Regulusys Terms of Service and Privacy Policy

1. DEFINITIONS

• Service: the websites, web app, live AI video sessions, apps and related services described above, offered by Regulusys, LLC.
• AI Persona: a character you talk with in the Service, with a face, a voice and a memory, whose words are generated by artificial intelligence. Every AI Persona is software, not a person.
• AI Output: any text, speech, summary, note, estimate or suggestion generated by AI in the Service.
• Participating Practice: a licensed healthcare provider that offers the Service to its own patients, for example a check-in or consultation guided by an AI assistant that speaks for that practice.
• Personal Data: information that identifies, relates to, or can reasonably be linked to you.
• Consumer Health Data: Personal Data that identifies your past, present or future physical or mental health status, as defined by the Washington My Health My Data Act, Nevada SB 370 and similar laws. Section 9 describes it.

2. ELIGIBILITY AND ACCOUNTS

2.1 Age. You must be at least 18 years old, or the age of majority where you live if that is higher. The Service is not directed to anyone under 18.

2.2 Where it is offered. The Service is offered in the United States. If you use it from elsewhere, you do so on your own initiative and are responsible for following local law.

2.3 Your account. Some features need an account, created with an email and password or with Google Sign-In. Accounts may be reviewed and approved before they open. Give accurate information, keep your password secure, do not share your account, and tell us at [email protected] if you think someone else has used it. You are responsible for activity under your account.

2.4 Guests. If someone invites you to a session by link, these Terms apply to your use of that session.

3. NOT MEDICAL ADVICE

3.1 General wellness and information. Regulusys products are designed for general wellness, education and information. They are not medical devices, have not been approved or cleared by the U.S. Food and Drug Administration (FDA), and are not intended to diagnose, treat, cure, mitigate or prevent any disease or condition.

3.2 No clinician–patient relationship with Regulusys. Using the Service does not create a doctor–patient, therapist–client or other professional relationship with Regulusys. AI Personas are not licensed professionals. AI Output is not medical, psychological, nutritional, legal or other professional advice, and it is not a substitute for professional care.

3.3 Always ask a licensed clinician. Talk to your doctor or another qualified, licensed clinician about any health question, and before you start, stop or change any medication, diet, supplement, exercise or treatment. Never disregard professional advice or delay seeking it because of something in the Service.

3.4 GLP-1 and other medications. Where the Service lets you log medications such as GLP-1 receptor agonists (for example semaglutide or tirzepatide), their doses and their side effects, it is a record-keeping tool. Regulusys does not prescribe, sell, compound, dispense or supply any medication, does not employ the prescriber, and does not tell you what dose to take. Follow your prescriber’s instructions and the medication’s labeling, and report side effects to your prescriber. Do not use the Service to adjust a dose.

3.5 Estimates, not guarantees. Calorie and nutrient values, goal dates, longevity scores, biological-age estimates and plain-language explanations of lab results are estimates based on the data available and general reference information. They can be wrong. Individual results vary, and we do not promise any weight-loss, fitness, anti-aging, longevity or other health outcome.

3.6 Participating Practices. When you use the Service through a Participating Practice, any medical care is provided by that practice and its licensed clinicians, who remain responsible for it. AI Output prepared for a practice is a draft for its clinicians to review; it is not a diagnosis or a treatment plan until a clinician makes it one. The practice’s own consent forms and notice of privacy practices also apply.

4. EMERGENCIES AND CRISIS

4.1 The Service is not for emergencies. If you think you may have a medical emergency, or you are in danger:

• Call 911 in the U.S., or your local emergency number, or go to the nearest emergency room;
• For a mental health or suicidal crisis in the U.S., call or text 988 (the 988 Suicide & Crisis Lifeline), or visit 988lifeline.org;
• Outside the U.S., find a local crisis line at findahelpline.com.

4.2 No monitoring. The Service is not monitored in real time by people. AI Personas are instructed to point you to emergency help when you mention a crisis, but they cannot call emergency services for you, may not recognize every emergency, and must not be relied on to do so.

