Consumer Health Data Privacy Policy

This policy explains how JB2S Enterprises, LLC d/b/a My Care Companion ("we") handles consumer health data. It is written to satisfy the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 and the health-data provisions of the Connecticut Data Privacy Act, and we apply it to every family that uses the Service, wherever you live. Our general Privacy Policy still applies to everything else.

1. What consumer health data we collect

Consumer health data is personal information that identifies your family and reveals a child's past, present or future physical or mental health. Everything you record in My Care Companion is health data of this kind. The categories are:

• Child profile: name, date of birth, gender, diagnosed conditions and ICD codes, and the notes you add;
• Medications: names, doses, schedules, doses given, missed or skipped, discontinuations and the reasons you give;
• Daily logs: behavior, mood, energy and anxiety ratings, incidents, sleep, meals and diet, bowel movements, speech, weight and height, sensory events, social interactions, therapy sessions, seizures and health events, with the free-text notes you write;
• Insights, alerts and reports generated from those logs;
• Visit recordings and their transcripts, journal photographs and files you choose to import, and the entries we extract from them;
• Family chat messages, support requests and community posts, to the extent you include health details in them;
• Technical data that can be linked to the above: account identifiers, device and push-notification tokens, and country-level location derived from your IP address.

We do not collect precise location and we do not use geofencing.

2. Where it comes from

• You, and the family members, caregivers and professionals you invite into your family's record;
• Your device (push-notification token, screen and platform details);
• Our own processing of what you record (insights, alerts, reports, transcripts and imported entries).

We do not buy consumer health data and we do not receive it from data brokers, advertisers or other apps.

3. Why we collect it

We collect and use consumer health data only with your consent or to the extent necessary to provide the product you asked for:

• Keeping your family's care record and showing it to the people you have invited;
• Reminders, alerts, pattern insights, reports for your care team, transcripts of visits you record, and entries read from files and photos you import;
• Answering your support requests;
• Keeping the Service secure, preventing abuse and meeting our legal obligations.

We never use consumer health data for advertising, for profiling you for marketing, or for any purpose you have not asked for. You give consent for optional processing (for example letting the AI read your free-text notes) in Settings, and you can withdraw it there at any time.

4. Who we share it with

We do not sell consumer health data, and we do not share it with any third party for that party's own purposes. The processors that handle it on our behalf, under contracts that limit them to our instructions, are:

• Amazon Web Services (United States): hosting and backups; Amazon Bedrock for AI pattern analysis and reading imported files; Amazon Transcribe for visit recordings;
• Stripe: payment processing. Stripe receives your billing details, never your child's health data;
• Microsoft 365: delivery of the emails we send you;
• Apple and Google: delivery of push notifications to your phone and distribution of the app. A notification tells you there is an alert to read; the details stay in the app.

Within the Service, the people you invite to your family (co-parents, caregivers and professionals) see the child records you give them access to. You control who is invited and can remove anyone at any time.

We have no affiliates that receive consumer health data. We may disclose it when the law requires us to, as described in section 5 of the Privacy Policy.

5. Your rights

Whether or not your state's law applies to you, you can:

• Confirm whether we hold consumer health data about your family, see it, and get a copy: Settings → Data Services → Export gives you everything in a portable file;
• Withdraw consent for any optional processing in Settings, with immediate effect;
• Delete your family's consumer health data: Settings → Delete My Account removes it from our live systems after the 30-day restore window and from backups within six months, and we instruct our processors to delete their copies;
• Get a list of the third parties we have shared your consumer health data with (section 4 is that list; no others);
• Appeal a decision we make about a request by replying to our response or writing to privacy@mycarecompanion.net with "Appeal" in the subject. We answer appeals in writing within 45 days.

We respond to requests within 45 days (extendable once by 45 days when a request is complex; we will tell you if so). We verify requests using your account sign-in or the email address on the account, and we never charge for a request or treat you differently for making one.

If you live in Washington and we deny your appeal, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint. Nevada residents may contact the Nevada Attorney General, and Connecticut residents the Connecticut Attorney General.

6. Contact

Email: privacy@mycarecompanion.net

Mail: JB2S Enterprises, LLC, PO Box 694, Helotes, TX 78023, United States

Our general Privacy Policy describes everything else we collect and your rights in other countries.