Privacy Policy

Last updated: November 12, 2026

Privacy at a glance

• We do not sell your personal or health data.
• Who runs Nox's models. Nox Vela 2.5, Nox's everyday chat model, is powered by a model provided by Anthropic through its API. The Nox 2 generation — Nox Orion and Nox Orion Flash (versions 2.1 and 2.5), and the Nox models behind Voice Mode and agent steps — are Nox's own models, not Fireworks AI or OpenAI products; Fireworks AI provides the inference infrastructure that runs them for us. OpenAI services answer messages with a photo when the selected model can't read images and power specific supporting features (see Sections 4 and 6), and ElevenLabs services for Voice Mode speech. Under Anthropic's, OpenAI's and Fireworks AI's API terms, your content is not used to train their foundation models. We send ElevenLabs only the voice audio and response text needed to provide Voice Mode speech features; how ElevenLabs may use that content is governed by its terms and the data-use settings of our ElevenLabs account (see “Retention” below).
• We retain your data while your account is active and delete it within 30 days after you delete your account.
• You can export your data, delete individual conversations, delete your whole account, use Incognito mode (no chat is saved), and opt out of having your chats used to improve Nox — all from inside the app.
• Pebs, Nox's agent, asks first. It works in an isolated browser that runs on Nox's own infrastructure. Anything it sends, buys, or changes on an outside site needs your approval, and the passwords, verification codes, and card details you enter in Pebs's secure cards are typed straight into the browser — never saved and never shown to the AI (see Section 12).
• Nox is a wellness and education tool. It is not a medical device, is not HIPAA‑regulated, and is not a substitute for a clinician.

1. Who we are

Nox is an AI health and wellness assistant provided by Xhealth, Inc. ("Xhealth", "we", "us", or "our"). This Privacy Policy explains what information we collect when you use Nox (the "Service"), how we use and share it, and the choices and controls you have.

This is the official Privacy Policy for the Service. If Nox describes our privacy practices inside a conversation, that description is informational only — this Policy controls.

2. Information we collect

• Account information: your name and email address, managed through our authentication provider (Clerk).
• Conversation content: the messages, prompts, images, and files you send to Nox, and Nox's responses, stored to maintain your conversation history (except in Incognito mode — see Section 11).
• Voice audio: if you use Voice Mode or the composer's voice dictation, the microphone audio you record is transmitted for transcription (see Section 4). We keep the resulting transcript as conversation content; we do not retain the raw audio recording after it has been transcribed and the response generated.
• Health-related information you choose to share in chat (defined in Section 3).
• Payment information: if you subscribe to a paid plan on the web, billing is handled by Stripe. In the iOS app, subscriptions are purchased through Apple's App Store and verified through RevenueCat. We store a customer/subscription identifier and plan status; we do not store your full card number.
• Connected‑service data: if you choose to connect third‑party apps — your own Google account (Calendar events and Docs created by Nox) or your own Todoist account — we access only the data those permissions cover, and Nox only reads it to answer you or writes to it after you approve a confirmation card in chat. The OAuth access tokens for your connections are stored encrypted; we do not store copies of your calendar, documents, or tasks beyond the conversation itself. You can disconnect an app at any time in Settings → Connected apps, which deletes the stored tokens and revokes our access.
• Pebs (agent) data: if you use Pebs, we store each task you create — your goal, the messages in the task, its plan and step history, and any files Pebs creates for you — plus the schedules, email preference, standing preferences, and share links you set up for Pebs (see Section 12).
• Usage and device data: features used, session activity, approximate timing, browser type, operating system, and IP address — used for security, reliability, and product improvement.
• Agreement and consent records: when you tap “I agree” in the iOS account agreement screen, we record your account identifier, the Terms and Privacy Policy versions shown, the AI disclosure version, the app-reported platform, and the server receipt time. We keep a history of AI consent grants and withdrawals to document your choices. Older AI-only consent records do not establish acceptance of the current Terms or Privacy Policy. Offline choices appear in our records only after the app syncs successfully. These records are removed with your account, subject to applicable legal obligations.

