Privacy Policy

Effective September 2, 2026

The rest of this document is the precise version which governs.

Part 1: The dalton.health website

What we collect

When you submit the founding-slot application form, we collect:

• Your name and your team or unit
• Your email address
• The professional segment you selected (e.g., Emergency Services, Clinical Practice)
• What you tell us you are trying to solve
• The date and time of your submission
• The country your submission came from, as reported by our network provider
• Whether you ticked the box asking us to email you about Dalton's progress, and the exact wording you agreed to

We record the country your submission came from. We do not retain your IP address.

Why we collect it, and on what basis

We use your application to evaluate your request for a founding slot and to reply to you about it. The lawful basis is that you asked us to: taking steps at your request before entering an agreement, and our legitimate interest in running an application process for a product that is invite-only.

We will only add you to a general mailing list about Dalton if you ticked the box on the form asking us to. That box is optional, unticked by default, and separate from your application. If you leave it unticked we will still read your application and reply to you; we simply will not email you about anything else. The lawful basis for those emails is your consent. Every email we send carries an unsubscribe link that removes you immediately, and you can also write to privacy@dalton.health. Withdrawing consent does not affect your application, and we will still reply to it.

We will not sell or rent your data. We will not share it with third parties for their own marketing.

Where your data is stored

Your application is stored in a private system operated by Cloudflare, our hosting and network provider, and a copy is sent to us by email through Resend, a transactional email provider. Cloudflare stores the record on our behalf. Resend processes the message for the sole purpose of delivering it to us. Neither uses your data for their own purposes. Both act as our processors under written terms.

Dalton is a United States company, incorporated in Delaware, and your application is stored and read in the United States. If you apply from the United Kingdom, the European Economic Area, or Switzerland, that means your data is transferred out of your region. We rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where it applies, as the basis for that transfer.

How long we keep it

If we do not offer you a slot, we keep your application no longer than necessary to evaluate and respond to it, and no more than 24 months from your last contact with us. If we do, your record becomes part of your customer relationship and is kept for as long as that relationship lasts. If you asked us to email you about Dalton's progress, we keep your email address and your consent record until you unsubscribe, and for up to 24 months afterwards so we can show when you unsubscribed.

You can ask us to delete your data sooner. Write to privacy@dalton.health and we will remove it within 30 days.

Cookies

We do not use analytics, tracking pixels, or advertising cookies. Any cookies the site sets are strictly necessary to serve pages, and third-party resources we load, such as web fonts, may set their own under their providers' policies.

Part 2: The Dalton Sync app

Dalton Sync is a companion app for Dalton. It reads health and fitness data from Apple Health on your iPhone and forwards it to your private Dalton storage, where it becomes part of your record. Dalton is invite-only. If you have not been invited, the app cannot pair and reads nothing.

What the app reads

With your explicit permission, Dalton Sync reads health and fitness data from Apple Health, currently including heart rate and heart rate variability, sleep, respiratory rate and body temperature, VO2 max and active energy, steps and workouts. It requests only what Dalton needs to build your record. iOS shows you the full list before you grant permission and lets you change it at any time.

The reads are one-directional. Dalton Sync never writes to Apple Health and never modifies your records there.

The app uses your camera once, to scan the pairing code shown on app.dalton.health. No photos or video are taken, stored, or transmitted. The camera is used only to read that single code.

Where your data goes

Paired data is sent to your own private storage, isolated from other users' data. Transmission is encrypted in transit.

Your data is stored there as part of your record. You own that record. You can review it, and you can delete your data or revoke the app's access at any time from app.dalton.health.

What we do not do

• We do not use your health data for advertising or marketing.
• We do not sell your health data.
• We do not share your health data with third parties for their own purposes.
• We do not send your health data to third-party analytics services.

Your control over app data

You decide which Apple Health categories Dalton Sync may read, and you can change those permissions in the iOS Health app at any time. Revoking a permission stops new data of that type from flowing. Deleting your account or your data at app.dalton.health removes it from our active systems. Backups and limited audit records are handled as described under Data retention in Part 3.

Children

Dalton Sync is not directed to children and is not intended for anyone under 18.

Part 3: The Dalton platform (app.dalton.health)

This part covers the platform itself: your dashboard, any permissioned clinician view, and the chat feature. It applies to you whether you joined as an individual member or as someone who also manages a team.

What we collect

Dalton works with whichever of the following you choose to connect. None is required, and you can ask us to remove any domain at any time:

• Wearable data (heart rate variability, resting heart rate, recovery scores, sleep stages, respiratory rate, skin temperature, training strain)
• Blood panel results
• Supplement intake records
• Body composition measurements
• Clinical assessment notes
• Injury records and imaging findings
• Genetic data
• Anything else you choose to add over time

We also hold account and identity data (your email address, authentication factors, the team you belong to, and which data domains you have opted into) and technical/audit data (authentication events and a record of every access to your data, who, what scope, when, for how long, without logging the contents of your health data).

We do not collect or store payment card details. We do not sell your health information.

Genetic data is included only if you choose to upload it. We treat it as health data under this policy: it is never sold, never shared with anyone for their own use, and never used for research or to train any model absent your explicit, separate, revocable consent. You can ask us to remove it at any time, as with any other data domain.

