Consumer Health Data Privacy Policy

This policy explains how Within Reach Health Ventures LLC (“Within Reach,” “we,” “us”) handles consumer health data under Washington’s My Health My Data Act, Nevada SB 370, and similar state laws. It applies together with our Privacy Policy. If the two conflict on consumer health data, this policy controls.

It applies to the Within Reach mobile app, withinreach.care, and related services (the “Service”).

What this covers

Consumer health data is personal information that identifies, or can reasonably be linked to, a person’s physical or mental health. In Within Reach that includes information you or someone in your care circle enter about care, conditions, medications, symptoms, and similar details.

Most of what you type is for family coordination. Where it qualifies as consumer health data, we treat it as described here.

What we collect

We collect the following when you (or an authorized member of your care circle) choose to enter it:

• Conditions, diagnoses, symptoms, and observations (including pain, breathing, mood, sleep, mobility, nutrition, cognition, and communication)
• Medications, including names, dose, and schedules you record
• Allergies and reactions
• Advance-care choices you record (for example DNR, living will, medical power of attorney)
• Healthcare and support involved in care (hospice, facility, aides, and similar)
• Medical equipment and assistive devices
• Insurance details you enter, including payer, plan, group number, and member ID
• Pharmacy name and contact information you enter
• Care setting and approximate location (home or facility; ZIP code)
• Emergency contacts and healthcare proxy information you enter
• Dietary, vision, hearing, language, religious or cultural preferences, mental-health notes, and similar care-context fields
• Care notes, tasks, appointments, visit prep, and family-feed or journal content that describes health or care
• Inferences needed to run the Service (for example, that a medication dose is due)

We do not collect biometric identifiers (fingerprints, retina scans, voiceprints), genetic data, or precise GPS. We do not geofence health-care facilities.

Where it comes from

• You, when you enter it
• Other people you have allowed into your care circle
• The Service, when it derives operational facts from what you already entered (reminders, overdue tasks, dose logs)

We do not buy consumer health data from data brokers or advertising networks.

Why we use it

We use consumer health data only to provide the Service you asked for:

• Operate care profiles, notes, medications, appointments, tasks, reminders, and family sharing
• Show information to people you have authorized
• Send transactional notifications you turned on (for example, a dose or appointment reminder)
• Secure the Service, prevent abuse, and provide support
• Comply with law
• Produce de-identified, aggregate statistics that do not identify anyone

We do not use consumer health data for advertising, for selling data, or for profiling that produces legal or similarly significant effects.

Crash and diagnostic reporting is optional. If you turn it on, we send technical reports to help fix bugs. Those reports are configured not to include care content. You can turn this off in Settings.

Who we share it with

We do not sell consumer health data. We do not share it for cross-context behavioral advertising.

We share it only with:

• People you invite into a care circle or group, according to the permissions in the app
• Vendors who run the Service for us, under contract to use it only for that purpose. Today that includes:
  • Amazon Web Services, Inc. — hosting and file storage
  • MongoDB, Inc. (MongoDB Atlas) — database
  • Clerk, Inc. — sign-in and sessions
  • Expo (650 Industries, Inc.) — app builds and updates
  • Our email and push-notification providers
• A hospice, facility, or other provider, only if you later connect your account to them. No such connection is active today.
• Authorities or other parties when we reasonably believe the law requires it, or to protect Within Reach, our users, or the public
• A successor if we merge, are acquired, or sell the business, with notice as described in the Privacy Policy

How we protect it

We encrypt data in transit and at rest, restrict internal access to people who need it for their job, and use role-based access in the app so members only see what their role allows. Details are in the Privacy Policy.

Your choices

Entering health details is how you use the product. You choose what to add and who in your circle can see it.

You may:

• Edit or delete information in the app
• Remove people from your care circle
• Turn optional diagnostic reporting off
• Delete your account (see Privacy Policy)

Withdrawing consent for a purpose we still need in order to run the Service may mean that feature cannot work (for example, we cannot remind you about a medication you have deleted).

Your rights

If you live in Washington, Nevada, Connecticut, or another state that grants similar rights, you may:

• Confirm whether we process your consumer health data
• Access it, and get a list of third parties we have shared it with
• Withdraw consent for collection or sharing, where consent was required
• Delete it
• Exercise these rights without being denied the Service or charged a different price, except that a feature may not work without the data it needs

To make a request, email privacy@withinreach.care with your name, the email on the account, and what you are asking for. We will verify you using information already on the account. We respond within 45 days, or tell you if we need another 45.

If we deny a request, reply and write “Appeal” in the subject line. We will answer the appeal in writing within 45 days. Washington residents may then file a complaint with the Washington Attorney General at https://www.atg.wa.gov/file-complaint. Nevada: https://ag.nv.gov. Connecticut: https://portal.ct.gov/ag.

Children

The Service is for adults 18 and older. We do not knowingly collect consumer health data from anyone under 18. If an adult enters information about a minor in their care, that adult is responsible for having the authority to do so.

Changes

If we change this policy, we will update the date at the top. If the change is material, we will give additional notice (email or in-app) before it takes effect.

Contact

Within Reach Health Ventures LLC
2125 Biscayne Blvd, Ste 204 #25480
Miami, Florida 33137

privacy@withinreach.care
support@withinreach.care