Privacy Policy

Last updated: 16 September 2026 | Effective: 16 September 2026

Aromha, Inc. (“Aromha,” “we,” “us,” “our”) built the Aromha Brain Health Test (“ABHT”) to make brain-health screening more accessible. Because the ABHT relates to your health, we take privacy seriously. This Privacy Policy explains what information we collect through aromha.com and the ABHT (the “Services”), how we use and share it, the rights you have, and the choices you can make.

This Policy is incorporated into our Terms of Use. By using the Services you agree to this Policy.

Plain-language summary (not a substitute for the full Policy). We collect what we need to sell you the test, ship it, and return your result to you. We do not sell your identifiable personal information, and we do not send your result to anyone. Your result goes to you, and you decide who else sees it. We may create de-identified data that no longer identifies you and use it to improve the test and support brain-health research. Before any de-identified data leaves Aromha, it has to clear a qualified expert determination first. Using your result in a form that still identifies you is always separate, optional, and something we would ask you for on its own. You can ask us what we hold, ask us to correct it, and ask us to delete it, at support@aromha.com.

1. Who this Policy covers

This Policy applies to everyone who uses the Services, however you obtained the test.

You may have received your ABHT directly from aromha.com, or through an audiologist, a clinic, a hospital, a senior-living community, or a research study. In every one of those settings, your result is returned to you and to nobody else. Aromha does not send your result to your clinician, your practice, your community, or your employer. If you want someone to see it, you share it yourself.

Two consequences follow. First, the information you give Aromha when you take the test is governed by this Policy, whoever handed you the kit. Second, the organization that gave you the kit will have its own records and its own privacy practices covering its relationship with you, and those are theirs rather than ours; contact them with questions about what they hold.

Clinical trials are the one exception. If you took the ABHT as a participant in a sponsor-run clinical trial, your results are not returned to you, the data is held in a database reserved for that trial, and the trial’s own consent form and the sponsor’s privacy terms govern it rather than this Policy.

2. Information we collect

You give us:

Contact and order information: name, email, phone, and shipping and billing address.
Purchase information: what you bought and the order details. Your payment card is collected and processed by our payment processor. We never see or store your full card number.
Test information: your responses during the ABHT and the result the test produces. Because this relates to your sense of smell and to brain health, we treat it as sensitive.
Communications: messages you send us, including support requests, feedback, and survey responses.

We collect automatically: very little. The aromha.com website sets no cookies and runs no advertising or analytics trackers. Our hosting provider processes standard web-server information, such as your IP address and browser type, in order to serve the site and protect it from abuse. If we ever add analytics or advertising technology, we will update this Policy and this section before we turn it on.

From third parties: limited information from the service providers listed in Section 5, such as delivery status from our shipping provider.

Accounts. Aromha does not currently offer user accounts, and there is no password to create or manage. You reach your result using the Test Number and password printed on your test card. If we introduce accounts in future, we will update this Policy first.

We do not knowingly collect information from anyone under 18, and the Services are not directed to children. If you believe someone under 18 has given us information, write to support@aromha.com and we will delete it.

3. How we use your information

We use your identifiable personal information to:

Provide the Services. Process your order, ship your kit, deliver the test, and return your result to you.
Support you. Answer your questions and provide customer service.
Operate, secure, and improve the Services. Maintain and troubleshoot them; develop, test, validate, and improve the ABHT and our other products and scoring methods; keep the Services safe; and prevent fraud and abuse.
Communicate with you. Send service messages and, where you have allowed it, product updates you can unsubscribe from at any time.
Comply with law and enforce our Terms.

Where a legal basis is required, we rely on performing our contract with you, our legitimate interests in operating and improving the Services and keeping them secure, your consent where the law requires it, and compliance with our legal obligations.

4. De-identified and aggregated data

We may process test and usage data into de-identified and aggregated data. “De-identified” means the data has been processed so that it can no longer reasonably be used to identify you. “Aggregated” means combined or statistical data that does not identify any individual.

We will not release, license, or sell de-identified data outside Aromha unless and until that data has first been de-identified to the standard of a qualified expert determination under the HIPAA de-identification rule (45 CFR 164.514(b)(1)). That determination is a condition we have set for ourselves, and we have not yet completed it. Until we have, de-identified data stays inside Aromha and is used only to operate and improve the Services and our products.

Once that condition is met, we may use, share, disclose, license, or sell de-identified and aggregated data to develop, train, validate, and improve the ABHT and our other products; for scientific and clinical research; for publication and benchmarking; and to provide datasets to research, clinical, or commercial partners. Where any law would treat such a use as requiring your authorization, we will obtain that authorization first rather than relying on the position that de-identification takes the data outside that law.

When we de-identify data, we commit that we will not attempt to re-identify it, we keep reasonable safeguards against re-identification, and we require anyone who receives it to make the same commitment. As between you and us, Aromha owns de-identified and aggregated data and anything derived from it, and those rights continue after you ask us to delete your personal information.

Please understand one practical limit. Once de-identified or aggregated data has been shared or released it no longer identifies you, so we may be unable to retrieve or recall it even if you later ask us to delete your information or withdraw a consent.

We do not sell your identifiable personal information, and we do not send your test result to anyone. We share identifiable information only as follows.

