Effective Date: August 13, 2026
App Name: Pear
Developer: Pear Project Inc.
Countries Served: United States only
Contact: hello@pear.care
Overview
Pear ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our mobile application ("App").
Pear helps users find doctors and healthcare providers based on their health information, symptoms, insurance coverage, and location.
The provider matches and scores we show you are derived from public and government healthcare datasets, including Medicare claims data published by the Centers for Medicare & Medicaid Services (CMS). This information is analyzed in aggregate and is never used to identify individual patients.
This Policy is a notice of our practices. It does not replace a separate consent, authorization, or acknowledgment where HIPAA or another privacy law requires one.
Information We Collect and How We Collect It
The information Pear collects depends on the features you use, the permissions you grant, and whether you choose to save information for future visits.
A. Account, Contact, and Profile Information
• First and last name, email address, phone number, and profile image or avatar
• Account, patient, session, and authentication identifiers; verification status; and the date and version of your legal consent
• Password, one-time verification code, and sign-in information processed to authenticate you
• Age or date of birth and gender or sex assigned at birth
• Insurance carrier and plan, and, when you use booking features, member ID, group number, and subscriber name
• City, state, ZIP code, search radius, and, with foreground location permission, precise device coordinates that may be converted to a ZIP code or profile location
B. Health, Search, and AI Interaction Information
• Symptoms, conditions, medical history, pregnancy status and weeks pregnant, and other clinical details you choose to provide
• Health and provider preferences, requested specialty, clinician gender preference, location radius, and insurance preferences
• Search terms, intake answers, free-text questions, chat messages, full conversation context sent with an AI request, feedback votes, and generated classifications such as ICD or CPT codes and urgency or matching signals
Health and pregnancy information is sensitive information. Depending on the context and Pear's legal role, it may be Protected Health Information ("PHI") under HIPAA or consumer health data under state law. Pear limits its use and disclosure as described in this Policy and applicable law.
C. Circle of Care and Information About Other People
• A care recipient's name, relationship, age, phone number, insurance, location, medical history, notes, reminders, searches, saved doctors, care team, and appointments
• Information you provide when searching, saving information, or arranging care on another person's behalf
D. Appointments, Reminders, and Saved Content
• Provider selections, favorites, fit summaries, shared-provider links, and search and match history
• Appointment date and time, visit type, status, duration, notes, visit reason, preferred availability, provider details, and booking reference
• Reminder titles, notes, dates, alert settings, and related calendar details
• SMS and email recipient information and message and delivery details; and, when you authorize an AI-assisted provider-office call, call audio, transcription, provider responses, call outcome, duration, and your recording choice
E. Device, Usage, Purchase, and Diagnostic Information
• Device type, operating system, app version, language, IP address, network and general location information, app or installation identifiers, and push token
• Screens and features used, searches, provider views, chat feedback, timestamps, and other product interactions
• Crash reports, stack traces, error messages, API endpoint and status data, performance information, and troubleshooting context
• Subscription status, product and entitlement information, purchase history, transaction status, and an internal account or anonymous purchase identifier
F. Support and Other Information You Choose to Provide
We collect the content of support requests, feedback, and any other information, files, or context you choose to send us.
How We Collect It
• Directly from you when you create an account, complete a profile, type or dictate a message, search, save information, book an appointment, create a reminder, make a purchase, or contact support
• From device permissions you choose to grant, including foreground location, notifications, calendar, and local biometric authentication
• Automatically when the App communicates with our servers or our analytics, crash-reporting, messaging, authentication, and purchase providers
• From Apple or Google when you choose their sign-in, maps, calendar, or app-store services, and from public or government provider datasets used for doctor results
• From you about another person when you state that you are authorized to act for that person
Information That Stays on Your Device
Pear does not receive your fingerprint, Face ID image, or other biometric template; your operating system only tells the App whether local authentication succeeded. Voice dictation is configured for on-device recognition, so Pear does not receive the raw audio. If you submit the resulting text, the transcript is handled like any typed chat message. Local reminders and Apple or device-calendar entries stay on your device, subject to any device backup or calendar-sync settings you control.
