Consumer Health Data Privacy Policy

#The short version

• The only health-related information oyapilot asks for is your answer to the voluntary disability self-identification question that many US job applications include.
• It is optional. You can leave it blank, or choose "I do not wish to answer", and oyapilot will leave that question on each application for you to answer yourself.
• We collect it only with your consent, and we share it with an employer only with a separate consent from you, and only on applications you authorize.
• We use it only to fill that one question on your applications. Never for scoring, matching, advertising, AI training or anything else.
• We never sell it.
• You can see it, change it, delete it and withdraw consent at any time, in your Application Profile.

#Contents

1. Who this policy is for
2. What "consumer health data" means here
3. The consumer health data we collect
4. Health data we do not collect
5. Why we collect it and how we use it
6. Where it comes from
7. Your consent
8. Who we share it with
9. We do not sell consumer health data
10. How long we keep it
11. How we protect it
12. Your rights
13. How to exercise your rights
14. Appeals
15. No geofencing
16. No discrimination
17. Employers and what happens after an application is sent
18. How deletion reaches every copy
19. Security incidents involving health data
20. Our processors' obligations
21. Questions people ask
22. Changes to this policy
23. Contact

#1. Who this policy is for

This policy applies to consumer health data that Oyatco LLC ("oyapilot", "we", "us") collects about you when you use oyapilot. Washington, Nevada and Connecticut law require it, but we apply it to every oyapilot user, wherever you live.

It supplements the oyapilot Privacy Policy. If this policy and the Privacy Policy differ on consumer health data, this policy controls, because it gives you more protection.

Oyatco LLC is an online business based in Texas, United States. Contact details are in Section 19.

#2. What "consumer health data" means here

Washington law defines "consumer health data" broadly, as personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. That can include information about a health condition or disability, and information inferred from other data.

A voluntary answer to a job application's disability self-identification question may fall within that definition. We treat it as consumer health data.

#3. The consumer health data we collect

Category: disability status, as a voluntary self-identification answer.

What it looks like in oyapilot: a single choice you can save in your Application Profile, matching the options US employers commonly offer, for example:

• "Yes, I have a disability (or previously had a disability)";
• "No, I do not have a disability"; or
• "I do not wish to answer".

What we do not ask for: we do not ask what your disability is, or for any diagnosis, condition, treatment, medication, accommodation need or medical record.

#4. Health data we do not collect

oyapilot does not collect or create:

• health conditions, diagnoses, symptoms, treatments, medications or medical history;
• information about reproductive or sexual health, gender-affirming care or substance use;
• biometric data (our voice mock interviews do not create voiceprints, and we do not keep recordings of your voice);
• genetic data;
• precise location, including location that could show a visit to a health care provider; or
• inferences about your health from other information. We do not analyze your résumé, answers, messages, employment gaps or activity to guess anything about your health.

If you include health information in your own content (for example, if your résumé mentions a medical leave, or you type health details into an answer or an interview practice session), we process that content only to provide the feature you are using, such as tailoring the document or scoring the answer, and we protect it under this policy. We do not extract it, label it or use it for anything else. We recommend leaving health information out of application materials unless you want employers to see it.

#5. Why we collect it and how we use it

We collect your disability self-identification answer only so that oyapilot can:

1. fill the voluntary disability self-identification question on job application forms that you authorize oyapilot to fill or send, including through Hybrid approvals and Autopilot; and
2. show your saved answer back to you in your Application Profile so you can review, change or delete it.

We also process it as strictly necessary to keep it secure, to comply with the law, and to respond to your requests under this policy.

We never use it to:

• calculate ghost-risk scores, fit scores or any other score;
• choose, rank, filter or recommend jobs;
• decide whether or where to apply;
• create a profile of you;
• infer anything about you;
• advertise to you or anyone else; or
• train or improve any AI model.

Our AI features do not receive your disability answer. The application engine's AI field-matching step is told only that an answer to a self-identification question is available, not what the answer is.

#6. Where it comes from

Only from you, when you choose to enter it in your Application Profile. We do not obtain it from any other source.