5. AI PERSONAS AND AI DISCLOSURE

5.1 You are talking with AI. The faces and voices you talk with in the Service, including Homa, the AI companion, and any AI assistant that speaks for a Participating Practice, are AI Personas generated by software. Each is labelled with its name in the Service. Other people appear in a session only if you, or someone you invited, bring them in.

5.2 Real people’s likeness. An AI Persona that uses the name, face or voice of a real person, such as a physician of a Participating Practice, does so only under that person’s written licence. It is an AI assistant speaking for that person or practice, not the person.

5.3 Limits of AI. AI Output is generated probabilistically. It can be incomplete, out of date or wrong, and it can sound confident when it is wrong. Figures that our software computes (for example calorie totals from USDA FoodData Central) are labelled as computed or estimated where the Service shows them. Check anything important with a qualified professional.

5.4 Memory. AI Personas remember what you share so that later sessions can build on earlier ones (see Section 8). You can ask an AI Persona, or us, to forget something you said.

5.5 By using the Service you acknowledge that you understand you are interacting with AI, and the limits described in Sections 3 to 5.

6. ACCEPTABLE USE

You agree not to:

• Use the Service if you are under 18, or on behalf of someone else without their permission;
• Present AI Output as advice from a licensed professional, or use the Service to practise medicine, psychology or another licensed profession;
• Record, share or publish another person’s session, image or voice without their consent;
• Upload content that is unlawful, infringing, harassing, sexually explicit, or that contains another person’s health information without authorization;
• Try to get an AI Persona to produce harmful content, or to bypass its safeguards;
• Reverse-engineer, scrape, overload, probe or interfere with the Service, or access it by automated means except as we allow;
• Break any law or anyone’s rights while using the Service.

We may suspend or close accounts that break these rules, and remove content that does.

7. INFORMATION YOU SHARE ABOUT OTHERS

If you invite others to a session, or tell an AI Persona about other people, share only what you have the right to share. Anyone you invite is bound by these Terms when they join.

8. PRIVACY POLICY

This Privacy Policy explains how Regulusys, LLC collects, uses, shares and protects Personal Data through the Service, and the choices and rights you have. It is our notice at collection under California law. MyHoma (myhoma.com and the MyHoma app) is operated by MY HOMA, LLC under its own privacy policy; Regulusys does not share your Personal Data with MY HOMA, LLC.

8.1 What we collect

• When you visit regulusys.com: the requests your browser makes (IP address, browser and device type, pages requested, time), handled by our hosting and by Cloudflare. The public pages set no cookies of their own and use no analytics, advertising or tracking tools.
• Account and profile: email address; a password, stored only as a salted hash; your Google account name and email if you use Google Sign-In; and what you add to your profile, such as name, username, date of birth, address, phone number and SMS preference.
• Onboarding answers: your answers to the short wellbeing questionnaire when you sign up.
• Sessions with AI Personas: your voice (microphone audio), periodic still images from your camera while it is on, the transcript of what both sides said, an audio recording of the session (both sides), the AI’s notes and summaries, and facts you share that the AI Persona remembers for next time. Your camera is also used, in your own browser, to estimate a coarse expression label (for example “smiling” or “tense”); only that label is sent to us, never the video it was read from.
• Check-ins and consultations with a Participating Practice: your consent signature (typed name and drawn signature), health history, symptoms, medications and readings you give (such as temperature, blood pressure, pulse, oxygen and weight).
• Regulusys App (when it becomes available): what you choose to log or connect, such as meals, photos of plates and menus, barcodes, voice entries, weight and measurements, workouts, sleep, medications and their side effects (including GLP-1 medications), lab results, and data from Apple Health or Google Health Connect if you connect them.
• Payments: your plan, sessions billed, invoices and payment status. Card details are entered on Stripe’s pages and are held by Stripe, not by us.
• Messages to us: what you send to [email protected] or in support requests.
• Likeness recordings: if you record your face and voice for an AI Persona under a written licence with us, those recordings and the voice and face models made from them. This applies only to people who sign such a licence.