Why we collect it, and what we do with it

We use your health data to build your unified record and to generate the analysis and insight the platform provides. If you contact us for support, we may review relevant information to help you. Where the law requires it, such as a valid court order or subpoena, a public health reporting obligation, or an imminent threat to safety, we may disclose the minimum information necessary, and we will notify you where the law allows.

We do not use your data to train or improve any AI model, except through an explicit, separate, revocable consent you grant. Absent that consent, your data is used only to serve you.

Dalton's output is information to inform your decisions and the decisions of people you trust. It is not medical advice, diagnosis, or treatment, and it does not make any determination about your fitness for duty or employment. See the Terms of Service for the full disclaimer.

We will not use or share your health information in any way beyond what is described here without your explicit, separate, revocable consent.

AI processing

We use AI models to answer questions you ask about your own record and to read documents you upload. That processing happens within our own AWS environment in the United States, under the Business Associate Agreement that covers the rest of your data.

We do not disclose your data to any third party for its own use. No external AI provider or third-party AI service receives your data. Your data is not used to train or improve any AI model, except through the explicit, separate, revocable consent described under “Why we collect it, and what we do with it.”

Where a data provider's terms restrict AI processing, we honor those restrictions and do not process that data with AI models.

Where your data lives and how it is protected

When you join, Dalton provisions a private storage space for you alone. Your health data lives there, hosted on Amazon Web Services in the United States, under a signed Business Associate Agreement covering storage, encryption, and the AI processing described above.

Your data is encrypted in storage and in transit, including on connections inside Dalton's own infrastructure. It does not stay only on your device. Your private storage is protected by an encryption key scoped to you alone. Dalton staff and automated processes cannot decrypt your data outside your authenticated session. This is not end-to-end encryption, which would require a key that only you hold. Where valid legal process compels disclosure, we will comply only to the extent required and will notify you where the law permits. No system is completely secure. We cannot guarantee absolute security, and if your data is ever affected we will notify you as described under Legal disclosures and breach notification.

Sharing with a clinician or coach

By default, only you see your data.

You may grant a scoped view to a physician, performance specialist, coach, or team manager. When you do:

• You choose exactly which data domains that person can see. You can share recovery and sleep data, for example, without sharing blood panels.
• The grant is time-limited and you can revoke it in real time. Revocation takes effect as soon as you revoke, and nothing further is served afterward. A view already open on someone's screen may remain visible until it refreshes.
• The person you grant never sees your full record, only the specific data you've chosen to share with them.
• Access events are logged with the scope, the timestamp, and the duration, and that log is visible to you.
• Derived indicators, such as a readiness band or an alert, are covered by the same consent as the measurements behind them. Nothing derived from your data is shown to anyone you have not granted.

A grant can be full values or a summary only. If you permit a grantee to export a copy of what you shared, that copy leaves Dalton and revocation does not reach it; we tell you so at the moment you grant it.

If you belong to a team, your manager does not see your personal health data unless you have granted it through these controls. Team membership by itself does not expose your data.

Third parties

We use a small number of service providers to operate the platform. They act only on our instructions, under written terms that bar them from using your data for their own purposes. Our infrastructure provider is Amazon Web Services, under the Business Associate Agreement described above. We do not sell, rent, or share your health data with anyone for their own use.

Your rights

You can view your data in the app at any time, and you can request an export of your record. You can request a correction if something is wrong. You can request that we restrict how your data is used or shared. We will consider any such request and honor it where we can, beyond what is needed to run the platform or meet a legal requirement. You can ask us to communicate with you in a specific way. You can request a list of any disclosures we have made of your data. If your unsecured data is ever involved in a breach, we will notify you without unreasonable delay and no later than 60 days after we discover it. To exercise any of these rights, write to privacy@dalton.health.

How to file a complaint

Email privacy@dalton.health and we will investigate and respond in writing. We will not retaliate against you for raising a concern.

Data retention

We keep your data for as long as your account is active. When you delete your account, we delete your health data from primary storage and permanently remove your private storage within 30 days. Encrypted backups are overwritten on our standard rolling backup cycle, and in any case no later than 90 days after your deletion request. We retain minimal audit-trail metadata, records of who accessed your data, when, and under what scope, not the contents of your health data, for up to six years after account deletion, solely for legal and security audit purposes.

Children

Dalton is not intended for and is not offered to anyone under 18. We do not knowingly collect data from children.

Legal disclosures and breach notification

If Dalton experiences a breach of unsecured health information, we will notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach. We will also notify regulators and, where required, the media, as applicable law requires.

Applies to all parts

Your rights under GDPR and similar laws

Under the GDPR and similar data protection laws, you have the right to:

• Request a copy of the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Receive a copy in a portable, machine-readable format
• Object to, or ask us to restrict, our use of your data
• Withdraw your consent at any time, without affecting anything we did before you withdrew it

To exercise any of these rights, email us at privacy@dalton.health. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you why. If you are in the United Kingdom or the European Economic Area and you think we have handled your data badly, you also have the right to complain to your national data protection authority.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date at the top of this page and, where the law requires it, ask for your consent. Continued use of Dalton after a change takes effect means you accept the updated policy.

Contact

Dalton Systems, Inc. Privacy Officer: Sean Wolpert Email: privacy@dalton.health General inquiries: feedback@dalton.health

We do not currently operate a physical office. All inquiries should be submitted by email.