Data Deletion Policy

This Data Deletion Policy explains how you can request that Xerevia Health delete the personal and health information we hold about you, how we verify these requests, how long the process takes, and the limited circumstances in which certain information must be retained. This policy applies alongside our Privacy Policy and our Account Deletion page, which provides a direct request form.

You can request deletion of your data in any of these ways:

• In-app: Settings → Account → Delete Account
• Online: use our Delete Account form
• By email: privacy@xereviahealth.com

To protect your account from fraudulent deletion requests, we verify your identity before processing a request. This typically involves confirming the request through a link sent to your registered email address, and may include additional identity checks for requests submitted by phone or mail. We will not act on a request we cannot verify.

Once verified, we begin processing your request immediately. Non-clinical account and usage data is deleted within 30 days. Where a longer legal retention period applies (see Exceptions below), the relevant records are securely retained and access is restricted to what is legally required, while all other data is deleted on the normal schedule. You will receive an email confirming when the deletion is complete.

We may retain certain information beyond a deletion request where required or permitted by law, including:

• Clinical and medical records subject to state medical recordkeeping requirements
• Billing, tax, and financial records required for accounting compliance
• Information needed to complete a transaction already in progress
• Records subject to an active legal hold, audit, or investigation
• Information reasonably necessary for security, fraud prevention, or debugging

Questions about this policy or the status of a deletion request can be sent to privacy@xereviahealth.com.