Much of the information above about your health, mood and wellbeing, and the session recordings, is sensitive personal information and Consumer Health Data. Section 9 adds detail for Washington, Nevada and other states.

8.2 Where it comes from

From you; from your browser and device; from Google if you use Google Sign-In; from Stripe about payments; from a Participating Practice if you use the Service through it; and from Apple Health or Google Health Connect only if you connect them.

8.3 Why we use it

• To provide the Service: run your account, hold live sessions, give AI Personas the context and memory you expect, and prepare notes for you or, if you use the Service through one, for your Participating Practice;
• To verify your phone number or email address, and to send you account and service messages;
• To bill for plans and sessions you choose;
• To keep the Service safe and working: security, preventing abuse, fixing faults, and quality and safety review of sessions by a small number of authorized staff;
• To improve the Service, including the quality and safety of our AI Personas;
• To meet legal obligations and enforce these Terms.

We use sensitive personal information only to provide the Service you asked for, to keep it safe and secure, and for the other purposes California law permits without a right to limit. We do not use it to infer characteristics about you for advertising.

8.4 Who receives it

We do not sell Personal Data, and we do not share it for cross-context behavioral advertising. We disclose it only to the service providers that run parts of the Service for us, under contracts that limit their use to that work, and as described below:

• Google LLC: the Gemini API (speech recognition, AI responses, voice synthesis, the camera stills it is shown, and search indexing of your notes); Google Sign-In; Gmail, to send account emails; and Google Fonts, which serves the site’s typeface and so receives your IP address and browser details.
• Cloudflare, Inc.: network delivery and security for every request to regulusys.com.
• Avatar video providers (Anam, Simli or HeyGen, depending on the session): they receive the AI Persona’s synthesized voice and render its face as video streamed to your browser, so they also receive your connection data. Some sessions use a renderer we run ourselves instead.
• Stripe, Inc.: payments, subscriptions and invoices.
• Twilio Inc.: text messages for phone verification and, if you opt in, account messages.
• jsDelivr and Google Cloud Storage: your browser downloads the open-source face-landmark model used for the expression label from them; they receive your IP address, not your camera images.
• A Participating Practice, when you use the Service through it, for its care of you.
• Others when required: to comply with law or valid legal process, to protect anyone’s safety, or as part of a merger, financing or sale of our business, subject to this Policy.

Our database, session recordings and search index are stored on servers we operate in the United States.

8.5 HIPAA

When we handle information for a Participating Practice that is a covered entity under HIPAA, we do so as its business associate under a business associate agreement, and HIPAA and the practice’s notice of privacy practices govern that information where they apply.

8.6 How long we keep it

• Account, profile, session recordings, transcripts, notes and remembered facts: while your account is open, and deleted or de-identified within 45 days after you delete your account or ask us to delete them, unless the law requires us to keep them longer;
• Records a Participating Practice must keep: as long as the practice’s legal obligations and our agreement with it require;
• Billing records: for as long as tax and accounting law requires (generally seven years);
• Consent records: for as long as we keep the data they cover, plus any period the law requires;
• Server logs: for a limited time needed for security and fault-finding.

8.7 Security

We use encryption in transit (HTTPS), store passwords only as salted hashes, sign session cookies, and limit staff access to session content to authorized people who need it. No system is perfectly secure; if a breach affects your Personal Data, we will notify you as the law requires.

8.8 Cookies and similar technology

The public pages of regulusys.com set no cookies of their own. The web app uses a sign-in cookie (homa_session, up to 30 days), a short-lived cookie that protects Google Sign-In, and your browser’s local storage for display preferences. These are strictly necessary for the app. Cloudflare may set its own security cookies. We do not use advertising or cross-site tracking cookies. We honor Global Privacy Control signals as a request to opt out of sale and sharing, which we do not do in any case.