#7. Your consent

#7.1 Two separate consents

Because the law treats collecting health data and sharing it as different things, oyapilot asks for two separate, specific consents, each an unticked checkbox you must choose yourself:

1. Consent to collect and store. You agree that oyapilot may save your disability self-identification answer in your Application Profile.
2. Consent to share with employers. You agree that oyapilot may send that answer to employers, in the disability self-identification question on applications you approve or that Autopilot sends for you.

You can give the first without the second. In that case, we keep your saved answer for you to view, and we leave the question on each application for you to answer yourself.

#7.2 What we tell you before you consent

Before you consent, oyapilot shows you:

• the category of data (disability self-identification);
• why we collect it and exactly how we use it (Section 5);
• who we share it with (Section 8);
• that giving it is optional and that saying no does not affect anything else in oyapilot; and
• how to withdraw consent at any time.

The exact wording of these consent screens is kept in our consent records, together with the date and time you agreed.

#7.3 Withdrawing consent

You can withdraw either consent at any time in your Application Profile, in one step.

• If you withdraw consent to share, oyapilot stops sending your answer to employers immediately, for every application that has not already started.
• If you withdraw consent to collect, we stop using your answer and delete it from your Application Profile within 7 days, and from our backups on the schedule in Section 10.

Withdrawing consent does not affect applications already sent (Section 17).

#8. Who we share it with

#8.1 Categories of consumer health data we share

Disability self-identification answers, and only with your consent to share.

#8.2 Categories of third parties we share it with

#8.3 Our processors

These companies store or process the answer for us, under written contracts that limit them to processing it on our instructions to provide our service. They may not use it for their own purposes.

#8.4 Affiliates

Oyatco LLC has no affiliates that receive consumer health data.

#8.5 Legal disclosures

We may disclose consumer health data if the law requires it, for example in response to a valid court order, and only to the extent required. Where the law allows, we will tell you first.

#8.6 A list of the specific employers

When you ask, we will give you a list of every employer and hiring system your disability answer was sent to, with the date of each application and the contact information we have for each (Section 12).

#9. We do not sell consumer health data

We do not sell consumer health data, and we never have. We do not exchange it for money or anything else of value, and we do not give it to data brokers, advertisers or any other third party for their own use.

#10. How long we keep it

#11. How we protect it

• It is stored in a separate, restricted database table from the rest of your profile, protected by row-level security so that only your account, and the services that fill your applications, can read it.
• It is encrypted in transit and at rest.
• Access by oyapilot personnel is limited to people who need it to provide the service to you, maintain security, or respond to your requests, and they are bound by confidentiality obligations.
• It is not available through the MCP server, not sent to our AI providers, not included in analytics, and not included in email notifications.
• Our processors are bound by contracts that require them to protect it.

#12. Your rights

You have the right to:

1. Confirm and access. Confirm whether we collect, share or sell your consumer health data, and get a copy of it.
2. Know who received it. Get a list of all third parties and affiliates with whom we have shared your consumer health data, together with an active email address or other online way to contact each of them.
3. Withdraw consent. Withdraw your consent to collection or to sharing at any time (Section 7.3).
4. Delete. Have your consumer health data deleted. When we delete it, we will also tell our processors to delete it. We will delete it from archives and backups within 6 months of your request, and we will not use or access it in those systems in the meantime.
5. Appeal any decision we make about your request (Section 14).
6. Not be discriminated against for exercising these rights (Section 16).

We do not charge for these requests. You may make at least two requests a year free of charge. If a request is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or decline it, and we will explain why.

#13. How to exercise your rights

• Yourself, in the app. In your Application Profile you can view, change and delete your answer and withdraw either consent at any time.
• By email. Write to privacy@oyapilot.ai from the email address on your account, with the subject "Consumer health data request", and tell us which right you want to exercise.

Verification. If you are signed in, or you write from your account email, that is usually enough. Otherwise we will send a confirmation to your account email. We use information you give for verification only to verify you.

Authorized agents. Someone you authorize may make a request for you. We will ask for proof of their authorization and may ask you to confirm your identity directly.

Parents and guardians. If a user is 16 or 17, their parent or legal guardian may make requests on their behalf after we verify the relationship.

Timing. We will respond within 45 days of receiving your request. If we need more time, we may extend this once by up to 45 more days where reasonably necessary, and we will tell you why within the first 45 days.

