HIPAA Privacy

Does HIPAA Apply to NinthMoon?

The Health Insurance Portability and Accountability Act (“HIPAA”) applies to “covered entities” (such as health plans and healthcare providers) and their “business associates.” When you use NinthMoon directly as an individual consumer, NinthMoon is generally not a HIPAA-covered entity or business associate, and the health information you share is generally not “Protected Health Information” under HIPAA. Your information is instead governed by our Privacy Policy and applicable consumer-privacy and consumer-health-data laws.

HIPAA may apply only in specific arrangements where we process health information on behalf of a covered entity (for example, under a partnership with a healthcare provider or an employer-sponsored program). In those cases, we would enter into a Business Associate Agreement and provide any additional notices required.

How We Protect Your Health Information Regardless

Even though HIPAA generally does not apply to direct consumer use, we treat your health and reproductive information as sensitive and apply strong safeguards:

• Encryption: AES-256 at rest (via Google Cloud / Firebase) and TLS 1.2+ in transit; chat messages and Nimo’s responses are additionally encrypted with a dedicated application key.
• Access controls: limited internal access on a need-to-know basis.
• No sale: we do not sell your health information.
• Limited sharing: we share health-related content only as described in our Privacy Policy — including transmitting conversation content and relevant context to OpenAI to generate Nimo’s responses (API business terms; no model training), and analyzing chat/journal text with Google Cloud Natural Language for safety signals.
• Storage: we store your conversations, memory summaries, and community content as described in our Privacy Policy; we do not store files you upload to Nimo. Conversations flagged for crisis or serious risk may be reviewed and escalated to support your safety.

Your Choices

You can access, correct, or delete your information and withdraw consent as described in our Privacy Policy, including by deleting your account at https://ninthmoon.ai/delete-account.

State Consumer-Health-Data Laws

Some U.S. states (for example, Washington’s My Health My Data Act and similar laws) provide specific rights regarding consumer health data, including separate consent for certain collection and sharing. Where these apply, we honor the additional rights they provide. [Confirm specific state-law coverage and any required separate consumer-health-data policy with counsel.]

Contact

legal@ninthmoon.ai NinthMoon AI LLC, 8 The Green, Ste A, Dover, DE 19901