8.9 Your choices

• You can turn your camera off in a session; the AI Persona then receives no images.
• You can ask an AI Persona, or us, to forget something; and you can ask us to delete a recording, a session or your whole account.
• You can opt out of text messages by replying STOP, and of non-essential emails by the link in them or by writing to us.

8.10 Children

The Service is not directed to, and we do not knowingly collect Personal Data from, anyone under 18. If you believe a minor has given us Personal Data, write to [email protected] and we will delete it.

8.11 Automated decisions

We do not make decisions that produce legal or similarly significant effects about you solely by automated means. AI Output about your health is information for you or a draft for your clinician.

8.12 Outside the United States

The Service is operated from, and your data is stored in, the United States. If you use it from another country, your data is transferred to the United States. Where the law of your country gives you rights such as access, correction, deletion, objection or portability, write to us and we will honor them as that law requires.

8.13 Changes

If we change this Policy materially, we will post the new version here with a new effective date and, where the law requires, tell you by email or in the app or ask for your consent first.

9. CONSUMER HEALTH DATA PRIVACY POLICY

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 (NRS 603A) and similar laws, including Connecticut’s consumer health data provisions. It applies in addition to Section 8.

9.1 Consumer Health Data we collect

Your onboarding wellbeing answers; what you say about your health, mood and wellbeing in sessions, with its recordings, transcripts, notes and remembered facts; the expression labels described in Section 8.1; health history, symptoms, medications and readings you give in a check-in or consultation; and, in the Regulusys App when available, the nutrition, body, activity, sleep, medication and lab data you log or connect.

9.2 Why we collect and use it

Only to provide the Service you asked for (sessions, memory, notes, tracking and, through a Participating Practice, the visit you booked), to keep it safe and secure, and to meet legal obligations. We collect and share Consumer Health Data only with your consent or as necessary to provide the Service you requested.

9.3 Sources

You; your device (microphone and camera, while a session is open); a Participating Practice; and Apple Health or Google Health Connect if you connect them.

9.4 Who we share it with

The processors listed in Section 8.4 that handle session content (Google for the Gemini API, the avatar video providers, Cloudflare for transport), Twilio and Stripe only for the limited data they need, and a Participating Practice when you use the Service through it. We do not share Consumer Health Data with MY HOMA, LLC or any other affiliate.

9.5 What we do not do

• We do not sell Consumer Health Data, and would not do so without your separate, signed authorization;
• We do not use it for advertising;
• We do not use geofencing around places where health care is provided.

9.6 Your rights

You may: confirm whether we collect, share or sell your Consumer Health Data; access it, including a list of all third parties and affiliates with whom we have shared it and how to contact them; withdraw your consent; and have it deleted, which we will also pass on to our processors. We respond within 45 days, which may be extended once by 45 days where reasonably necessary, and we will tell you if we do. We will not discriminate against you for exercising these rights.

To use these rights, follow Section 10.4.

10. U.S. STATE PRIVACY RIGHTS AND HOW TO USE THEM

Depending on where you live, laws such as the California Consumer Privacy Act as amended by the CPRA, and the privacy laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states, give you rights over your Personal Data. We honor the requests below from any U.S. user, whether or not a particular law applies to us.

10.1 Your rights

• Know and access: the categories and specific pieces of Personal Data we hold about you, where it came from, why we use it, and who receives it (and, in Oregon and Minnesota, the specific third parties);
• Correct inaccurate Personal Data;
• Delete Personal Data;
• Portability: a copy in a usable format;
• Opt out of the sale or sharing of Personal Data, targeted advertising, and profiling with significant effects — none of which we do;
• Limit or consent to the use of sensitive personal information — we use it only as Section 8.3 describes, and where the law requires consent for health data, we ask for it;
• Non-discrimination: we will not deny you service, charge you differently or treat you worse for using these rights.

10.2 Categories under California law

In the past 12 months we collected: identifiers (name, email, phone, IP address); customer records (address, date of birth, billing records); commercial information (plans and purchases); internet activity (requests to our servers); audio and visual information (session audio, recordings and camera stills); sensitive personal information (account login, health and wellbeing information, and, for licensors only, biometric data from likeness recordings); and inferences (session notes and remembered facts). Sources, purposes, recipients and retention are in Sections 8.2 to 8.6. We disclosed each category only to the service providers in Section 8.4 for a business purpose, and did not sell or share any of it.