Service providers who work on our behalf and see only what they need to do their job. Today these are our payment processor, our shipping and fulfilment provider, our website hosting and form providers, and our email provider. Each is bound by contract to use the information only to provide the service to us.
Legal and safety. When required by law or legal process, or to protect the rights, safety, and security of Aromha, the people who use our Services, or the public.
Business transfers. In connection with a merger, financing, acquisition, or sale of assets, subject to the protections in this Policy and, where required, notice to you or your consent.
When you ask us to. Including if you opt in to identifiable research use under Section 6.

6. Optional identifiable research use

Beyond the uses in Section 3 and the de-identified uses in Section 4, we may invite you to let Aromha use your result in a form that still identifies you, for research, a brain-health registry, or a partner study.

This is entirely separate and entirely optional. We will ask through a distinct, clearly labelled opt-in, not through your acceptance of these Terms or this Policy. It will say what the specific use is. It will not affect your test, your result, or your ability to use the Services, and declining costs you nothing. You can withdraw at any time and we will stop the identifiable use going forward, though we cannot recall data already shared with a research partner or already de-identified.

7. Your privacy rights and choices

Depending on where you live, you may have some or all of the following rights: to access the information we hold about you, to correct it, to delete it, to obtain a portable copy, to opt out of its sale or sharing and of certain profiling, to limit the use of sensitive information, and to withdraw a consent you have given. We will not discriminate against you for exercising any of them.

To exercise a right, write to support@aromha.com. We will verify that the request is really yours and respond within the time the law allows.
If we deny your request, you may appeal by replying to our decision, or by writing to support@aromha.com with “Privacy appeal” in the subject line. A person who was not involved in the original decision will review it, and we will tell you the outcome and our reasons within the time the law allows.
Marketing. Unsubscribe at any time using the link in any marketing email.

Consumer health data. Washington’s My Health My Data Act, Nevada’s SB 370, and Connecticut’s consumer-health-data provisions give residents of those states specific rights over consumer health data, including to access it, to withdraw consent to its collection and sharing, and to have it deleted. We will not collect or share your consumer health data beyond what is needed to provide the Services you asked for without your separate consent, and we will not sell it. To exercise these rights, write to support@aromha.com. Our separate Consumer Health Data Notice sets this out in full.

California residents. In the last twelve months we have collected the categories of personal information described in Section 2: identifiers (name, email, phone, postal address, IP address); commercial information (your order); internet or network activity (standard web-server logs); and sensitive personal information, namely health information in the form of your test responses and result. We collect it from you directly and from the service providers in Section 5, for the purposes in Section 3. We disclose it for a business purpose only to the service providers in Section 5. We do not sell or share personal information as the CCPA defines those terms, and we have not done so in the last twelve months. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit, so no “Limit the Use of My Sensitive Personal Information” link is required. We do not knowingly sell or share the personal information of anyone under 16. You may exercise your California rights, including access, correction, deletion, portability, and non-discrimination, at support@aromha.com; an authorized agent may act for you with proof of authorization. Under California Civil Code section 1798.83 you may also request information about disclosures to third parties for their direct marketing purposes; we make none.

Residents of the European Economic Area, the United Kingdom, Turkey, and Brazil. The ABHT is currently sold only in the United States. We do not offer the test for sale outside the United States, we do not target advertising anywhere, and this site sets no cookies and runs no analytics or tracking technology, so we do not monitor visitor behaviour. We publish the site in Spanish, Turkish, and Portuguese so that clinicians, hospitals, and research partners who read those languages can understand our work, not in order to offer goods or services to consumers in those markets. On that basis we do not believe the GDPR, the UK GDPR, Turkey’s KVKK, or Brazil’s LGPD currently apply to this site. If you are in one of those places and you contact us or send us information through this site, we will handle it in line with this Policy and, if you ask, we will give you access to it, correct it, or delete it. If we begin selling outside the United States, we will update this Policy, appoint any representative required, and put a lawful transfer mechanism in place before we do.

8. Cookies and similar technologies

The aromha.com website sets no cookies, and runs no analytics, advertising, or tracking technology. There is no cookie banner because there is nothing to consent to. Our hosting provider may set a strictly necessary cookie to protect the site from automated abuse. Our Cookie Policy says what that means in practice, and it will be updated first if this ever changes.

Note that the ABHT test application itself runs on a separate website and uses a strictly necessary session cookie to keep you signed in to your test while you take it. That cookie is required for the test to work.

9. Data security

We use administrative, technical, and physical safeguards designed to protect your information, and health information generated through the ABHT is stored on HIPAA-aligned cloud infrastructure in the United States. No system is perfectly secure and we cannot promise absolute security. Keep the Test Number and password printed on your card to yourself, and tell us at support@aromha.com if you think someone else has used them.

10. How long we keep information

We keep identifiable personal information for as long as we need it to provide the Services and to meet our legal, tax, accounting, and regulatory obligations, to resolve disputes, and to enforce our agreements. As a general rule that means order and contact information is kept for seven years after your last order, in line with US tax and business-records requirements, and test responses and results are kept for as long as you may want to retrieve them plus that same period. After that we delete or de-identify it. De-identified and aggregated data may be kept indefinitely because it no longer identifies you.

11. Where your information is held

We store and process information in the United States. If you reach the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws differ from those where you live.

12. Changes to this Policy

We may update this Policy. We will post the updated version with a new “Last updated” date, and for material changes we will give additional notice. We will not use information we already collected in a materially new way that requires your consent without first asking you for it.

13. Contact us

Aromha, Inc. 10008 Hemswell Lane, Potomac, MD 20854 support@aromha.com