Privacy Policy

Plain English

Plain-English Summary (for clarity only)

This explanation is provided to help you clearly understand ionava’s approach.

For legal purposes, the Legal Disclosure controls.

The Legal Disclosure governs and is the only legally binding statement of ionava’s data practices (not the plain-English version).

Our Data Standard

Your information is not a commodity.

Your information is not a product.

It is personal, financial, and health-related information handled under strict legal, technical, and ethical controls.

ionava treats personal, financial, and health-related information as restricted assets subject to purpose limitation, access controls, and jurisdictional compliance—not as material for resale.

Health-related information, when collected, is provided directly by users or accessed with user authorization solely for eligibility evaluation, risk integrity, and platform operations.

Our Operating Principle

ionava’s relationship to your data is defined by responsibility.

That duty includes:

• Collecting only what is necessary to operate ionava responsibly.
• Using data only for disclosed, limited purposes.
• Restricting access to those with a legitimate operational need.
• Protecting data under applicable financial, privacy, and security laws.

Your information exists to enable ionava’s financial platform to function safely.

Verification and Platform Operations

To operate ionava responsibly, we may verify information you provide during onboarding and account creation.

With your authorization where required, we may receive information from trusted third-party providers to:

• Verify identity
• Validate account information
• Evaluate eligibility
• Prevent fraud
• Protect platform security
• Comply with legal and regulatory obligations

We use this information only for operational, security, onboarding, eligibility, compliance, and platform-administration purposes.

We do not sell this information, and we do not authorize third parties to use it for their own independent commercial purposes.

We do not use these processes to make healthcare decisions or provide medical advice.

What ionava Does Not Do

ionava does not:

• Sell personal, financial, or health information.
• Monetize data unethically through third-party analytics or profiling.
• Trade data as a commercial asset.

If data is not required to operate ionava, it is not collected.

Health-Related Information (When Provided)

If you choose to provide health-related information, it is treated as high-sensitivity restricted data and protected using safeguards designed to meet widely recognized privacy and security standards appropriate to the sensitivity of the information involved.

Health-related information is used only to:

• Evaluate eligibility and participation.
• Validate information for risk integrity.
• Protect the sustainability and fairness of ionava’s financial model.

Health data is never used for resale.

Limited Information Sharing

In limited, legally required cases, ionava may share specific, minimum-necessary information with trusted third parties to:

• Verify identity and account ownership
• Validate information provided during onboarding
• Evaluate eligibility and participation requirements
• Prevent fraud, misuse, or security threats
• Comply with financial, anti-money-laundering, or regulatory obligations
• Support platform operations, security, and verification processes

All such sharing is governed by contractual, technical, and legal protections.

ionava responds to legally valid data rights requests where and when required by applicable law.

Bottom Line

Your data is not a commodity.

Your data is not a product.

It is a restricted asset governed by law, and ionava treats it accordingly.

This Privacy Policy operates in conjunction with ionava’s Terms & Conditions, which govern use of the ionava platform more broadly.

Legal Disclosure

Data Use, Privacy, and Jurisdictional Compliance

This Legal Disclosure governs ionava, Inc.’s (“ionava,” “we,” “us,” or “our”) collection, use, processing, protection, and limited disclosure of personal, financial, and health-related information. This Disclosure is legally binding and supersedes any plain-English explanations, summaries, or informational materials provided for convenience or clarity.

1. Scope and Applicability

This Disclosure applies to all applicants, users, participants, and other individuals (“you” or “your”) who access or interact with ionava’s platform, services, or onboarding processes, regardless of geographic location.

ionava’s data practices are intended to align with applicable privacy, data protection, financial compliance, and consumer protection laws in the jurisdictions in which ionava operates or from which its services are accessed.

Where local law imposes additional or specific obligations, ionava will comply with such requirements to the extent applicable.

2. Nature of the Platform

ionava operates as a financial platform designed around health and wellness. ionava is not health insurance, does not provide medical coverage, does not process insurance claims, and does not make medical decisions.

Nothing in this Disclosure shall be interpreted as creating an insurer-insured relationship, a healthcare provider-patient relationship, or any form of medical authority.

3. Categories of Information Collected

ionava may collect the following categories of information, solely to the extent reasonably necessary for the purposes described in this Disclosure:

• Personal identifying information
• Contact information
• Financial information
• Identity-verification information
• Eligibility and onboarding information
• Information obtained from authorized third-party verification sources
• Health-related information, if voluntarily provided or accessed with user authorization

ionava does not collect information for unrelated or speculative purposes.

