Consumer Health Data Privacy Policy

Effective: [DATE] · DRAFT — pending attorney review

This policy is provided under the Washington My Health My Data Act and similar laws in Nevada and Connecticut. It applies to [CareCrib LLC] ("we") and the CareCrib app. Contact: hello@carecrib.app.

Categories of consumer health data we collect

Information a parent or caregiver chooses to enter about a baby's health: feeding (including tube feeding, pump settings and residuals), sleep, diapers and stool, medications and doses given or skipped, spit-up, retching and vomiting, vital-sign readings copied from home monitors (oxygen saturation, heart rate, breathing rate, temperature, alarms), skin findings and photos, growth measurements, developmental goals and milestones, appointments, questions for clinicians, and clinicians' instructions.

Sources

Only you — the information you type, select or attach in the app. We do not buy health data or receive it from other companies.

Purposes

To show your log, reminders, charts and reports to you; and, only if you turn on Family Sync, to let your own family's devices share the same log. We do not use consumer health data for any other purpose, including advertising.

How it is collected and stored

The data is stored on your device. With Family Sync on, it is encrypted on your device and the encrypted copy is stored with our hosting provider (Cloudflare). We cannot read it.

Sharing

We do not share or sell consumer health data. Categories of third parties that handle it on our behalf (processors): our hosting provider (Cloudflare), which stores the encrypted Family Sync copy only. If you choose to connect Discord notifications, your device sends the messages you enabled directly to your own Discord channel.

We have no affiliates that receive consumer health data.

Consent

We ask for your consent in the app before you start logging. You can withdraw consent at any time by deleting your data (below) and stopping use of the app.

Your rights

You may: (1) confirm whether we collect, share or sell your consumer health data and access it; (2) obtain a list of third parties and affiliates with whom we shared it (none, other than the processor above); (3) withdraw consent; and (4) have your data deleted.

How to exercise them:

• Access: your data is shown in the app; Settings → Data lets you export all of it.
• Delete: Settings → Data → Delete all data on this device (also offers to delete the encrypted family copy on our server).
• Email: hello@carecrib.app with "Health data request" in the subject. We respond within 45 days (extendable once by 45 days when reasonably necessary, with notice).

Appeal: if we decline your request, reply to our decision with "Appeal" in the subject. We will respond within 45 days. If you are not satisfied, Washington residents may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Geofencing

We do not use geofencing around health-care facilities, and we do not collect location.