10.3 Verification and agents

We verify a request by matching it to the email on your account (for example by asking you to confirm from it). An authorized agent may make a request for you with your signed permission, and we may ask you to confirm it directly.

10.4 How to make a request

Email [email protected] with the subject “Privacy request”, or write to Regulusys, LLC, 2602 Kelly Lane, Lake Worth Beach, FL 33460, or call +1 (305) 339-9576. To delete your account and its data, send “Delete my account” from the email on the account. We respond within 45 days, extendable once by 45 days where the law allows.

10.5 Appeals

If we decline your request, you may appeal by replying to our decision, or by emailing [email protected] with the subject “Privacy appeal”, within a reasonable time. We will respond in writing within 45 days (60 days in Colorado), explaining what we did and why. If you are not satisfied, you may contact your state attorney general, including the Washington State Attorney General at atg.wa.gov or the Nevada Attorney General at ag.nv.gov.

11. FEES, SUBSCRIPTIONS AND REFUNDS

11.1 What is paid. Some features are free. Others are paid under the plan shown to you before you buy: a monthly subscription, a price per session, or a price per minute. Prices and what each plan includes are shown before you agree to pay.

11.2 Subscriptions renew automatically. A monthly subscription renews each month at the price shown, and is charged to your payment method through Stripe, until you cancel. We will tell you the price, the billing frequency, any trial period and how to cancel before you subscribe, and give advance notice of any price change.

11.3 Per-session and per-minute plans are billed after the session by an invoice from Stripe, which you can pay on Stripe’s secure page.

11.4 Cancelling. You can cancel at any time in the app where the option is shown, or by emailing [email protected] from the email on your account. Cancellation takes effect at the end of the current billing period, and you keep access until then.

11.5 Refunds. Except where the law requires otherwise, fees already paid are not refundable. If you think you were charged in error, write to [email protected] within 60 days and we will review it. Purchases made through the Apple App Store or Google Play are refunded under their processes.

12. EMAIL AND TEXT MESSAGES

12.1 Account emails (sign-in, verification, invoices and important changes) are part of the Service.

12.2 Text messages. If you give us your mobile number, we send a one-time code to verify it. If you also opt in, we may text you account and session reminders. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent to texts is not a condition of any purchase.

12.3 We do not share mobile numbers or SMS opt-in data with third parties for their marketing. Our SMS provider receives your number only to deliver our messages.

13. INTELLECTUAL PROPERTY AND COPYRIGHT

13.1 Ours. The Service, its software, AI Personas, design, text, images, films and the Regulusys name and star mark belong to Regulusys, LLC or its licensors. We give you a limited, personal, non-exclusive, non-transferable, revocable licence to use the Service under these Terms. You may not copy, modify, resell or redistribute it without our written permission.

13.2 Yours. You keep the rights you have in what you submit. You give us a licence to host, process and use it only to provide and improve the Service as described in the Privacy Policy.

13.3 Copyright complaints (DMCA). If you believe material in the Service infringes your copyright, send a notice under 17 U.S.C. § 512 to our designated agent: Rodin Younessi, Regulusys, LLC, 2602 Kelly Lane, Lake Worth Beach, FL 33460; [email protected]. Include your signature, the work, the material and where it is, your contact details, a statement of good-faith belief, and a statement under penalty of perjury that the notice is accurate and that you are authorized to act. We may close the accounts of repeat infringers.

14. DISCLAIMERS

To the fullest extent the law allows, the Service and AI Output are provided “as is” and “as available”, without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, accuracy and non-infringement. We do not warrant that the Service will be uninterrupted or error-free, or that any result will be achieved. Some jurisdictions do not allow these exclusions, so some may not apply to you.