How We Use Your Information
We use your information to:
• Create and secure your account, verify your identity and phone number, manage sessions, remember legal consent, and support local biometric unlock
• Build and maintain your profile, Circle of Care, saved doctors, searches, reminders, and appointments
• Understand your request, perform safety and urgency checks, normalize health and search concepts, and provide AI-assisted conversation
• Match and rank relevant providers and explain why a provider may fit your stated needs, insurance, preferences, and location
• Book, cancel, reschedule, and recover appointments; create user-requested reminders and calendar entries; and support provider-contact features you authorize
• Send account, service, safety, appointment, and support communications and push notifications
• Deliver phone verification codes and service emails and, when you authorize it, use an AI voice assistant to contact a provider office and communicate the minimum information needed to request an appointment
• Process subscriptions, restore purchases, enforce search entitlements, prevent fraud, and maintain account and service security
• Diagnose crashes and errors, measure feature performance and engagement, respond to support requests, and improve reliability, usability, matching, and recommendations
• Create aggregate or de-identified statistics, conduct audits, enforce our terms, resolve disputes, protect rights and safety, and comply with law
We do not sell personal or health information, use it for third-party advertising, or share it for cross-context behavioral advertising.
Data Sharing and Disclosure
We disclose information only as needed for the purposes below, at your direction, or as required by law.
Pear APIs, Cloud Hosting, and AWS Bedrock:
Clerk, Apple, and Google Sign-In:
Clerk processes authentication, account identifiers, email, phone, session, device, and security information. If you choose Apple or Google sign-in, that provider receives the sign-in request and returns the account information you authorize.
Twilio:
Twilio processes phone numbers, one-time verification codes, SMS content, sender and recipient information, timestamps, delivery status, and telecommunications metadata to deliver phone verification and other service messages. If Twilio telephony is used for an authorized provider-office call, it also processes the routing, signaling, and live audio needed to connect that call.
Twilio SendGrid:
SendGrid processes the recipient email address, message headers and content, and delivery, bounce, and related email metadata to send account, verification, support, invitation, and other service emails. Pear does not send PHI, symptom or chat content, or appointment details through SendGrid; sensitive details remain inside the authenticated App.
ElevenLabs AI Voice:
When you authorize Pear to use an AI voice assistant to contact a provider office, ElevenLabs may process live call audio, transcriptions, provider responses, call duration and outcome, and the minimum booking information needed for the call, such as name, date of birth, callback number, insurance carrier, high-level visit reason, preferred times, and provider contact information. Pear does not provide unrelated chat history or the rest of your clinical record. Pear records a call only after obtaining the required consent and providing any notice required by law.
Deepgram Speech-to-Text:
When Deepgram is enabled for an authorized provider-office call, Deepgram may process the live call audio and related connection and technical information needed to create a real-time transcript and related speech-recognition results, such as timestamps, speaker labels, and confidence information. The audio and transcript may contain the minimum booking information exchanged during the call, including the information described in the ElevenLabs paragraph above. Pear uses the result so the voice assistant can understand provider responses, continue the requested scheduling workflow, and determine the call outcome. Pear does not provide Deepgram with unrelated chat history or the rest of your clinical record and enables call transcription only after obtaining any consent and providing any notice required by law.
Google Firebase:
Firebase Analytics, Crashlytics, and automatic screen reporting are disabled in Pear's production health-app configuration. Firebase Cloud Messaging receives an app installation or push token; limited device, app, network, and delivery information; and the title, body, event type, and routing identifier of a notification. Appointment notifications may reveal that an appointment was scheduled, changed, is upcoming, or occurred and may include a provider reference. Pear does not send symptom entries or chat content through Firebase and limits notification content to what is needed to provide the notification service.
RevenueCat and App Stores:
RevenueCat, Apple, and Google receive an internal account or anonymous identifier and purchase, product, transaction, subscription, and entitlement information to process and restore purchases and determine access. Pear does not send health or chat content to RevenueCat.
Maps, Calendar, and Device Services:
Apple or Google mapping services may receive a location, provider address, map request, and device or network information when the App displays a map or you open directions. If you choose Google Calendar, Pear opens a Google Calendar request containing the appointment title, time, notes, and location. If you choose a device calendar or local notification, the event or reminder is written to your device and is then governed by your device and sync settings.
