Gratos

Gratos Consumer Health Data Statement

Notice. Gratos is available by invitation while we add merchants city by city. This document is effective and applies to your use of the service. It will be reviewed by counsel and may be updated as the product develops; material changes will be notified as described in the Changes section. Questions: support@gratos.ai.

Last updated: October 16, 2026

Effective: October 16, 2026

This statement is published at app.gratos.ai/health-privacy. It explains how Gratos Inc. ("Gratos," "we," "us") handles consumer health data under the Washington My Health My Data Act and Nevada SB 370. It supplements our Privacy Policy at app.gratos.ai/privacy. Where the two conflict on consumer health data, this statement controls.

1. What we treat as consumer health data

Gratos is a gifting platform. We are not a healthcare provider. For gifting, the information that can be consumer health data is:

  • Allergies, for example a peanut or shellfish allergy.
  • Medical conditions.
  • Health-related dietary restrictions, for example celiac disease or diabetes.

Lifestyle diets are ordinary preferences. That someone eats vegetarian, vegan, or keto is an ordinary gift preference, not health data. Senders can tell us about it, and it is handled under our Privacy Policy.

We do not ask for or use diagnoses, treatments, medications, symptoms, biometric data, reproductive or sexual health information, gender-affirming care information, or information about visits to healthcare facilities.

2. Whether we collect it

We do not collect it at this time. We do not ask for, or record in anyone's profile, allergies, medical conditions or health-related dietary restrictions. Senders cannot give them to us, and the claim link does not ask recipients for them. Before we begin collecting any consumer health data, we will publish a full Consumer Health Data Privacy Policy at this address.

We do not obtain consumer health data from data brokers, public records, or advertising networks. We do not infer it from purchases, browsing, or anything else.

3. If someone gives us health information anyway

Senders cannot give us a recipient's health information. The agent does not ask senders for it and does not record it from them as a preference. Our Terms of Service tell senders not to provide it.

If a sender, or anyone else, types health information into a conversation with Gratos anyway, we do not store it in anyone's profile. The message stays in that conversation's history like any other message, and conversation history is kept as described in our Privacy Policy. Write to privacy@gratos.ai and we will delete it.

4. How we use and share it

This section does not apply at this time, because we do not ask for, or record in anyone's profile, consumer health data. We do not sell consumer health data.

5. Consent and withdrawal

This section does not apply at this time. We will ask for your separate consent before we collect any consumer health data from you.

6. Retention

This section does not apply at this time. A conversation message containing health information that someone typed anyway is kept with that conversation, as described in our Privacy Policy, until you or the sender asks us to delete it.

7. Your rights

If you live in Washington or Nevada, you have the right to:

  • Confirm whether we are processing your consumer health data.
  • Get a list of the third parties and affiliates we have shared it with, and how to contact them.
  • Have it deleted. We will also direct the service providers that received it to delete it. Copies in our database provider's backups expire on the provider's backup schedule, and we do not restore deleted information from them except to recover from a failure.
  • Withdraw any consent you gave.

How to ask. Email privacy@gratos.ai with your name and the email address, phone number, or delivery address the gift went to. You do not need a Gratos account. We may need to verify your identity, and we will not use verification information for anything else.

We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you before that deadline and take no more than 90 days total.

Appeals. If we deny your request, you may appeal by replying to our decision with the word "Appeal." We will respond within 45 days. If we deny the appeal, we will give you a link to complain to the Washington or Nevada Attorney General.

8. Geofencing

We do not use geofencing around any healthcare facility, and we do not use precise location data at all.

9. Changes

We will update the date at the top when this statement changes. We will not begin collecting consumer health data in a new way without first updating this statement and, where the law requires it, getting your consent.

10. Contact

Gratos Inc. Attn: Privacy c/o Legalinc Corporate Services Inc. 131 Continental Dr, Suite 305 Newark, DE 19713

Consumer health data requests: privacy@gratos.ai Everything else: support@gratos.ai