4. Purpose Limitation and Use of Information

ionava collects and processes information exclusively for legitimate operational purposes, which may include:

• Verifying identity and eligibility
• Preventing fraud, misuse, or abuse
• Satisfying legal and regulatory obligations
• Assessing and managing financial and platform risk
• Operating, maintaining, and protecting ionava’s financial systems and liquidity structures
• Validating user-provided information
• Administering onboarding, participation, account management, and platform communications
• Delivering account-related communications, onboarding updates, eligibility communications, security notices, and other operational messages
• Establishing, administering, and maintaining future program reservations, pricing reservations, vesting periods, enrollment records, payment authorizations, and related account administration functions

Information is used only for the purposes disclosed and only to the extent necessary to operate ionava responsibly and lawfully.

Information is collected and used solely to enable ionava’s financial platform to function safely, responsibly, and lawfully.

Contact information may be used to provide account-related, Health Score-related, Onboarding-related, transactional, security, eligibility, and other operational communications associated with the Platform.

5. Ethical and Operational Data Standard

ionava treats personal, financial, and health-related information as restricted assets governed by law, not as commodities or commercial products.

Accordingly:

• ionava does not sell personal, financial, or health information
• ionava does not monetize personally identifiable data through resale, profiling, or third-party analytics unrelated to platform operations

If information is not required to operate ionava, it is not collected.

6. Health-Related Information

Health-related information, when collected, may be provided directly by users or obtained from authorized third-party sources with user authorization in connection with onboarding, eligibility evaluation, verification, risk integrity, and platform operations.

If you choose to provide health-related information, such information is treated as high-sensitivity restricted data and is subject to enhanced safeguards.

Health-related information is used solely for purposes that may include:

• Evaluating eligibility or participation status
• Verifying the accuracy of information provided
• Protecting the integrity, sustainability, and fairness of ionava’s financial model

Health-related information is not used for resale.

ionava does not provide medical advice, evaluate medical necessity, or control healthcare decisions. Users retain full autonomy over the user's own healthcare choices.

7. Verification and Third-Party Data Sources

To protect the integrity of the Platform, maintain security, prevent fraud, evaluate eligibility, validate information, comply with legal obligations, and support responsible platform operations, ionava may collect, receive, verify, review, or process information obtained from authorized third-party sources, subject to applicable law and any required user authorization.

Such sources may include:

• Identity-verification providers
• Account-validation services
• Financial institutions
• Consumer reporting agencies
• Fraud-prevention providers
• Public-records sources
• Health-related information verification providers
• Regulatory, compliance, or sanctions-screening services
• Other service providers engaged to support onboarding, verification, security, compliance, or platform administration

Information obtained from such sources may be used to:

• Verify identity and account ownership
• Validate information provided during onboarding
• Evaluate eligibility and participation requirements
• Detect, prevent, investigate, or respond to fraud, misuse, or security incidents
• Satisfy legal, regulatory, compliance, or reporting obligations
• Maintain the integrity, sustainability, and security of the Platform

Where required by law, ionava obtains appropriate authorization before accessing or receiving information from third-party sources.

ionava does not use information obtained through these processes to provide medical advice, make healthcare decisions, evaluate medical treatment, or determine medical necessity.

Information obtained through verification and third-party data sources is used solely for operational, verification, security, eligibility, compliance, onboarding, and platform-administration purposes.

8. Information Sharing with Third Parties

ionava may share limited, minimum-necessary information with trusted third parties where reasonably necessary to:

• Verify identity and account ownership
• Validate information provided during onboarding
• Evaluate eligibility and participation requirements
• Prevent fraud, misuse, or security threats
• Satisfy Know Your Customer (KYC), anti-money-laundering (AML), sanctions-screening, or similar compliance obligations
• Administer platform operations, security, and verification processes
• Comply with applicable legal, regulatory, or governmental requirements

All such disclosures are governed by contractual, technical, and legal protections designed to restrict use, maintain confidentiality, and ensure compliance with applicable law.

ionava does not authorize third parties to use personal health information for independent commercial purposes.

Third-party service providers engaged by ionava may include identity-verification providers, account-validation services, consumer reporting agencies, financial institutions, fraud-prevention providers, public-records sources, health-related information verification providers, and other operational service providers. Such providers may receive or provide information solely for authorized operational, verification, compliance, security, onboarding, or platform-administration purposes.

9. Security, Access, and Retention

ionava employs reasonable and appropriate administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, or misuse.

Access to information is limited to personnel and service providers with a legitimate operational need. Access controls, logging, and review processes are implemented consistent with ionava’s internal compliance standards.

Information is retained only for as long as necessary to fulfill disclosed purposes or to satisfy legal or regulatory obligations, after which it is deleted or anonymized in accordance with applicable requirements.

9A. Data Rights Requests

ionava responds to legally valid data rights requests where and when required by applicable law. Such requests may be subject to identity verification and lawful limitations.

10. Governing Effect

This Legal Disclosure constitutes the sole legally binding statement regarding ionava’s data practices. Any summaries, explanations, or plain-English descriptions are provided for convenience only and have no legal effect.

11. Contact Information

ionava, Inc.

info@ionava.com