Healthcare Providers:
Viewing a provider match does not disclose your health information to that provider. If you expressly ask Pear to contact or schedule with a provider in a feature that supports it, Pear may disclose the minimum information needed for that request, such as your name, date of birth, callback number, insurance details, visit reason, and availability. We do not disclose unrelated chat history or clinical details.
Legal, Safety, and Business Transfers:
We may disclose information when reasonably necessary to comply with law or legal process, protect a person's safety or our rights, investigate fraud or security issues, or complete a merger, financing, acquisition, or sale subject to appropriate confidentiality and continued privacy protections.
Consumer Health Data We Share
The consumer health data Pear discloses for processing consists of the symptoms, conditions, medical history, pregnancy information, health preferences, search and intake answers, chat content, and generated clinical or matching signals described in Section 2. Pear shares those categories with Pear's backend and AWS Bedrock to provide the requested AI, safety, classification, and matching functions; with Google Firebase Cloud Messaging when push notifications are registered for your device, limited to the appointment-notification information described above; with ElevenLabs, Deepgram, and, where applicable, Twilio only when you authorize an AI-assisted provider-office call, limited to the voice, transcript, and minimum booking information described above; and with a healthcare provider only when you direct Pear to contact or schedule with that provider. SendGrid does not receive consumer health data. Pear does not currently share consumer health data with an affiliate. Pear does not permit a third party to collect consumer health data through Pear over time and across unrelated websites or online services for tracking or advertising.
Same or Equivalent Protection Requirement
Before a service provider processes personal or health information for Pear, we assess the provider's privacy and security practices and require written terms that limit processing to Pear's instructions and the stated service purpose; require confidentiality, appropriate technical and organizational safeguards, incident notice, deletion or return, and equivalent controls for subprocessors; and prohibit sale, advertising use, or use to train a provider's general-purpose models. We require those protections to be at least as protective as the commitments in this Policy and remain responsible for selecting and overseeing our processors. If a provider cannot meet those requirements, Pear will not authorize it to process personal or health information for us.
When a service provider creates, receives, maintains, or transmits PHI for Pear, Pear also requires a HIPAA-compliant Business Associate Agreement ("BAA") when required and limits PHI to services, accounts, models, regions, logging settings, and other configurations covered by that BAA. Subcontractors that handle PHI must accept the same applicable restrictions and safeguards.
Pear authorizes PHI through Twilio only in a BAA-covered HIPAA Account and only using Twilio services listed as HIPAA eligible. Pear authorizes PHI through ElevenLabs only under an executed BAA, with Zero Retention Mode enabled, and using models and configurations covered by that BAA. Under that configuration, ElevenLabs is not permitted to retain raw call audio, transcripts, tool calls, or sensitive logs after processing. Pear authorizes PHI through Deepgram only under an executed Enterprise BAA and with the Model Improvement Partnership Program opt-out enabled on every request. Under that setting, Deepgram may retain call content only for the time needed to process the request and may not use it to improve or train its models. Twilio SendGrid is not used to transmit PHI because SendGrid does not offer a HIPAA-compliant transmission service.
When Amazon Bedrock processes PHI, Pear uses it only under an applicable AWS Business Associate Agreement and an approved HIPAA configuration. Bedrock data handling depends on the selected model, API, region, and effective account or project retention mode. Pear does not authorize identifiable prompts or outputs to be used to train base or general-purpose models. Before a model processes PHI, Pear verifies that the service, model, retention settings, and provider-access settings meet Pear's HIPAA requirements.
Apple, Google, and a healthcare provider may act independently when you direct us to open their sign-in, maps, calendar, app-store, or provider-contact service. We send only the information needed for the action you request, but their independent handling is also governed by the privacy notice and settings they provide to you.
We do not share your information with data brokers or advertisers.
Data Storage and Security
We use safeguards designed for the sensitivity of the information, including encrypted production network connections, encryption offered by our cloud providers, role-based access controls, authentication, monitoring, logging controls, and workforce and service-provider confidentiality obligations. Pear routes approved Bedrock workloads through U.S. regions or U.S. geographic inference profiles. Pear's application-level AI telemetry is designed to record model and usage metadata rather than prompt or completion content.
