Washington Consumer Health Data Privacy Policy

Washington Consumer Health Data Privacy Policy

This policy is for people in Washington State. Washington's My Health My Data Act asks companies that handle consumer health data to publish a separate notice about it, so this is that notice. It sits alongside our main Privacy Policy and does not replace it — where the two overlap, they say the same thing, and the main policy has the fuller detail.

Briggzy is operated by Keystone Software LLC, an Alabama limited liability company. Questions and requests go to privacy@briggzy.com.

Who this covers

Washington residents, and anyone whose consumer health data we collect or process in Washington State.

What consumer health data we collect

Nearly everything a family records in Briggzy is health data, because that is what the product is for:

• Conditions and diagnoses, and the notes a family keeps about them.
• Medications, doses given, times, and whether a dose was missed.
• Allergies and reactions.
• Appointments, the providers seen, and visit notes.
• Incidents such as a seizure or a fall, including what happened and for how long.
• Measurements a family tracks, such as weight, temperature, or sleep.
• Routines, care instructions, supplies, and equipment.
• Symptoms, observations, and free-form notes.
• Photos, documents, and receipts attached to any of the above.
• Insurance details and emergency contacts.

We also collect account details (name, email, phone) and basic security and usage data. Those are covered in the main Privacy Policy and are not health data on their own.

We do **not** collect precise location, biometric identifiers, information about seeking reproductive or sexual health services, or gender-affirming care data as a category, and we do not infer health status from your behaviour.

Where it comes from

From you and the people you invite. You type it in, or you upload it. We do not buy health data, receive it from data brokers, or pull it from your other apps. The one exception is a calendar you choose to connect, which is an outbound connection you control: it writes appointments to your calendar, it does not read health data into Briggzy.

The person the data is about — usually a child or another dependent — normally has no account. An adult caregiver enters it on their behalf, and confirms they have the authority to do so.

Why we collect it

To run the service you asked for, and nothing else:

• To show the care record to the people you invited into a circle.
• To send the reminders you set up.
• To produce the briefings and handoff summaries you generate.
• To show a guest exactly the slice of information you chose to share.
• To keep your account secure and to tell whether the beta is working.

Under the My Health My Data Act, collecting and sharing health data that is necessary to provide the service you requested does not require separate consent. Everything in the list above is that. **If we ever want to collect or share your health data for a purpose beyond running the service, we will ask you first and you can say no.**

Who we share it with, and who we don't

Inside the product, you decide: the members of your circle see what the circle holds, and a guest link shows only the level of detail you chose when you created it, until it expires or you revoke it.

Outside the product, these service providers process data on our instructions and for no purpose of their own:

• Supabase — the database, sign-in, and file storage. Held in the United States.
• Vercel — hosting and scheduled jobs.
• Resend — account emails only (sign-in links, invitations). It handles your
• email address, not your care information.
• Cloudflare — the challenge that blocks automated sign-up abuse. It sees the
• request, not your care information.
• Apple and Google — app distribution, and push notification delivery if you
• turn it on. Notification text is deliberately generic ("a dose is due") and
• never contains health details or names.

**We do not sell consumer health data.** We never have. Selling it would require your separate signed authorization under Washington law, and we do not ask for one because we do not do it.

We do not share health data with advertisers, data brokers, or analytics companies, and we do not use it to train models.

We will disclose data if the law requires it, and we will tell you unless we are legally prevented from doing so.

Your rights

You can:

• **See** what we hold. Export everything your account can see from inside the
• product under Me, then Export.
• **Delete** your consumer health data, by deleting your account under Me, or
• through our account deletion page if you cannot sign in.
• **Withdraw consent** to our collecting or sharing your health data. Withdrawing
• consent means closing your account, because the health data is the service.
• **Appeal** if we turn a request down.

Send any of these to privacy@briggzy.com. We answer within 45 days and may take a further 45 days for a complicated request, and we will tell you if we need it. We do not charge for these requests and we will not treat you differently for making one.

One thing to know before you delete, because it is unusual and we would rather you heard it here: deleting your account removes **you**, not the family's care record. The doses, notes, appointments, and incidents you logged stay in the circle they belong to, because they are records about the person being cared for, co-created by that family, and removing them would erase another caregiver's record of their own child's care. Section 7 of the main Privacy Policy explains exactly what goes and what stays.

Appeals and complaints

If we deny a request, reply to our answer and say you are appealing. We will review it and write back with our reasoning. If you are not satisfied, you can complain to the Washington State Attorney General at www.atg.wa.gov/file-complaint.

How we protect it

Traffic is encrypted in transit. Access is enforced per row in the database, so a person can only read the circles they belong to. Sensitive free-text and health fields are encrypted with our own key before they are stored. Uploaded files live in private storage that is not publicly reachable. We hold that key, so it is technically possible for us to read your care information; as a practice we do not, and our logs and error reports are built to carry no care details.

No service is immune, and Briggzy is in private beta. Do not let it be your only copy of anything critical, such as a medication schedule.

Changes

We may update this policy. When the substance changes we record the new version and ask you to accept it.

Contact

Keystone Software LLC · privacy@briggzy.com