Privacy Policy
Effective date: October 30, 2026
OUR PRIVACY PROMISE
Your health information should work for you. Hundred uses it to help you understand your health, connect information across your records and devices, and access relevant services. We do not sell identifiable health information to data brokers. An employer or organization sponsoring your membership does not automatically receive your medical results. We use authorized technology providers to deliver and improve Hundred, subject to applicable safeguards. When a use of your health information requires additional permission, we will ask for it. Your rights and choices are explained below.
1. WHO WE ARE AND WHEN THIS POLICY APPLIES
This Privacy Policy describes how GHOAT, Inc., doing business as Hundred Health, and applicable affiliates (together, “Hundred,” “we,” or “us”) collect, use, disclose, retain, and protect personal information in connection with our websites, applications, memberships, testing coordination, digital health experiences, products, and related services (the “Services”). The entity responsible for particular information may depend on the service and legal relationship. Clinical care may be furnished by separate professional entities and other healthcare providers, whose own notices and legal obligations may apply. Where a Notice of Privacy Practices, a state consumer health data notice, or another legally required notice governs particular information, read that notice together with this Policy; in a conflict, the applicable law and controlling notice govern.
2. INFORMATION WE COLLECT
Depending on your use of Hundred, information may include: (a) identity, contact, demographic, account, authentication, and preferences; (b) billing, orders, subscriptions, fulfillment, and transaction details; (c) lab tests, biomarkers, diagnoses, medications, prescriptions, clinical notes, medical records, imaging, genetics, family history, and other health information; (d) activity, sleep, heart-rate and other information from connected devices and applications; (e) information you upload, share in conversations, or provide through surveys and support; (f) device, browser, usage, approximate location, cookies, and other technical information; and (g) employer or partner eligibility and program-administration details. Some categories are sensitive personal information or consumer health data under applicable law. We collect only information appropriate to the Services, permissions, and lawful purposes described here and in supplemental notices.
3. WHERE INFORMATION COMES FROM
Information may come directly from you, from your use of Hundred, and from sources you connect or authorize, including laboratories, healthcare providers, record-exchange networks, pharmacies, wearable platforms, and authorized representatives. We may also receive limited eligibility or enrollment information from membership sponsors and distribution partners. When permitted, we combine these sources to provide a more complete and useful view of your health. Disconnecting a source stops future access through that connection, subject to technical timing and other lawful bases for collection; it does not automatically erase information previously obtained.
4. HOW WE USE INFORMATION
We use information as permitted by applicable law to operate accounts; coordinate testing, healthcare-related services, prescription and product fulfillment; retrieve and organize records; provide insights, protocols, and personalized recommendations; respond to support requests; maintain security and prevent fraud; administer subscriptions and payments; analyze performance and improve features; conduct permitted quality assurance and research; communicate service updates; meet legal obligations; and carry out other purposes disclosed at collection or authorized by you. We distinguish service-related health guidance from optional promotional marketing that uses identifiable medical information. Where additional authorization is required, we obtain it before that use.
5. ARTIFICIAL INTELLIGENCE AND PERSONALIZATION
Hundred uses AI and analytical systems to organize information, identify patterns, answer questions, generate explanations, support personalized experiences, and improve service quality. This can involve processing health information you provide or authorize Hundred to access. Authorized technology providers may process information on our behalf under applicable contractual and security controls. We distinguish using AI to provide a member-facing service from evaluating, developing, or training models. Hundred may evaluate and improve its systems using information as permitted by law, including appropriately de-identified information and information covered by any required authorization. We do not permit outside AI providers to use identifiable member health information to train their general-purpose models for their own independent purposes. We do not represent that every AI-generated insight is reviewed by a clinician; clinical review is applied where the relevant workflow or law requires it. AI-generated information does not replace individualized professional medical advice.
6. PERSONALIZED SERVICES AND OPTIONAL PROMOTIONS
Hundred may present relevant tests, supplements, care options, prescriptions, and other products or services within the experience to help you act on your health information, subject to applicable healthcare, privacy, advertising, and professional rules. Some recommendations may relate to products or services from which Hundred earns revenue. We distinguish these service-related experiences from promotional outreach or third-party marketing based on identifiable medical information. When applicable law requires separate authorization for a marketing use, we will seek it separately, explain the purpose and recipients, and provide a means to revoke it. Declining an optional marketing authorization will not by itself prevent access to core Services. We do not treat acceptance of this Policy alone as a substitute for a legally required medical-information marketing authorization.
7. HOW INFORMATION IS SHARED
We disclose information only as permitted or required by applicable law and as appropriate to the purpose: (a) to clinicians, labs, pharmacies, healthcare networks, and other participants involved in requested services or authorized care; (b) to contracted service providers supporting hosting, analytics, security, payment, customer service, AI processing, data warehousing, communications, and fulfillment, acting on our behalf under applicable restrictions; (c) to organizations administering memberships, limited as described below; (d) to research collaborators or other recipients when lawful and subject to required permissions or de-identification; (e) to affiliates and parties involved in a corporate transaction subject to applicable restrictions; and (f) when required by law, legal process, or to protect safety and rights. We do not sell identifiable health information to data brokers or give advertisers unrestricted independent use of identifiable health records. We do not claim that all sharing is prohibited: operating a connected health service necessarily involves authorized processors and healthcare partners.