Authentication tokens and account-session data are stored using operating-system protected storage when supported. The App also stores selected profile fields, search drafts, symptoms, chat history, care-recipient information, insurance booking details, reminders, appointments, preferences, and related session information in the App's device storage so features can resume after restart. Sensitive local values are encrypted with authenticated AES-256-GCM encryption. The data-encryption key is held in iOS Keychain or Android Keystore-backed secure storage and is configured not to migrate to a different device. Existing plaintext values from older App versions are migrated at startup, and signing out clears these sensitive local records and rotates the key. Device security still matters, so protect your device with a passcode and sign out before sharing it.
No security measure can guarantee absolute security. We limit access to people and providers who need it for the purposes in this Policy and review safeguards as our services change.
Data Retention
Retention depends on the type of information and the feature involved. We retain account, profile, appointment, transaction, consent, security, and support records for as long as reasonably necessary to provide the App, maintain an account, complete the transaction or request, protect the service, meet legal requirements, and resolve disputes.
AI and match requests are processed to return a response and may be held in an active session for continuity, recovery, safety, and security. The "Save my health information" setting controls whether Pear adds new durable health-history facts to your account for future visits. Turning it off does not prevent the temporary processing needed to answer a current request, and it does not automatically delete account, appointment, consent, security, or device-local records. You may ask us to delete previously saved clinical details.
Device-local drafts, chats, care-recipient details, reminders, insurance details, and preferences remain until the feature clears them, you sign out where the App is configured to clear them, you clear or uninstall the App, or the operating system removes them. Service-provider backup copies may remain for a limited period before being overwritten. We delete or de-identify information when it is no longer needed, subject to legal, safety, fraud-prevention, dispute, and backup exceptions. You can request deletion as described in Section 10.
Your Privacy Rights
You may have the right to:
• Access and review your data
• Request correction or deletion
• Withdraw consent for processing
• Request a copy of your data
• Opt out of a sale, targeted advertising, or qualifying profiling, where applicable
• Appeal our refusal to act on a privacy request
• Use an authorized agent and exercise your rights without unlawful discrimination
Where we rely on your consent, you may withdraw it for future processing. You can also turn off the "Save my health information" setting to stop new durable health-history facts from being added to your account. Withdrawal does not affect processing that already occurred, temporary processing needed to complete a request you make, or information we must retain for legal, safety, security, transaction, or dispute purposes. Some features may not work without the information they require.
To exercise these rights, contact us at hello@pear.care with the subject "Privacy Request." You do not need to create a new account to make a request. We will use reasonable methods to verify your identity and authority. If we deny a request, our response will explain why and, where applicable, how to appeal by emailing the same address with the subject "Privacy Appeal."
HIPAA and Consumer Health Data Protections
Pear complies with the HIPAA Privacy, Security, and Breach Notification Rules and the HITECH Act when those laws apply to Pear as a covered entity or business associate. We maintain administrative, physical, and technical safeguards for electronic PHI, conduct and update risk analysis and risk-management activities, limit access based on role and need, train relevant workforce members, and maintain incident-response and breach-notification procedures.
HIPAA does not apply to every category of health information or every direct-to-consumer health-app relationship. When Pear handles PHI as a business associate, Pear's BAA with the applicable covered entity and that covered entity's Notice of Privacy Practices govern the PHI. If Pear is required to provide a HIPAA Notice of Privacy Practices for a service, that separate notice will supplement this Policy and control if the notices conflict.
As applicable to PHI in a designated record set, you may have the right to inspect or receive an electronic or paper copy, request an amendment, request confidential communications, request restrictions, receive an accounting of certain disclosures, receive a copy of the applicable HIPAA notice, and have a verified personal representative act for you. Depending on Pear's role, you may exercise these rights through Pear or the covered entity responsible for the record; Pear will help route a request when appropriate.
You may complain to Pear's Privacy Officer or to the U.S. Department of Health and Human Services Office for Civil Rights if you believe HIPAA rights were violated. Pear will not retaliate against you for filing a complaint. To the extent Pear receives substance-use-disorder patient records protected by 42 C.F.R. Part 2, Pear will not use or disclose those records in a civil, criminal, administrative, or legislative proceeding against you except with your written consent or as permitted by a qualifying court order and subpoena.
