Hearo Medical Inc.
This Privacy Policy describes how Hearo Medical Inc. (“we,” “us,” “our,” or “HEARO”), a company based in the United States, collects, uses, shares, and protects personal data in connection with the HEARO mobile application (“App”) and related services (collectively, the “Services”).
The App is available to download from public app stores. However, functional use of the Services requires both (a) an authorized account, which we grant only to approved healthcare professionals (“Clinicians”), and (b) the HEARO device, which is not sold to the general public. The App cannot perform its core ear-examination function without the HEARO device.
Where this policy applies. We operate the Services in two contexts: (1) in the United States, which is our intended commercial market; and (2) in Peru, where we currently conduct a clinical research study. This policy has a general part that applies to everyone, plus a United States part (Section 16) and a Peru part (Section 17) that provide additional, location-specific information. Where local law gives you stronger protections, those protections apply to you.
By accessing or using the Services, you (the authorized Clinician) agree to this Privacy Policy. If you do not agree, do not use the Services.
Questions or to exercise your rights: info@hearomed.com
This policy applies to:
Patients and study participants do not create accounts and do not interact with the App directly. All patient data is entered by authorized Clinicians on the patient’s behalf. Clinicians are responsible for obtaining any required patient (or parental/guardian) consent under applicable law before entering patient information, and for providing patients or guardians with the relevant information in a language they understand.
Data Controller. The party responsible for the personal data processed through the Services is:
Local Representative in Peru. Because we direct Services to individuals in Peru while established outside Peru, Peruvian law requires us to appoint a representative located in Peru who can be contacted by data subjects and by the ANPD. Our local representative is:
Personal data bank (Peru). Personal data collected in connection with the Peru study is stored in a personal data bank registered, or being registered, with Peru’s National Registry of Personal Data Protection under reference registration in process.
When a Clinician is granted access and registers, we collect:
Clinicians enter the following on behalf of patients or study participants. This information is not submitted by patients directly:
During an ear examination conducted through the App, we collect:
We automatically collect certain technical information when the App is used (including when it is opened before login):
Some of the information we process is sensitive data, including health data, otoscope images and video, and data relating to minors. In Peru, sensitive data may generally be processed only with the data subject’s prior, informed, express, and written (or equivalently recorded) consent, or under a specific legal exception (such as processing necessary for health purposes carried out under the responsibility of a health professional bound by professional secrecy). In the United States, sensitive health data is subject to the FTC Act, the FTC Health Breach Notification Rule, and various state consumer-health-data laws. We process sensitive data only as necessary to provide the Services and to support clinical and research activities, and apply heightened safeguards to it.
Where Peruvian law applies, consent must be free, prior, express, unequivocal, and informed, and must be in writing (or equivalently recorded) for sensitive data. Where U.S. law applies, we rely on consent and on other lawful bases such as performing the Services and complying with legal obligations, and we obtain opt-in consent where required for sensitive health data.
How consent is obtained. Clinicians obtain the required consent (and, for minors, parental/guardian consent plus the minor’s assent where appropriate) from each patient or study participant before entering data, using the consent documentation provided with the Services. We rely on Clinicians to confirm consent has been obtained and recorded.
Withdrawing consent. A data subject may withdraw consent at any time, with future effect; withdrawal does not affect processing carried out beforehand. Contact us or our local representative using Section 21.
We use the information we collect to:
Mandatory vs. optional data. Most account and examination data is required to provide the Services; without it, an account cannot be created and an examination cannot be performed, analyzed, or stored. Optional fields are indicated at the point of collection. We do not use sensitive health data for advertising, employment decisions, insurance eligibility, or unauthorized social sharing.
The App uses artificial intelligence and machine learning to analyze otoscope images and videos, including assessing image quality and identifying anatomical features. This is automated processing of personal data.
Nature and consequences. The AI produces image-quality metrics and analysis results that assist the Clinician. These outputs support, not replace, qualified clinical judgment. HEARO does not provide medical diagnoses, and no clinical decision about a patient is made solely by automated means without a Clinician’s involvement. You have the right to be informed about this processing and to contact us with questions.
Core feature. AI analysis is a core feature and cannot be disabled without limiting core functionality. To request restriction or deletion of AI-processed data, contact us using Section 21.
We do not sell personal data. We may share information as follows:
Third-party vendors that provide infrastructure and support — cloud computing and storage, app hosting, authentication, and performance monitoring/logging. All are bound by written contract to process data only as we instruct, solely for the purposes we specify, and to maintain appropriate security and confidentiality.
Examination data, images and videos, and AI results may be shared with authorized healthcare professionals or clinical reviewers, research collaborators and study sites, and ethics boards or regulatory bodies, as required by law or research protocol.
In a merger, acquisition, or sale of assets, your information may transfer as part of the transaction. We will provide notice if your data becomes subject to a materially different privacy policy.
We may disclose information where required by law, court order, or a competent authority (including the ANPD or the FTC), or to protect the rights, property, or safety of Hearo Medical, our users, or others.
