2.1 What HealthRec1 Provides HealthRec1 is a secure, patient-controlled platform that allows you to store personal health records electronically, manage your health information, access records from any device, and control access.

2.2 What HealthRec1 Does NOT Provide HealthRec1 is NOT a healthcare provider, source of medical advice, diagnosis, or substitute for professional medical care. Always consult qualified healthcare professionals.

2.3 Zero-Knowledge Architecture (At-Rest Encryption) Your health records are encrypted before storage and while at rest on our servers using zero-knowledge architecture. This means HealthRec1 cannot access, view, or read your stored records in their encrypted state, and our personnel do not have standing access to your unencrypted health information.

2.4 AI-Powered Features and Temporary Data Processing To provide certain features — including AI Health Chat, Appointment Transcription, and AI-generated summaries — HealthRec1 must temporarily decrypt and process the specific health information relevant to that feature. This is different from our at-rest storage model, and by using these features, you expressly consent to this temporary processing. Specifically:

• What is processed: When you use AI Health Chat, the platform accesses relevant portions of your stored health records (and, where applicable, publicly available web information) to generate a response to your question. When you use Appointment Transcription, the audio recording you provide is processed to generate a transcript, which is then analyzed to produce a summary of diagnoses, follow-ups, and key takeaways.

• How it's processed: This processing may occur using HealthRec1's own systems and/or third-party AI service providers (e.g., third-party language model or transcription providers). Data sent to third-party providers is transmitted securely and is subject to that provider's data handling and retention terms, which may differ from ours.

• Duration and scope: Decryption for AI processing is limited to the specific data needed to fulfill your request and is not a permanent or standing change to your zero-knowledge storage. Processed data (such as chat responses or transcripts) may be stored in your account, encrypted at rest like other records, unless you delete it.

• Your consent and control: By initiating an AI Health Chat query or recording an appointment for transcription, you affirmatively consent to the temporary decryption and processing described above. You may decline to use these features, and doing so has no effect on your ability to use HealthRec1's core record storage and management functions.

• Not medical advice: AI-generated responses, summaries, and transcripts are provided for informational and organizational purposes only. They are not medical advice, diagnosis, or treatment recommendations, may contain errors or omissions, and should not be relied upon in place of consulting a qualified healthcare professional.

2.5 Interaction with Zero-Knowledge Claims References elsewhere in these Terms (including Section 18) to HealthRec1's inability to "access" your records refer to your records' encrypted, at-rest state and to HealthRec1's lack of standing access absent your action. They do not apply to data you actively submit for processing through AI-powered features, as described in Section 2.4.

2.6 Regulatory Status and Health Data Disclosures HealthRec1 is a consumer-controlled, patient-directed platform. HealthRec1 is not a healthcare provider, health plan, or healthcare clearinghouse, and in most circumstances does not act as a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act (HIPAA). As a result, health information you store using HealthRec1 may not be protected under HIPAA in the same manner as records held by your doctor, hospital, or insurer.

Notwithstanding the above, HealthRec1 is subject to applicable state consumer health data laws, including but not limited to laws such as Washington's My Health My Data Act and similar statutes in other states, as well as the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA) where applicable. In accordance with these laws, HealthRec1:

• Will not sell your health data without your explicit authorization;

• Will obtain your consent before collecting or processing health data beyond what is necessary to provide the Service;

• Will honor your right to withdraw consent and to request deletion of your health data, subject to Section 5.7 (Data Export and Portability) and applicable record-keeping requirements; and

• Will provide additional disclosures specific to your state of residence in our Privacy Policy where required by law.