State consumer-health laws may protect health information that is not PHI or is not otherwise exempt. Pear therefore maintains a separate Consumer Health Data Privacy Policy for the disclosures and rights required by laws including the Washington My Health My Data Act, Nevada's consumer health data law, and the consumer health provisions of the Connecticut Data Privacy Act. That separate policy identifies the consumer health data Pear collects and shares, its sources, how and why it is processed, the recipients, consent practices, and how to exercise consumer health data rights.
Read Pear's Consumer Health Data Privacy Policy
Pear does not sell consumer health data and does not use geofencing around an entity that provides in-person healthcare services to identify or track a person seeking care, collect consumer health data, or send health-related messages or advertising. Pear provides additional notice and obtains affirmative consent before a new category, recipient, or materially different purpose when applicable law requires it.
Pear will notify affected individuals, covered entities, regulators, and others of a breach of unsecured PHI or identifiable consumer health information when and as required by HIPAA, HITECH, the FTC Health Breach Notification Rule, and applicable state law.
Circle of Care and Searching on Behalf of Others
Pear lets you add family members or other individuals to a "Circle of Care" and run searches on their behalf. If you provide another person's information, you represent that you have the authority to do so and to consent to its use on their behalf. For a minor, you represent that you are the minor's parent or legal guardian. We handle information you provide about others under the same protections described in this Policy.
Children's Privacy
Pear is not intended for children under 18 years old (or the applicable minimum age in your jurisdiction) to use directly. We do not knowingly create accounts for children. An adult parent or legal guardian may provide information about a minor through the Circle of Care and is responsible for having authority to do so. If we learn that a child used Pear directly or provided information without appropriate authorization, contact us so we can take appropriate action.
Data Deletion and Account Removal
You can request deletion of your account and all associated data by emailing hello@pear.care.
After verifying your identity, we will delete or de-identify information associated with your account and instruct our processors to do the same, except where retention is required or permitted for legal obligations, safety, fraud prevention, security, payment or transaction records, dispute resolution, or limited backup cycles. Data already written to your device calendar, synced through a service you selected, or sent to an independent provider at your direction must be removed through that service. You can remove device-local Pear data by signing out where supported, clearing the App's storage, or uninstalling the App.
United States Service and Data Processing
Pear currently offers the App and its services only in the United States. The App is not directed to people outside the United States. Pear routes approved Bedrock workloads through U.S. regions or U.S. geographic inference profiles. Some service providers may process information in countries where they or their subprocessors operate. When required, we use contractual and other transfer safeguards intended to preserve protection for the information.
U.S. State Privacy Rights
This section supplements the rest of this Policy for residents of U.S. states with privacy laws that apply to Pear. As of the Effective Date, those laws may include laws in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Washington, Nevada, and Connecticut consumer health data protections are also addressed in Pear's separate Consumer Health Data Privacy Policy. A right applies only to the extent the applicable law covers Pear and the information and does not provide an exemption.
• Confirm whether Pear processes your personal information and access it
• Correct inaccurate personal information
• Delete personal information, subject to lawful exceptions
• Obtain a portable copy of personal information where required
• Learn the categories or, where required, specific third parties that received personal information
• Opt out of a sale, targeted advertising, cross-context behavioral advertising, or qualifying profiling
• Limit certain uses or withdraw consent for sensitive personal information where applicable
• Use an authorized agent, appeal a denial where provided by law, and exercise your rights without unlawful discrimination
Pear does not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use personal information to profile a consumer in furtherance of a decision that produces legal or similarly significant effects. Pear does not offer a financial incentive for personal information and does not knowingly sell or share personal information of users under 16.
California Notice at Collection and Additional Rights
If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA/CPRA"), applies, Sections 2 through 4 provide Pear's notice at collection. They identify the categories of identifiers, customer-record information, protected characteristics, commercial information, internet or network activity, geolocation, sensory information, medical and insurance information, and sensitive personal information Pear may collect; the sources; the purposes; and the categories of recipients. Section 6 describes Pear's retention criteria. Pear uses and discloses sensitive personal information only as reasonably necessary and proportionate to provide requested health and app services, maintain security, and perform other purposes permitted without a right to limit under California law.