3. What we mean by "health data"

Because Nox is a health assistant, you may share sensitive information. "Health data" includes, but is not limited to:

• Sleep data, heart rate, heart‑rate variability (HRV), body temperature, respiratory rate, activity/steps, and other wearable or Aurena Ring–style readings you type or upload
• Apple Health (HealthKit) metrics you choose to sync from the Nox iOS app — daily steps, sleep duration, resting/average heart rate, HRV, active energy, walking distance, blood‑oxygen (SpO2), respiratory rate, body weight, and wrist‑temperature deviation
• Symptoms, conditions, diagnoses, and how you're feeling physically or mentally
• Medication and supplement names, dosages, and schedules
• Lab results, vitals, and measurements (e.g., blood pressure, blood glucose)
• Menstrual / cycle and reproductive‑health information
• Mental‑health information you disclose
• Photos or screenshots you upload (e.g., labels, supplements, meals, rashes, wearable readings, lab reports)
• Location information, only if you choose to share it (e.g., to find nearby care)

You decide what to share. Please avoid sharing more identifying detail than you need (for example, full name, address, or government IDs) inside a conversation.

4. How health data is handled differently

• Encryption: all data, including health data, is encrypted in transit (HTTPS/TLS) and encrypted at rest by our database and hosting providers.
• Used to answer you: health data you share is used to generate relevant responses for you in that conversation.
• AI processing: like other chat content, your messages, any health information you share, images or files you choose to upload, and relevant conversation context are sent to the service that runs the selected model or feature. Answers from Nox Vela 2.5, the everyday chat model (including messages with a photo), are generated by a model provided by Anthropic. Answers from the Nox 2 generation (Nox Orion and Nox Orion Flash, versions 2.1 and 2.5, and the Nox models behind Voice Mode and agent steps) run on Fireworks AI inference infrastructure; those Nox 2 models are Nox's own models, not Fireworks AI models, and Fireworks AI provides the computing that runs them. OpenAI generates the answer when your message includes a photo and the selected model can't read images, and processes content for specific supporting features: generated illustrations, Memory and long-conversation summaries, and daily check-in scoring. The applicable provider can therefore vary by feature, account, or availability. Under the applicable API terms, this content is not used to train third-party foundation models.
• Voice Mode and dictation: in Voice Mode, we send ElevenLabs only the voice audio and the response text needed to produce speech (see Section 6 and “Retention” for how ElevenLabs may use it), while a Nox model running on Fireworks AI infrastructure generates the response. Composer voice dictation — and Voice Mode when live transcription is unavailable — sends your voice audio to OpenAI for transcription only. Nox itself uses voice audio solely to provide these features and does not keep it after the response is delivered.
• Live web search: when you allow Nox to search the web (and in Nox Work, where web access is always on), Nox writes a short search query and sends only that query — never your message, your health details, your identity, or the conversation — to Brave Search, a search index, to get result links; Nox's own servers then read the pages. The query can reflect the topic of your question. On the photo turns that OpenAI processes, the search runs through OpenAI's own search tool instead.
• Pebs (agent): tasks you give Pebs are processed by Nox models on Fireworks AI infrastructure, and Pebs's web searches send only the short search query to Brave Search (never to an AI company). Section 12 explains what Pebs reads, what it never sees, and what it stores.
• Not sold, not advertised: we never sell health data and never use it for third‑party advertising.
• Improvement use is opt‑outable: see Section 5 — you can turn off use of your chats to improve Nox.
• Aurena Ring: Nox does not currently receive a live data feed from the Aurena Ring. It only knows the values you type into Settings or share in chat.
• Apple Health (optional, off by default): if you enable Apple Health sync in the Nox iOS app, the daily metrics listed in Section 3 are read from HealthKit (only the categories you approve in iOS permission prompts) and stored with your account so Nox can show them to you and use them to personalize its answers. When these metrics are used to generate a response, the relevant values are included in the request to the AI provider serving your selected model, under the same no‑training API terms described above. HealthKit data is never sold, never used for advertising or marketing, and never shared with third parties except the AI provider processing your request. You can turn sync off at any time in the app, revoke access in iOS Settings → Health, and delete synced data by deleting your account (or asking us to remove it). We keep roughly the most recent 90 days of synced metrics.

5. How we use your information & how we improve Nox

We use your information to provide and maintain the Service, keep your conversation history, run safety checks (such as detecting potential medical red flags), personalize responses, keep the platform secure, process payments, and meet legal obligations.

The phrase "improve AI responses" can mean many different things, so we separate them clearly:

• Training third‑party models: your chats are not used to train Anthropic's, OpenAI's or Fireworks AI's foundation models, and we never license or sell your content to anyone for model training. Voice audio and necessary response text processed by ElevenLabs for Voice Mode speech features are governed by the data-use settings of our ElevenLabs account, described under “Retention” below.
• Human review: your conversations are not routinely read by people. Limited, authorized personnel may access specific conversations only for support you request, safety, abuse prevention, debugging, or legal compliance (see Section 7).
• Internal improvement & analytics: we may use conversation data to evaluate quality, fix problems, and improve Nox's own prompts and features. Where practical we use aggregated or de‑identified data for this.
• Opt‑out: you can turn off use of your chats for internal improvement at any time in Settings → Privacy & data. This does not affect processing needed to answer you, keep the Service running, or comply with law.

