (both “SOUND Health Data” and “Third‑Party Health Data”) is encrypted end‑to‑end before it leaves your device and is stored on our Nostr Secure Web‑Socket Relay. Only you (via your private key) can decrypt it. Your private key (nsec) is never known to us.

6. DATA SECURITY

We use administrative, technical, and physical security measures to help protect your Personal Information.

• Encryption: Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Access Control: Strict role-based access limits which employees can view sensitive user data.
• Multi-Factor Authentication (MFA): We support and require MFA for account access. By providing your mobile phone number, you consent to receive authentication codes via SMS for account security.

7. DATA RETENTION

• General‑User Data – Retained for as long as your account remains active or as needed to provide the Services (typically 2 years after inactivity). SOUND can delete data from its own systems/relays, but has no control over data that persists on the decentralized Nostr network by third parties.
• HSA‑Customer Data – Retained indefinitely for the life of the account plus minimum 7 years after account closure, as required by federal banking, tax, and anti‑money‑laundering statutes.
• Technical logs – Kept for up to 90 days unless needed for security investigations, compliance, or legal holds.

8. YOUR PRIVACY RIGHTS

Depending on your location, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate data.
• Deletion: Request deletion of your data (subject to our legal retention obligations described in Section 7).
• To exercise these rights, contact us at support@soundhsa.com.

We will respond to verifiable requests within 30 days.

9. CHILDREN’S PRIVACY

• The Services are not intended for individuals under 18.
• We do not knowingly collect personal information from children.
• If we become aware that we have inadvertently collected such data, we will delete it promptly.

10. INTERNATIONAL DATA TRANSFER

All data is processed and stored on servers located in the United States. By using our Services you consent to the transfer of your information to the U.S., where privacy laws may differ from those in your home country. We rely on standard contractual clauses and our own privacy commitments to protect your data abroad.

11. CALIFORNIA RESIDENTS (CCPA/CPRA)

• Right to Know – request the categories of personal information we have collected, the sources, business purposes, and third parties with whom we share it.
• Right to Delete – request deletion of your personal information, subject to statutory exemptions (e.g., financial record retention).
• Right to Opt‑Out of Sale – we do not sell personal information; you will be notified if that changes.
• Non‑Discrimination – we will not treat you differently for exercising any CCPA right.

Requests can be sent to support@soundhsa.com. We will verify your identity before fulfilling any request.

12. DO‑NOT‑TRACK (DNT)

We do not track users across third‑party sites for advertising purposes and therefore do not respond to DNT signals. Third‑party services embedded in the Platform (e.g., analytics providers) may honor DNT at their discretion.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we make material changes we will:

1. Post the revised policy on our website and update the “Last Updated” date.
2. Provide a notice within the App or via email (for HSA customers).

Your continued use of the Services after the changes become effective constitutes your acceptance of the revised terms.

14. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

• Email: support@soundhsa.com
• Mailing Address: 1110 Halcyon Ave, Nashville, TN 37204

Thank you for trusting SOUND HSA with your privacy.