Hearo Medical is based in the United States. Personal data collected from individuals in Peru is transferred to and processed in the United States, and may be processed by service providers in other countries. This is a cross-border transfer under Peruvian law.
Basis and safeguards. We carry out international transfers on the basis of the data subject’s prior, informed, express, and unequivocal consent and/or as necessary to provide the Services. Where the destination is not recognized by the ANPD as providing adequate protection, we put contractual safeguards in place with recipients consistent with Peruvian law, and we notify the ANPD of transfers where required. Data-protection laws in the United States and other recipient countries may differ from those in Peru.
Data relating to children and adolescents is treated as sensitive data and given special protection. Where the Services are used to examine pediatric patients as part of approved clinical or research activities:
We do not knowingly collect personal data directly from children, and the App is not directed to children as users. If you believe a minor’s information has been improperly collected, contact us at info@hearomed.com and we will take appropriate steps, including deletion where required.
We retain personal data only as long as necessary to fulfill the purposes in this policy and to meet legal, ethical, clinical, research, security, and recordkeeping obligations, after which we delete or anonymize it. In no case will we retain personal data longer than sixty (60) months after termination of the associated Clinician account, unless a longer period is required by law or an approved research protocol. Where deletion is not immediately possible (e.g., backups), we isolate the data from further processing until deletion can occur.
We implement appropriate technical and organizational measures — encrypted transmission, encryption of stored data, access controls and authentication, activity logging, and secure cloud storage — with heightened safeguards for sensitive data. Because we process sensitive data including the data of minors, we conduct and periodically review a privacy/data-protection impact assessment. No method of electronic transmission or storage is completely secure; access the App only within a secure environment and on properly secured devices.
If we become aware of a security incident affecting personal data, we will respond, document the incident, and notify as required by law.
We will notify the ANPD within forty-eight (48) hours of becoming aware of a qualifying incident, and will notify affected data subjects within forty-eight (48) hours, in clear and simple language, where the incident may prejudice their rights.
Where the FTC Health Breach Notification Rule applies, we will notify affected individuals and the U.S. Federal Trade Commission within sixty (60) days of discovering a breach of unsecured identifiable health information, and the media where required. State laws may impose additional or shorter notification timelines, which we will also observe.
Subject to applicable law, you may have the following rights regarding your personal data:
How to exercise your rights. Contact us or our local representative using Section 21, or submit a data-subject request. We will respond within the timeframes required by applicable law. Certain rights may be limited where retention is required by law, research-ethics obligations, or clinical-recordkeeping requirements; if we cannot fully meet a request, we will explain why.
Our regulatory status. Hearo Medical is not a HIPAA-covered entity. Health apps and device makers like us are generally outside HIPAA, which applies to healthcare providers, health plans, and clearinghouses. If we process data on behalf of a HIPAA-covered entity (for example, a clinic) under a business associate agreement, we will act as a business associate for that data and handle it accordingly.
FTC oversight. We are subject to Section 5 of the FTC Act (which prohibits unfair or deceptive practices) and to the FTC Health Breach Notification Rule (see Section 14). More information: FTC Health Breach Notification Rule.
State privacy rights. Residents of California (CCPA/CPRA), Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws may have rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of certain processing. We do not sell personal information or use it for cross-context behavioral advertising. State consumer-health-data laws (such as Washington’s My Health My Data Act and similar laws) may give additional rights regarding health data. To exercise any of these rights, use the contact details in Section 21.
Our processing of the personal data of individuals in Peru is governed by Personal Data Protection Law No. 29733 and its Regulation (Supreme Decree No. 016-2024-JUS), under the supervision of the National Authority for the Protection of Personal Data (ANPD). In addition to the rights in Section 15, you have the right to seek protection (“tutela”) from the ANPD and to claim compensation for damage caused by unlawful processing. We register our personal data bank(s) with the ANPD and keep that registration current (see Section 2). Official text of the Regulation: https://www.gob.pe/institucion/minjus/normas-legales/6171889-016-2024-jus.
We do not currently respond to Do-Not-Track (DNT) signals, as no uniform standard exists. If a standard we are required to follow is adopted, we will update this policy.
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. For material changes, we will notify affected users by email or a prominent in-App notice, and obtain renewed consent where required. The “Last Updated” date above reflects the most recent revision.
Processing of personal data of individuals in Peru is governed by Peruvian law (Law No. 29733 and Supreme Decree No. 016-2024-JUS) and supervised by the ANPD. Processing of personal data of individuals in the United States is governed by applicable U.S. federal and state law. Where more than one law applies, we apply the protection most favorable to the data subject.
For questions, requests, or to exercise your rights or withdraw consent, contact:
Peru data subjects may also lodge a complaint with the ANPD (Autoridad Nacional de Protección de Datos Personales, Ministry of Justice and Human Rights). U.S. users may contact the FTC.
© 2026 Hearo Medical Inc. All rights reserved.