Arc Consumer Health Data Privacy Policy

Last updated: October 14, 2026

Sanctum LLC (“Sanctum”, “we”, “us”) makes Arc. This policy covers the consumer health data Arc collects about you: information that is linked to you and describes your body, your health or your habits, including what Arc works out from it. It is written for the health-data laws of Washington, Nevada and Connecticut, and we apply it to every Arc member. Our general privacy policy, at https://sanctum.company/privacy, covers everything else.

Arc is a wellness product, not a medical device.

The health data we collect

Apple Health. The types you allow on your iPhone: heart rate, heart rate variability, resting heart rate, sleep, respiratory rate, wrist temperature, workouts, steps, weight and body composition, and glucose from a continuous glucose sensor that writes to Apple Health.
Apple Watch. Workouts you record in Arc on your watch, your heart rate during each set, and how fast your heart rate recovers afterwards.
Oura, if you connect it: sleep stages, heart rate variability, resting heart rate, temperature, Oura’s readiness and stress scores, and the tags you add in Oura.
Withings, if you connect it: weight, body composition and blood pressure.
Lab results you import: your markers, the lab’s reference ranges, and the targets you set.
Food and water: what you log, your recipes, and the barcodes you scan. The camera is used only to read barcodes.
Supplements and doses: the products you take, your plans, dose times and what you logged.
Training: workouts, sets, plans and the equipment you use.
What Arc works out: your recovery score, training load, signs of strain, stress and resilience, meal scores, a VO2 max estimate from a step test, your chronotype and best sleep window, trends, and how your tags relate to your results. These are inferences about your health, and we treat them as health data.
Tags and notes: tags you add, tags imported from Oura, and anything you write in a note.
Ask Arc: the questions you ask Ask Arc and its answers.

Where it comes from

You, when you log, import, tag, write in Arc or ask Ask Arc a question.
Apple Health and Apple Watch, only for the types you allow on your iPhone.
Oura and Withings, only after you connect them. We read from them; we send them nothing of yours.
Arc itself, which calculates the scores and estimates above from the data you gave it.

Why we use it

To give you Arc: your morning read, recovery score and guidance, signs of strain, trends, your daily briefing, your weekly review and answers in Ask Arc.
To run your plans, your food budget and meal scores, compare your lab results with your targets, and show how your tags relate to your results.
To keep your account working and secure, and to answer your requests about your data.

We do not use your health data for advertising or marketing. We do not use it to train AI models, and the AI providers that write your summaries may not either.

Arc asks for your consent when you connect each health source, such as Apple Health, Oura or Withings, before it collects any health data from that source. You give it by a clear action, such as tapping “Allow”. Accepting our terms is never consent.

When you set up Arc, it also asks your permission before it sends any of your information to the AI providers that write your summaries for us (see below).

Apart from the recipients below, we don’t share your health data. If we ever wanted to share it with anyone else, we would first ask for your separate consent, on its own screen.

You can withdraw any consent at any time: switch a source off or withdraw AI permission in Arc’s settings, disconnect Oura or Withings, or remove Arc’s access in your iPhone’s Health settings. Arc then stops collecting that data, or sending it to the AI providers, from that moment.

Who receives it

Only these recipients receive your health data. Anthropic, OpenAI and OVH are processors: they act for us, under contract, only to provide Arc to you, and may not use your data for anything else.

Anthropic and OpenAI, whose AI models write the words of your daily briefing and weekly review, through their commercial services. Arc calculates every number; the AI only writes the prose around them. They receive a summary Arc prepares: trends and scores, findings from lab results you imported, and notes you chose to include. They also answer the questions you ask Ask Arc, using your question and the data needed to answer it. They may not use any of it to train their models. Each keeps what it receives for up to 30 days to check for misuse, then deletes it unless the law requires it to be kept longer.
OVH, which stores Arc’s data for us on servers in Canada. It holds every category above and may use it only to run Arc for us.
Authorities, only when the law requires it, such as a valid court order.

We keep your Ask Arc conversations for 90 days, unless you delete them sooner.

With your permission, Arc also writes food, water and workouts you log back to Apple Health on your iPhone.

We don’t share consumer health data with any affiliate.

We do not sell it

We do not sell your health data. Selling it would require a separate authorization signed by you, and we do not ask for one.

We do not geofence

We do not draw virtual boundaries around places where people get health care to identify you, track you, or send you messages or ads. Arc keeps only an approximate place, rounded to about 10 km (6 miles), to show your sunrise and sky.

Your rights

You can ask us to:

Confirm whether we collect or share your health data, and give you a copy of it.
List every third party and affiliate we have shared it with, with an email address or other online way to contact each of them.
Correct health data that is wrong. You can fix most of it yourself in Arc.
Delete it. We delete it from our live systems within 30 days of your request and from our backups within a further 30 days, and we tell every processor and third party that received it to delete it too.
Withdraw your consent to collecting or sharing it.

We don’t charge for these requests, and we won’t treat you differently for making one.

How to use your rights

In Arc: download your data, or delete it, in Arc’s settings.
By email: privacy@sanctum.company.

Someone you authorize can ask for you, with proof that you authorized them.

Verifying you. We confirm the request comes from you, for example through your signed-in app or your account email. We ask only for what we need to do that.

When we answer. Within 30 days, free of charge. If we need more time and the law allows it, we tell you why within those 30 days.

Appeals. If we turn down a request, in whole or in part, we tell you why. You can appeal by replying to our answer or by emailing privacy@sanctum.company with “Appeal” in the subject. Someone who did not decide the first request reviews it, and we answer within 45 days and explain the result. If you’re still not satisfied, you can complain to your state attorney general, to the Office of the Privacy Commissioner of Canada, or, in Quebec, to the Commission d’accès à l’information. When we deny an appeal, our answer tells you how.

Changes to this policy

The date at the top is when this policy took effect. At least 30 days before a change takes effect, we post the new version here and tell you in Arc and by email. If a change means collecting or sharing your health data in a new way, we ask for your consent first.

Contact

Sanctum LLC, privacy@sanctum.company.