For details on how our medical‑safety checks (red‑flag detection) are built, measured, and governed, see our Trust & Transparency page.

6. Service providers & subprocessors

We share data only with the providers needed to run the Service, and each provider receives only the data needed for its function. We do not sell your data. Every provider processes data under its published API terms and data-processing terms; the specific commitments that matter for your data (training use, retention, encryption) are stated per provider below and under “Retention”. We have opted out of ElevenLabs' use of our account's content for model improvement. This opt-out is not a promise of zero retention. Our current subprocessors are:

• Nox/Xhealth — Nox's own models and AI features, including the Nox 2 generation (Nox Orion and Nox Orion Flash, versions 2.1 and 2.5, and the Nox models behind Voice Mode and agent steps). We may process your messages, images, files, and related context to provide the response or feature you request.
• OpenAI, L.L.C. — processing for specific supporting features: answering messages that include a photo you upload when the selected model can't read images, generated illustrations, Memory and long-conversation summaries, daily check-in scoring, transcription of dictated voice audio (and Voice Mode audio when live transcription is unavailable). Nox Voice 1.2 (beta) was retired on October 17, 2026 and no longer processes any data. Nox Light 1.1 was retired from Nox chat on September 23, 2026 and remains available only in NOX WORK and the Nox developer API. Under OpenAI’s API data policies, API content is not used to train OpenAI models by default, may be retained for up to 30 days for abuse monitoring, and is encrypted in transit and at rest. The specific OpenAI-backed features may change over time.
• Anthropic, PBC — provides the model behind Nox Vela 2.5, Nox's everyday chat model (since November 2026). Receives your text, shared health information, photos and uploaded file text you send in those chats, and conversation context. Under Anthropic's commercial API terms, API content is not used to train Anthropic's models by default.
• Fireworks AI, Inc. — inference infrastructure that runs Nox's models: the Nox 2 generation (Nox Orion and Nox Orion Flash, versions 2.1 and 2.5), including the Nox models that answer in Voice Mode and run agent steps. These are Nox models, not Fireworks AI models; Fireworks AI runs them on our behalf. Receives your text, shared health information, uploaded file text, and conversation context for those models, including the goal, page text, and (on request) page screenshots Pebs sends to the Nox model running your task. Per Fireworks AI’s published data-handling terms, inference requests are handled with zero data retention by default (prompts and responses are not logged or stored) and are not used to train Fireworks models.
• ElevenLabs, Inc. — receives Voice Mode audio and the necessary response text to produce speech. Does not receive your account identity, conversation history, or files. ElevenLabs states that data is encrypted in transit and at rest; its model-improvement data use is described under “Retention”.
• Topaz Labs LLC — only when you explicitly ask Nox to enhance or upscale a photo you attached, or to sharpen an illustration Nox generated for you; that image is sent to Topaz Labs for processing under its API terms.
• Kaleido AI GmbH (remove.bg) — only when you explicitly ask for a transparent background on an illustration Nox generated for you (and, in Nox Work, for photos you attach); the image is sent to remove.bg for processing under its API terms.
• RevenueCat, Inc. — verifies and manages in-app subscriptions purchased through Apple's App Store in the Nox iOS app (receives your account identifier and purchase receipt; never your conversation or health data).
• Apple Inc. — processes in-app purchases in the Nox iOS app under Apple's own terms and privacy policy.
• Brave Software, Inc. (Brave Search API) — the search index behind live web search in Nox chat, Plan mode, Nox Work, Voice Mode, and Pebs. Receives only the short search query Nox or Pebs issues (plus ordinary request metadata such as our server's IP address); never your messages, task goal, page content, files, or account identity. Nox's own servers (or Pebs's cloud browser) then open the pages. Processes queries under the Brave Search API terms.
• Resend, Inc. — delivers the optional Pebs task emails (finished, needs your approval, has a question). Receives your account email address and the email's text: the task title, the approval or question text or error, and a link to the task. Never receives card details, passwords, or the verification codes you enter in Pebs's secure cards.
• Clerk, Inc. — authentication and account management (name, email, sign‑in).
• Stripe, Inc. — payment and subscription processing for paid plans.
• Google LLC — only if you (or your deployment) connect Google services; we access only the scopes you authorize (calendar events and Nox‑created documents for personal connections).
• Doist Inc. (Todoist) — only if you connect Todoist; we access your tasks solely to perform the actions you request and confirm.
• Our cloud infrastructure provider — application hosting and the managed, encrypted PostgreSQL database where your data is stored.