#14. Appeals

If we decline your request, in whole or in part, we will tell you why. You can appeal by replying to our decision, or by emailing privacy@oyapilot.ai with the subject "Consumer health data appeal", within 60 days. Someone who was not involved in the original decision will review it, and we will tell you the outcome in writing, with our reasons, within 45 days of receiving your appeal.

If we deny your appeal, you can contact:

• Washington: the Washington State Attorney General, at atg.wa.gov/file-complaint;
• Nevada: the Nevada Attorney General, at ag.nv.gov;
• Connecticut: the Connecticut Attorney General, at portal.ct.gov/ag; or
• the attorney general or consumer protection authority where you live.

#15. No geofencing

We do not use geofences, meaning virtual boundaries around a physical location, around health care facilities or for any other purpose. We do not collect precise location from your device at all.

#16. No discrimination

We will not deny you the Services, charge you a different price, or give you a different level or quality of service because you declined to give your disability answer, declined either consent, withdrew consent, or exercised any right in this policy. Declining only means that oyapilot leaves that one question for you to answer on each application.

#17. Employers and what happens after an application is sent

When your disability answer is sent to an employer, the employer and its hiring system receive it and control it from then on, under their own privacy policies and the law that applies to them. In the United States, employers that collect disability self-identification (for example, federal contractors using the Office of Federal Contract Compliance Programs form CC-305) generally must keep it separate from application materials reviewed by hiring decision makers, and may not use it to discriminate against you. We cannot control or verify how any employer handles it.

We cannot delete answers already sent to employers. To ask an employer about or delete information it holds, contact the employer directly. When you ask, we will give you the list of employers that received your answer (Section 8.6).

If you would rather decide employer by employer, keep the consent to share switched off and answer the question yourself on each form, or approve applications one at a time in Hybrid mode and review each form first.

#18. How deletion reaches every copy

When you delete your disability answer, withdraw consent to collect it, or delete your account, we delete the answer from:

If we ever cannot delete a copy (for example, because a legal hold applies), we will tell you which copy, why, and when it will be deleted.

#19. Security incidents involving health data

If a security incident involves consumer health data, we will notify affected consumers and authorities as the law requires, and in any case without unreasonable delay. Our Security and Vulnerability Disclosure Policy explains our incident process.

#20. Our processors' obligations

Every processor that handles consumer health data for us does so under a written contract that:

• limits it to processing the data only on our documented instructions and only to provide its service to us;
• requires it to keep the data confidential and secure;
• prohibits it from selling the data or using it for its own purposes; and
• requires it to help us honor your rights, including deletion.

If a processor ever processes consumer health data outside our instructions, it would no longer be acting as our processor, and we would treat that as a breach of its contract.

#21. Questions people ask

Do I have to answer the disability question? No. It is always voluntary, both on oyapilot and on employers' forms. If you do not save an answer, oyapilot leaves that question for you on each application, or sends the application to your Needs You queue.

If I save "I do not wish to answer", is that health data? It says nothing about your health, but we protect it in exactly the same way.

Can employers see my answer before deciding whether to interview me? That depends on the employer's hiring system and practices, which we do not control. Many US employers are required to keep self-identification answers separate from the application materials hiring managers review. If you are unsure, leave the question to answer yourself on each form, where you can read the employer's own notice first.

Does oyapilot's AI know my answer? No. Our AI features never receive it.

Does my answer affect which jobs oyapilot shows me or how they are scored? No. It is never used to choose, rank, score or filter jobs.

Can I use the answer on some applications and not others? Yes. Turn off consent to share and answer the question yourself on the applications where you want to. Or keep sharing on, and approve applications one by one in Hybrid mode, where you see each filled form before it is sent.

I live outside Washington, Nevada and Connecticut. Does this policy apply to me? Yes. We apply it to every user.

Who can I contact if I have a concern? privacy@oyapilot.ai. If you are not satisfied, you can contact your state attorney general (Section 14).

#22. Changes to this policy

We will update this policy if our practices change. The "Last updated" date shows the latest change. We will not collect new categories of consumer health data, use it for a new purpose, or share it with new categories of recipients without first updating this policy and obtaining your consent.

#23. Contact

Email: privacy@oyapilot.ai (subject: "Consumer health data")

Oyatco LLC is an online business based in Texas, United States.

The general oyapilot Privacy Policy is at oyapilot.ai/privacy.