During the 12 months preceding the Effective Date, Pear collected and disclosed the categories described in Sections 2 through 4 only when the corresponding feature was enabled and used. If a vendor-enabled feature was not available or you did not use it, Pear did not make that feature-specific disclosure. Pear did not sell personal information or share it for cross-context behavioral advertising during that period.
California's Confidentiality of Medical Information Act may separately protect medical information maintained by a business that offers an app designed to help an individual manage medical information or a medical condition. Where that law applies, Pear maintains the confidentiality of medical information and discloses it only with a legally sufficient authorization or as otherwise permitted by law. California users may also request access to medical information Pear maintains about them. Pear does not use prohibited geofencing at a California healthcare location or sell or share information for another person to do so.
Sensitive Data and State-Specific Variations
Pear processes health information, precise location, and other sensitive data only as reasonably necessary and proportionate to provide or maintain a feature you request, with consent where required, or as otherwise permitted by law. Pear provides a method to withdraw consent that is no more difficult than the method used to provide it. Maryland law, where applicable, prohibits Pear from selling sensitive data and limits its collection, processing, and sharing to what is strictly necessary for a requested product or service. Other states may provide different definitions, exceptions, response periods, appeal rights, or authorized-agent procedures; Pear applies those rules to a verified request as required.
Read the separate Consumer Health Data Privacy Policy
Submitting a State Privacy Request
Email hello@pear.care with the subject "State Privacy Request" or call (317) 413-0516. You do not need to create a new account. Pear may ask you to authenticate an existing account or provide information reasonably necessary to verify your identity, residency, or authority. Do not send medical records, insurance numbers, or other sensitive details through unencrypted email. Pear will respond within the period required by applicable law.
If Pear denies a request, the response will explain the decision and any available appeal process. Submit an appeal to hello@pear.care with the subject "Privacy Appeal." If Pear denies an appeal, you may contact your state attorney general or privacy regulator. Pear will not unlawfully discriminate against you for exercising a privacy right.
Updates to This Policy
We may update this Privacy Policy periodically. Significant changes will be communicated via the app or by email. The "Effective Date" above will reflect the latest update. Where required, we will obtain affirmative consent before collecting or sharing a new category of consumer health data, using it for a materially new purpose, or sharing it with a newly disclosed recipient.
Contact Us
If you have questions or concerns about this Privacy Policy or your data, please contact us at:
Privacy Officer, Pear Project Inc.
1101 Wilson Blvd., Arlington, VA 22209
Phone: (317) 413-0516
Email: hello@pear.care
Website: https://www.pear.care
HIPAA complaints may also be filed with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/privacy/hipaa/complaints, 200 Independence Avenue SW, Washington, DC 20201, or 1-877-696-6775.
Apple App Store Privacy Summary
(for App Store Connect)
Data Linked to the User:
• Contact and Personal Info: Name, Email, Phone Number, Age or Birth Date, Gender, Profile Image, Insurance Information
• Health and Sensitive Info: Symptoms, Conditions, Medical History, Pregnancy, Health and Provider Preferences
• Location: Precise Foreground Location and Coarse Location such as ZIP Code
• User Content and Search History: Chat Messages, Intake Answers, Notes, Reminders, Care-Circle Content, Searches, and Authorized Voice-Call Audio and Transcripts
• Purchases: Subscription, Product, Transaction, and Entitlement Information
• Identifiers and Usage: User or Patient ID, Installation or Device ID, Push Token, Product Interactions
• Diagnostics: Crash, Error, Performance, Device, OS, App Version, IP Address, and Network Information
Purpose of Collection:
• App Functionality, AI Assistance, Provider Matching, Booking, Calendar, and Reminders
• Personalization and Recommendations
• Account Management, Authentication, Security, Fraud Prevention, and Purchases
• Developer Communications, Analytics, Product Improvement, Diagnostics, and Customer Support
Data Not Used For:
• Third-party advertising
• Tracking across apps or websites
“Framer is one of the best web builders I have ever tried. It’s like magic.”
Author