Effective date: October 11, 2026
This notice explains how OTB Capital, LLC, doing business as Rucks AI, handles consumer health information in connection with Rucks. It supplements our Privacy Policy and applies to the practices described here. Where a health-data law gives you additional protections, those protections control. Rucks is a travel service, not a healthcare provider, and this notice does not represent that your Rucks account is a medical record protected by HIPAA.
If you choose to use the relevant optional fields, we collect information you provide about allergies, dietary needs that reveal health information, blood type, medical notes, health insurance, and other health-related travel needs. Identifiers and contact details associated with that information can also be health data. A travel record, message, note, or conversation you submit may contain health information, including a destination or request that reveals an attempt to obtain healthcare. We do not ask you to provide this information to use unrelated Rucks features.
We use the information for the feature you request: storing your selected Travel Profile fields, showing them to you, allowing correction or deletion, and carrying out a specific sharing instruction. If you deliberately include health information in an AI request, such as a question, the AI processing described in section 7 of the Privacy Policy can process that request, and only with the separate AI permission described there. The health fields saved in your Travel Profile are never sent to an AI provider. Storing a field in Travel Profile does not itself authorize sending that field to an external assistant or incorporating it into general recommendation profiling. We do not create health profiles by inferring medical conditions from your photo locations or travel history. Rucks’s memory does not save a belief about your health on its own, and leaves any such belief out of what you share (section 4 of the Privacy Policy explains these controls and their limits). We do not use health data for targeted advertising, general-purpose model training, or insurance eligibility decisions.
The principal source is you, through the fields, content, or requests you choose to supply. An account you authorize us to import can contain incidental health information; we do not use that as permission to populate medical fields automatically. A communication or travel record supplied by someone else can also contain information about you. Contact us if information about you has been included without an appropriate basis.
Rucks keeps the health fields of your Travel Profile only after you give a separate permission in the app. The permission names the fields, the purpose, who processes them, and how to withdraw, and links this notice; we record your choice with the version of its wording, never the values you enter. It is separate from accepting our Terms and Privacy Policy and from AI permission. For other health information you choose to include in a request, we process only what is necessary for that request where the law permits that basis, and obtain consent where it is required. You may decline the optional health feature. We do not ask you to consent to the sale of health information.
Hosting, storage, backup, and security processors may handle the categories above under restricted contractual instructions to operate the feature. AI processors (today OpenAI, directly) receive health information only when you include it in an AI request you make with AI permission; they never receive your Travel Profile’s health fields. Authorized personnel may access information only when needed for the permitted purpose, support with the required permission, security, or a legal duty.
If you specifically choose to share health fields, the selected information goes to the recipient or audience identified in the share flow, for example a chosen hotel, guide, companion, or other person. If the flow uses a bearer link, anyone who obtains the link may be able to see those fields while it remains active. Review that access method before sharing. A general Friends connection or family roster entry does not grant this access. A share link carries health fields only after you confirm those fields for that link. The confirmation names the fields, says that anyone with the link can read them while it is active and that a link can be forwarded, shows when the link ends or that it has no end date, and explains how to stop it; adding health fields means a new link and a new confirmation. Permission to collect is not permission to disclose.
We do not sell consumer health data. We do not disclose it to advertising networks or data brokers. We do not share it with corporate affiliates for their own uses. A legally compelled disclosure or other exceptional use must have a valid basis under the applicable health-data law; a general corporate-transaction clause does not authorize an otherwise prohibited transfer. Contact us for information about the actual recipients of your information, including applicable contact details.
You can ask whether we collect or share health data about you, obtain access to it and information about recipients, withdraw permission for future collection or sharing, and request deletion. You can also correct your own saved fields. Email privacy@rucks.ai with “Health data request” in the subject, or use the in-app controls: you can edit or remove each field in your Travel Profile, and withdraw your permission there, which removes the saved health fields and stops them on every link. An account is not required to submit a request about yourself. We verify identity using information proportionate to the request. Do not send a medical record or identity-document scan unless necessary and requested through an appropriate secure process.
For a request governed by Washington’s My Health My Data Act, we respond without undue delay and within 45 days, with one additional 45-day period where law permits and after explaining the extension during the initial period. We provide the legally required free responses and do not discriminate against you for using these rights. If we decline a request, you may appeal by emailing privacy@rucks.ai with “Health data appeal” and identifying the decision. We respond to that appeal within 45 days and explain the result. If it remains denied, we provide a way to complain to the Washington Attorney General, including the information at atg.wa.gov. Other applicable laws may provide different or additional rights and deadlines, which we honor.
Withdrawing permission stops the corresponding future processing; it does not change whether earlier processing was lawful. It also does not erase information automatically from every place where you separately supplied it. Tell us if your request includes a conversation or imported record as well as a Travel Profile field so we can assess its full scope.
We retain health fields while needed for the feature you selected, until you remove them, withdraw the relevant permission, or request deletion, subject to a specific retention basis permitted by applicable law. The general desire to keep a lifelong travel memory does not authorize keeping optional health information after its permitted purpose ends.
For a valid deletion request, we delete covered information from the systems within the request’s scope and notify processors and other recipients where law requires it. A recipient’s earlier copy is not an automatic exception to a health-data deletion obligation. Archived and backup copies are addressed under the applicable legal deadline; where Washington law permits delayed deletion from those systems, the delay will not exceed six months after authenticating the request. That is a legal maximum, not our intended everyday retention period. Restoration must not silently undo an effective deletion. We explain a lawful exception if particular information cannot be removed.
Privacy contact: privacy@rucks.ai. Postal address: OTB Capital, LLC, doing business as Rucks AI, Attention Privacy, 1117 State Street, Santa Barbara, California 93101, United States.
We identify updates with a new effective date and provide notice and a new choice where required before collecting additional categories or using information for a new purpose. Posting this notice does not itself authorize collection or sharing. Please also read the Rucks Privacy Policy for security, international processing, and general account practices.