15. LIMITATION OF LIABILITY

To the fullest extent the law allows:

• Regulusys, LLC, its affiliates, and their managers, members, employees and licensors are not liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, data or goodwill, arising from or related to the Service;
• Our total liability for all claims related to the Service is limited to the greater of US $100 or the amount you paid us in the 12 months before the claim;
• Nothing in these Terms limits liability for gross negligence, willful misconduct, death or personal injury caused by negligence, or anything else that cannot be limited by law.

16. INDEMNIFICATION

You agree to indemnify and hold harmless Regulusys, LLC and its affiliates, managers, members, employees and licensors from claims, losses and costs (including reasonable attorneys’ fees) arising from your breach of these Terms or your misuse of the Service, to the extent the law allows.

17. DISPUTE RESOLUTION, ARBITRATION AND GOVERNING LAW

17.1 Talk to us first. Before filing a claim, email [email protected] with a description of the dispute. We will try to resolve it informally within 60 days.

17.2 Binding individual arbitration. If we cannot, you and Regulusys agree that any dispute arising from or relating to these Terms or the Service will be resolved by binding individual arbitration administered by the American Arbitration Association (AAA) under its Consumer Arbitration Rules. The arbitration will take place in Palm Beach County, Florida, or by video or in your county of residence if you prefer. The Federal Arbitration Act governs this Section. Fees are paid as the AAA Consumer Rules provide.

17.3 Exceptions. Either of us may bring an individual claim in small-claims court, and either of us may seek an injunction in court to stop infringement of intellectual property.

17.4 Class action and jury waiver. Claims may be brought only individually, not as a plaintiff or class member in any class, collective or representative proceeding. You and Regulusys each waive the right to a jury trial.

17.5 Opting out. You may opt out of this arbitration agreement within 30 days after you first accept these Terms by emailing [email protected], or writing to the address below, with your name, the email on your account and a statement that you opt out of arbitration. Opting out does not affect any other part of these Terms.

17.6 Governing law and courts. These Terms are governed by the laws of the State of Florida, without regard to its conflict-of-law rules. Any claim not subject to arbitration will be brought only in the state or federal courts located in Palm Beach County, Florida, and you and Regulusys consent to their jurisdiction. This does not take away any protection the law of your state of residence gives you and that cannot be waived by agreement.

17.7 Legal notices go to Regulusys, LLC, Attn: Rodin Younessi, Registered Agent, 2602 Kelly Lane, Lake Worth Beach, FL 33460, USA.

18. TERMINATION

You may stop using the Service and ask us to delete your account at any time (Section 10.4). We may suspend or end your access if you break these Terms, if the law requires it, or if we stop offering the Service, and will tell you where reasonable. Sections that by their nature should survive, including Sections 3, 4, 13 to 17 and 21, survive termination.

19. ACCESSIBILITY

We want the Service to be usable by everyone, and we work toward the Web Content Accessibility Guidelines (WCAG) 2.1, level AA. If something is hard to use, or you need this document in another format, write to [email protected] or call +1 (305) 339-9576 and we will help.

20. CHANGES AND GENERAL TERMS

We may update these Terms. The effective date at the top shows when they last changed. For material changes we will notify you by email or in the app before they take effect. If you keep using the Service after that, the updated Terms apply; if you do not agree, stop using the Service and you may close your account. Changes to the arbitration agreement do not apply to disputes already pending.

If any part of these Terms is found unenforceable, the rest stays in effect. These Terms, with any plan terms shown at purchase, are the whole agreement between you and Regulusys about the Service. We may not assign them except with our business; you may not assign them without our consent.

21. CONTACT US

Regulusys, LLC — 2602 Kelly Lane, Lake Worth Beach, FL 33460, USA

Florida limited liability company · Document No. L26000480261 · Manager and registered agent: Rodin Younessi

Email: [email protected] · Phone: +1 (305) 339-9576 · regulusys.com

MyHoma: MY HOMA, LLC (Florida Document No. L25000216281), a Regulusys company — myhoma.com · [email protected]