Moku Consumer Health Data Privacy Policy

Document version: chd-v1 Effective date: 2026-06-22 Last updated: 2026-06-22

1. Scope

This Consumer Health Data Privacy Policy applies to "consumer health data" as defined under Washington's My Health My Data Act (RCW 19.373). It supplements, and does not replace, our Privacy Policy, which governs all of your information; this policy addresses only the consumer health data of Washington residents and consumers whose consumer health data is collected in Washington.

Moku is operated by Arbor Ray, Inc. (dba "Moku," "we," "our," or "us"). We are a consumer health-education app: you bring in your medical records — by uploading them or by connecting a health system at your direction — and we read, organize, and generate educational explanations of them for you.

2. Categories of consumer health data we collect, and the purpose

We collect the following categories of consumer health data, for the sole purpose of providing the service to you — reading, organizing, and generating educational explanations and suggested questions from your records:

Medical records you provide — documents you upload, such as lab reports, imaging reports, discharge summaries, and visit notes.
Medical records from a connected health system — records retrieved, at your direction, from a hospital, clinic, or other healthcare organization you choose to connect.
Clinical information we extract from those records — for example, conditions and diagnoses, medications, lab and test results, procedures, and the dates of medical events.
Health information in your profile, questions, and notes — what you tell us about the person whose records you are organizing, and any health-related questions or notes you enter.
Educational outputs we generate — summaries, explanations, and suggested topics to discuss with a clinician, derived from your records.

We do not use your consumer health data for advertising, and we do not collect it for any purpose not described in this policy.

3. Categories of sources we collect from

Directly from you — the records you upload and the profile information, questions, and notes you enter.
From a connected health system, at your direction — when you choose to connect a healthcare organization, your records are retrieved by our record-retrieval vendor and delivered to Moku.

4. Categories of consumer health data we share

We share the following categories, only as needed to operate the service for you:

The medical records you bring in.
The clinical information we extract from them.
The educational outputs we generate.

5. Categories of third parties and affiliates we share with

We share consumer health data only as needed to operate the product. The service providers that process consumer health data on our behalf each do so under a Business Associate Agreement, and only to perform their service for us:

Cloud hosting and storage providers — currently Amazon Web Services (secure U.S. storage and hosting).
AI and model providers — currently Google Cloud (Vertex AI / Gemini) for optical character recognition, and OpenAI for reasoning and summarization, under a Business Associate Agreement with Zero Data Retention.
Electronic health record connectivity providers — currently Fasten Health, Inc., which retrieves your records from a connected health system at your direction.
Error and security monitoring providers — to detect and diagnose bugs, crashes, and security events.

We may also disclose consumer health data to legal and compliance recipients — for example, in response to a valid subpoena or court order, or where necessary to protect rights, safety, or the integrity of the product. These disclosures are required by law or necessary for safety; they are not sales or commercial sharing.

Specific affiliates: we have no affiliates with whom we share consumer health data.

We do not sell your consumer health data. We do not share it with advertising platforms, data brokers, or information resellers, and we do not use it for targeted advertising.

6. How to exercise your rights

You have the right to confirm whether we are collecting, sharing, or selling your consumer health data; to access it; to withdraw your consent to its collection and sharing; and to have it deleted, including by any of our processors. To exercise these rights:

In the app — review what we have extracted, disconnect a connected health system, delete a profile, or delete your account at any time.
By email — contact us at info@mokuhealth.ai.

We will respond to a rights request within 45 days of receipt. When reasonably necessary, we may extend that period once by an additional 45 days, and we will notify you of the extension and the reason within the first 45 days.

If we decline your request, you may appeal by replying to our response or emailing info@mokuhealth.ai. The appeal process mirrors the request process, and we will respond in writing within 45 days of receipt, explaining the action we have taken or declined to take. If we deny your appeal, you may submit a complaint to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.

When you delete consumer health data, we delete it from our active systems within a reasonable period; deleted data may persist in encrypted backups for up to six months before it is overwritten on backup rotation.

7. Changes and affirmative consent

We will not collect, use, or share additional categories of consumer health data not disclosed in this policy, or use your consumer health data for purposes not disclosed here, without first disclosing the change and obtaining your affirmative consent. Every processor that handles your consumer health data on our behalf is contractually required to process it consistently with this policy. If we make a material change to this policy, we will update the version and the effective date above.

8. Contact us

To exercise any right described above, or for any question about your consumer health data, contact:

Moku (Arbor Ray, Inc.) Email: info@mokuhealth.ai

Version History

chd-v1 — 2026-06-22 — Initial Consumer Health Data Privacy Policy under Washington's My Health My Data Act.