8. EMPLOYERS, BENEFIT SPONSORS, AND PARTNERS
If an employer, insurer, association, or other organization offers or pays for your membership, we may provide information necessary to confirm eligibility, administer enrollment, billing, support, and permitted program-level reporting. Paying for a membership does not itself entitle a sponsor to your diagnoses, biomarker results, medical records, genetic information, or individual AI conversations. Individual health information is shared with a sponsor only when legally permitted and appropriately authorized. Aggregate reporting is subject to applicable privacy rules and controls intended to reduce re-identification risk. A partner providing healthcare services may have a different role and receive information as legally appropriate for that care.
9. RESEARCH, ANALYTICS, AND DE-IDENTIFIED INFORMATION
We use analytics to understand reliability, member experience, product performance, and health-service outcomes. Where lawful, we may create and use aggregated or de-identified information for internal analysis, quality improvement, scientific research, product development, and collaborations, including commercial collaborations. We apply applicable de-identification standards, contractual restrictions, and safeguards against re-identification. De-identified information is not necessarily anonymous in every context, and different laws may continue to impose restrictions. We do not sell identifiable medical records as a routine business practice. Research or other secondary uses of identifiable information will be conducted only where permitted by law and with any required consent, authorization, or oversight. This section does not itself grant unrestricted rights to license identifiable health data.
10. COOKIES, ANALYTICS, AND ADVERTISING
Our websites and applications may use cookies, software development kits, and similar tools for login, security, performance, product analytics, support, and permitted advertising. We use authorized analytics and infrastructure providers to help operate and improve Hundred. Some digital tracking activities may be regulated as a sale, sharing, targeted advertising, or sensitive-data disclosure under applicable law even when no money changes hands. We provide notices and opt-out mechanisms where required. We seek to prevent sensitive health details from being transmitted to advertising platforms through page URLs, event properties, recordings, or similar mechanisms.
11. PRIVACY RIGHTS AND CHOICES
Depending on where you live and which entity holds your information, you may have rights to access, correct, obtain a copy of, delete, or restrict certain information; withdraw consent; request information about disclosures; and opt out of certain targeted advertising, sale, sharing, profiling, or sensitive-data uses. Some rights have exceptions, identity-verification requirements, deadlines, and appeal procedures. We will not unlawfully discriminate against you for exercising applicable rights. Requests may be submitted through the verified contact channels listed below. Additional rights, instructions, and required category-by-category disclosures appear in applicable state-specific notices and healthcare notices.
12. CONNECTED SOURCES, EXPORTS, AND DELETION
You may disconnect supported devices and data connections, request access to eligible records, and request export or deletion where available under law. We will explain which information can be exported, what formats are supported, and any limitations. Closing an account, disconnecting a device, or revoking an optional authorization does not necessarily require deletion of records already collected or retained for lawful healthcare, financial, security, or legal purposes. We aim to delete or de-identify information when it is no longer needed and retention is not otherwise required or permitted. A request may be denied or limited where an applicable exception applies; we will explain the outcome as required by law.
13. FAMILY, CAREGIVERS, AND AUTHORIZED REPRESENTATIVES
A person who pays for another person’s membership does not automatically receive access to that person’s health information. Family members, guardians, caregivers, and clinicians may receive access only under appropriate permissions or legal authority. For minors, parental access may be limited by laws protecting certain confidential services. We may provide separate roles, permissions, and access controls for family or delegated-access features. Members should review the permissions they grant and revoke access when appropriate.
14. SECURITY
We use administrative, technical, and physical safeguards designed for the sensitivity of the information we handle, including appropriate access controls, monitoring, security processes, and vendor oversight. Specific controls and certifications will be described publicly only when verified. We assess and respond to suspected security incidents and provide legally required notifications. No technology can eliminate all security risk, but protecting member information is a core operational responsibility.
15. DATA RETENTION
We retain information for periods reasonably necessary to provide Services, maintain clinical or business records, meet legal and contractual requirements, prevent fraud, protect security, resolve disputes, and fulfill other lawful purposes. Retention depends on the category of information, the entity responsible, and applicable law. For example, account information may be eligible for deletion after closure while medical records may have mandatory retention periods. Backups and audit records may be retained for limited periods consistent with documented schedules and legal obligations.
16. CHILDREN AND MINORS
General consumer memberships are intended for adults unless a specifically offered dependent or family service supports minors. We handle children’s information under applicable age, parental-consent, healthcare confidentiality, and other legal requirements. We do not assume that a parent or guardian may access every category of a minor’s confidential health information. If a child has supplied information contrary to applicable requirements, contact us using the privacy contact below.
17. INTERNATIONAL PROCESSING
Hundred and authorized service providers may process information in jurisdictions where they operate, subject to applicable legal, contractual, and security protections. Location of processing and access depends on the particular service and provider. Where international transfers trigger additional requirements, we apply the required mechanisms.
18. CHANGES TO THIS POLICY
We may update this Policy to reflect changes to Services, law, and data practices. We will post the revised Policy with its effective date and provide additional notice or obtain permission where required. A revised Policy does not override a previously required authorization or make an otherwise unlawful secondary use lawful.
19. CONTACT AND ADDITIONAL NOTICES
Privacy email: privacy@hundred.com. Mailing address: GHOAT, Inc. (Hundred Health), 428 J Street, BST 150, Sacramento, CA 95814. Effective date: October 30, 2026. Consumer Health Data Privacy Policy: https://www.hundred.com/legal/consumer-data-privacy-policy.
Your annual physical tests 20 markers and sends you home. Hundred tests 100+, connects your wearables and medical history, and gives you a 100-day plan built from all of it. $0.55/day.
Cancel anytime · HSA/FSA eligible