Nox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is used only to provide the features you request, is never sold, never used for advertising, and never used to train AI models.

We may also disclose information when required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice where required). For an up‑to‑date subprocessor list, contact us at Info@Xhealthus.com.

7. Human access to your conversations

Your conversations are not browsed by our team. Human access is restricted to authorized personnel and only for specific purposes:

• Providing support you have requested
• Investigating safety issues, abuse, or security incidents
• Debugging a specific reported problem
• Complying with a valid legal obligation

We limit access to health data, train personnel on handling it responsibly, and require contractors to sign confidentiality obligations.

8. HIPAA & medical‑device status

• Nox is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease.
• Nox is not a replacement for a clinician or for professional medical advice.
• Xhealth, Inc. is not a HIPAA "covered entity", and the Service is not HIPAA‑regulated. Your conversations are protected under this Privacy Policy and applicable consumer‑privacy law, not under HIPAA.

9. Your choices & controls

• AI processing consent (mobile app): the Nox iOS app requires an account and asks for your explicit consent right after you sign in or create an account — you read these Terms, this Privacy Policy and the AI data disclosure in full and tap "I agree" before any message can be sent; nothing is sent to an AI provider before that. You can review or withdraw this consent at any time in Settings → Data controls → AI data & privacy; withdrawing shows the agreement again before your next AI message.
• Incognito mode: start a private chat that is not saved to your history (see Section 11).
• Improvement opt‑out: stop your chats from being used to improve Nox.
• Export your data: download a copy of your account and conversations as a file.
• Delete individual conversations: remove a single chat at any time.
• Connected apps: connect or disconnect your own Google or Todoist account at any time in Settings → Connected apps. Disconnecting deletes the encrypted access tokens and revokes Nox's access; Nox never changes anything in a connected app without an explicit in‑chat confirmation from you.
• Pebs controls: pause, take over, stop, or delete any Pebs task; pause or delete a schedule; turn off Pebs email updates and clear your saved preferences in Pebs settings; and turn off a share link. Nothing is sent, bought, or changed on an outside site without your approval (see Section 12).
• Delete your account: permanently remove your account and associated data.
• Access & correction: depending on your location, you may also have rights to access, correct, restrict, or object to certain processing, and to data portability.

Privacy controls live in Settings → Privacy & data and in the chat itself. You can also email Info@Xhealthus.com.

10. Data retention & deletion

We keep your account information and conversation history for as long as your account is active. When you delete a conversation or your account, here is what happens:

• Chat history: deleted conversations are removed from our active database immediately.
• Account deletion: deleting your account removes your conversations, plan/usage records, connected‑app tokens, and account profile from our active systems, and deletes your sign‑in record with Clerk.
• Pebs tasks: deleting a task removes its messages, step history, and files, and its share link stops working. Usage records without any task content (model usage and charges) are kept for billing until your account is deleted. Files a website offers to download are held only temporarily in the task's sandbox, cleared when the task ends, and in any case within 24 hours.
• Pebs on account deletion: deleting your account also removes all of your Pebs tasks and their contents, schedules, saved preferences, usage records, and share links.
• Backups: residual copies in encrypted backups are purged on a rolling cycle, within 30 days.
• Operational logs: security and diagnostic logs are kept for a limited period and then deleted.
• Nox/Xhealth: content processed by Nox-operated systems is handled under this Privacy Policy and our internal retention and security controls.
• OpenAI: content sent to OpenAI services may be retained by OpenAI for a limited period for abuse monitoring and then deleted, per OpenAI's API data policies.
• Fireworks AI: content sent to Fireworks AI services is processed to generate the response and handled per Fireworks AI's API data policies; it is not used to train their models.
• Anthropic: content sent to Anthropic for Nox Vela 2.5 is processed to generate the response and handled per Anthropic's commercial API terms; it is not used to train their models by default.
• ElevenLabs: we have opted out of model-improvement data use for our ElevenLabs account. Voice audio and necessary response text submitted through that account after the opt-out are excluded from model-improvement use under that setting. This does not mean zero retention or retroactive removal of content submitted before the opt-out; processing and retention for providing the service, security, and legal obligations remain subject to ElevenLabs' applicable terms. Voice audio is not stored by Nox after your Voice Mode response is delivered.

