Expect Fitness, Inc. ("Expect," "we," "us") operates an AI-augmented pelvic floor physical therapy platform for adults located in Utah. This Policy explains how we collect, use, disclose and protect information when you use our websites, the platform, and related services (the "Services").
Expect operates under a Regulatory Mitigation Agreement with the Utah Office of Artificial Intelligence Policy ("OAIP") — a state regulatory pilot. The current authorized pilot population is women aged 18 or older located in Utah.
The Services handle sensitive health information. Depending on the context in which information is created, received or maintained, federal or state health-privacy laws may apply, and where a more specific legally required privacy notice governs particular information, that notice supplements this Policy. We will provide any additional notice required by law.
This Policy does not use "protected health information" as a blanket description of everything we hold, because that term has a specific legal meaning that depends on facts we describe honestly here rather than assume.
Regardless of which statute applies, the commitments in section 7 govern our handling of your information for this pilot.
We do not collect race or ethnicity, precise geolocation, biometric identifiers, or payment-card information. The application disables the browser geolocation feature entirely. There is no payment processing in the platform.
We set one cookie — expect_session — which keeps you signed in. It is httpOnly, secure, and expires after twelve hours. We also keep an in-progress intake draft in your browser, with your name, contact details, date of birth and insurance ID removed before it is stored.
We use no advertising cookies, no analytics platform, and no tracking pixels.
We record IP address transiently for rate limiting and security, and if the application crashes we record the error, the page address and your browser type. We filter email addresses and long numbers out of those reports, but they are generated automatically and may incidentally contain information you entered.
Infrastructure providers that serve parts of our site may receive ordinary connection information such as IP address and browser type when their resources are requested.
We do not use your information for advertising.
Your care plan and its clinical codes are produced by a deterministic, rules-based system. Your questionnaire scores are compared against predetermined thresholds, and the resulting plan follows from those rules. The same inputs always produce the same outputs.
If we activate a feature that uses generative AI, we will update this Policy and the applicable consent materials, and obtain any regulatory approval required, before making that feature available to you.
The pilot may operate in more than one phase. We are telling you about both now so that this disclosure remains accurate if the phase changes.
In every phase, a physical therapist reviews every patient at Week 8, and a therapist may modify, reject or add to any output at any time.
We automatically scan the free-text answers you write for language suggesting self-harm. If the system detects a match, it records a flag on your record and shows you crisis resources.
Your information is available to the physical therapist responsible for your care. A treating therapist sees only patients assigned to them; supervisory and administrative access exists to operate and audit the Services.
We use clinical fax to communicate with a physician or specialist you name. Depending on the purpose, this may include your encounter information, clinical codes, questionnaire scores, medications, care-plan and progress information, and a positive PHQ-2 depression screening result together with a recommendation for follow-up.
If clearance is required before a plan can be released, the request may include your name, date of birth and the specific clinical reason clearance is being requested.
Participation in the pilot requires reporting to the OAIP. You should understand the scope of this:
We may provide de-identified datasets to IRB-approved researchers under a data use agreement that prohibits re-identification and prohibits resale.
| Provider | Function |
|---|---|
| Convex | Primary database and record storage |
| Vercel | Application hosting |
| Sinch | Clinical fax |
| Amazon Web Services (SES) | Email delivery |
| Amazon Web Services (SNS) | SMS delivery |
| Google Workspace | Email received at our contact addresses |
| Google, Apple, Mozilla | Browser push delivery (encrypted; they see delivery metadata only) |
| CMS NPI Registry | Public provider-directory lookup (no health information sent) |
| Cloudflare | Delivery of application resources |
Service providers may process information only for the functions for which we use them, subject to contractual, privacy and security requirements.
We may disclose information where required by law or legal process, or where necessary and legally permitted to protect safety, rights or security. In a merger, acquisition or sale of assets, information may transfer subject to confidentiality and applicable law. We may also share information with your consent or at your direction.
Where more than one requirement applies, we retain the record for the longer period. These are minimum retention periods, not a promise that every record is deleted the moment a period expires.
Expect is a signatory to the CISA Secure by Design pledge and aligns its security program to the NIST Cybersecurity Framework. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
You can view your care plan and records in your patient portal, and you can download a complete copy of your record in a portable format at any time.
You may ask us to correct information you believe is inaccurate, subject to clinical-record and legal requirements.
You may withdraw from the pilot at any time, without penalty. No new data is collected after you withdraw. Information already collected may remain subject to clinical, safety and regulatory retention requirements.
You may decline AI-assisted care at any time. If you do, we will stop the automated pathway and refer you to an in-person pelvic floor physical therapist in our Utah partner network. Expect does not offer a human-delivered version of this platform — the alternative is a referral to care elsewhere.
You may turn off SMS reminders in the app or reply STOP to any text message, and you may disable browser notifications at any time.
Some clinical and regulatory records must be retained and therefore cannot be deleted during the required retention period — the same rule that applies at any clinic. Where a law applicable to you gives you a right to request deletion, we will honor it to the extent that right is not limited by record-retention, safety, regulatory or other legal obligations. You can always obtain a copy of your record, and you can always ask us to correct it.
Depending on where you live, you may have additional rights under state privacy law. To make any privacy request, contact us at privacy@expect.care.
The Services are for adults aged 18 and older. We verify date of birth at intake and block enrollment for anyone under 18. We do not knowingly collect information from children.
The Services are delivered by telehealth to patients located in Utah, and you must confirm you are in Utah to use them — which is why we collect location information. Details of the treatment relationship, provider identity and licensure, and the limitations of telehealth are addressed in your informed consent materials rather than in this Policy.
If we discover a security incident involving information covered by a breach-notification law, we will provide the notices that law requires. Depending on the circumstances this may include federal health-privacy or health-breach rules, state breach-notification law, and obligations under the Regulatory Mitigation Agreement.
The Agreement separately requires us to report suspected data leaks, unauthorized access, and re-identification of data treated as de-identified to the OAIP within the time it specifies.
We may update this Policy as the Services, the law, or our regulatory obligations change. We will post the updated version with a new date and, where required, provide additional notice or obtain renewed consent.
We will not activate Phase 2 or a generative-AI patient feature without completing the regulatory, legal and disclosure steps required for that change.
Expect Fitness, Inc.
Privacy Officer: Joseph Pacheco
privacy@expect.care
You may raise concerns about this pilot directly with the Utah Office of Artificial Intelligence Policy, without going through us:
ai@utah.gov
You do not need our permission or involvement to contact the Office, and we do not receive a copy of what you send.