Legal
Effective May 28, 2026 · Last updated May 27, 2026
Plain-language summary: auro is a clinical nutrition workspace. We collect the minimum we need to make the apps work — your account info, your interactions with the app, and (if you're a patient) your clinical data, which is visible only to you and your dietitian. We don't sell your data, ever. We use a small number of subprocessors (Supabase, Anthropic, LiveKit), each under a Business Associate Agreement. You can export everything we have on you, and delete your account at any time.
auro Health, Inc. is a Texas corporation headquartered in Austin, Texas. We provide auro Provider (a macOS application for registered dietitians) and auro Wellness (an iOS application for the patients of those dietitians). Throughout this policy, "auro," "we," "our," and "us" refer to auro Health, Inc.
This policy describes how we collect, use, store, and share information when you use auro Provider, auro Wellness, or visit theaurohealth.com. It does not cover information collected by your dietitian's practice outside of auro (those records are governed by that practice's own Notice of Privacy Practices, which you should have received when you became their patient).
When you create an account (provider or patient), we collect your name, email address, role, and the practice you're associated with. Providers additionally provide a credential number (e.g., RD/RDN registration) and the state(s) in which they practice.
If you are a patient, the following may be stored in your record:
If you are a dietitian using auro Provider, we store the charts, meal plans, recipes, notes, and messages you create about your patients. We also store your practice's branding (logo).
We collect basic telemetry: app version, OS version, device model, anonymized crash reports, and aggregated feature-usage counts. Telemetry never includes PHI.
We share information only as follows:
We do not sell or rent your data. We do not share it with advertisers. We do not use it to train third-party models.
Patient clinical records are retained for the period required by your practice's record-retention policy and applicable state law (typically 7 years for adults, longer for minors). Provider account data is retained while your account is active and deleted within 30 days of account closure. Audit logs are retained for 6 years as required by HIPAA.
See our Security & HIPAA page for the full overview. In short: Postgres row-level security, TLS 1.3 in transit, AES-256 at rest, MFA for admins, immutable audit logs, and a Business Associate Agreement required of every subprocessor that touches PHI before production data flows through it.
auro is intended for use by patients aged 13 and older, and providers aged 18 and older. We do not knowingly collect data from children under 13. If a dietitian provides care to a minor under 13, the parent or guardian is the auro account holder.
auro is operated from the United States and data is stored in U.S. data centers. If you access auro from outside the U.S., your data will be transferred to and processed in the U.S.
We will notify all account holders by email at least 30 days before any material change takes effect. Past versions of this policy are available on request.
Privacy questions or requests: privacy@theaurohealth.com
Security issues: security@theaurohealth.com
General: hello@theaurohealth.com
auro Health, Inc.
Austin, Texas