In short: your personal data is deleted within 30 days after account deletion, except where we must retain limited information to comply with law.

11. Incognito mode

When you use Incognito mode, your messages and Nox's responses for that session are not saved to your conversation history and are not stored in our database after the response is delivered. Your messages are still sent to the service operating your selected model (Nox Vela 2.5 via Anthropic, a Nox model running on Fireworks AI infrastructure, or OpenAI for photo messages the selected model can't read) to generate a response, and Nox still runs its emergency checks. Incognito chats still count toward your plan's usage limits. Closing or leaving the Incognito session clears it.

12. Pebs (Nox's agent)

Pebs is Nox's agent. You give it a goal and it plans the steps and carries them out for you — searching the web, reading pages and working in an isolated cloud browser, and creating files. This Policy applies to Pebs like the rest of Nox; this section covers what is specific to it.

• Cloud browser: each task gets its own isolated Chromium browser session that runs on Nox's own infrastructure, not a third-party browser service. Pebs reads the text of the pages it opens and can click and type on your behalf. A live view streams the page to you while the task runs; those frames are held in memory only and are never saved by Nox. You can take over the browser, type yourself, and hand it back. The browser session, including anything you or Pebs signed in to inside it, exists only for the task and is discarded when the session ends.
• AI processing: your goal, the plan, your messages in the task, and the text of the pages Pebs reads are sent to the Nox model running the task, which runs on Fireworks AI inference infrastructure (see Sections 4 and 6). When Pebs needs to understand a page visually, it sends a screenshot of that page to a Nox model. Pages can contain personal information, so only ask Pebs to open pages you are comfortable with it reading.
• Web search and public pages: when Pebs searches the web, only the short search query is sent to Brave Search (Brave Software, Inc.), a search index, to get result links; it never receives your goal, messages, or page content, and no AI company is involved in the search. Public pages Pebs opens are fetched by Nox's servers and browser.
• Files: Pebs can create text, Markdown, CSV, and JSON files from its work. They are stored with the task and available to download in the chat.
• Scheduled tasks: you can ask Pebs to repeat a task on a schedule, in Scheduled or simply in a Pebs chat. To run at your local time, Pebs keeps your device's time zone (for example "America/Los_Angeles") with your Pebs settings. Each run is an ordinary task that uses your plan's credits, and you can pause or delete the schedule at any time.
• Email updates: when a task finishes, needs your approval, or has a question for you, Pebs can email the address on your account. The email contains the task title, the approval or question text (or the error, if the task failed), and a link to the task. It is sent through Resend from noreply@getnox.ai. You can turn these emails off in Pebs settings.
• Saved preferences: standing preferences you write in Pebs settings are added to Pebs's instructions on later tasks. They never authorize a purchase or sending anything.
• Share links: you can create a read-only link to a task. Anyone with the link can read the task's messages and plan step titles; screenshots, files, and sign-in or payment cards are never included. Turning sharing off or deleting the task stops the link from working.
• Passwords, verification codes, and card details: Pebs never asks you to type these into chat. When a site needs them, Pebs shows a secure card and Nox's server types what you enter directly into the task's browser. These values are never saved to our database, logs, or messages and are never shown to the AI model; they are removed from everything the model reads, and the fields are masked in screenshots and the live view. They exist only in that browser session's memory. Card entry works for fields on the checkout page itself. Fields inside a payment provider's embedded frame cannot be filled by Pebs; you take over the browser and type them yourself, and what you type then passes through Nox's servers to the browser in real time and is not stored.
• Approval before anything is sent, bought, or changed: Pebs pauses and asks you to approve the specific action before it sends something, submits a form, places an order, or changes something on an outside site. For purchases, Pebs can fill in a checkout, but only you provide the card details, and placing the order is a separate approval. Nox is not the seller and does not process the payment: your card details go only to the merchant's own checkout, and the merchant and its payment processor handle the order under their own terms.

Pebs acts on your instructions and on pages it reads, and it can make mistakes. Review what you approve.

13. Security

We use industry‑standard safeguards including encrypted transmission (HTTPS/TLS), encryption at rest, secure authentication, and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Children

The Service is intended for adults 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

15. International users & governing law

The Service is operated from the United States and your information is processed there. This Policy is governed by the laws of the State of California, United States, without regard to its conflict‑of‑laws rules.

16. Changes to this Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for significant changes, provide a prominent notice in the Service or by email. Continued use after changes take effect constitutes acceptance of the updated Policy.

17. Contact us

For privacy questions or requests, contact: