Consumer health privacy
Consumer Health Data Privacy Notice
This notice explains the care information Giver’s Atlas handles, why it is used, who may receive it, and how a person can exercise privacy rights.Use non-identifying sample information only. Do not enter personal or health information about a real person.
At a glance
Giver’s Atlas does not sell care information.
State-specific consumer health protections
Washington, Texas, Minnesota, Connecticut, Nevada, Oregon, and California
Health information includes medicines, dose records, care routines, and other details that reveal a person’s health or care needs. State protections concern the person whose information is involved. A caregiver, Admin, or Viewer role does not itself establish legal authority to share that person’s information. Read-only access can still disclose health information.
Washington
The My Health My Data Act provides rights concerning collection, sharing, access, deletion, and withdrawal of consent. Our separate Washington Consumer Health Data Privacy Policy explains the health information we handle, its sources and uses, and recipients. See the Washington rights, request instructions, and statutes for how to exercise these rights.
Texas
When the Texas Data Privacy and Security Act applies, consumers may request confirmation and access, correction, deletion, and a portable copy of personal data; opt out of sale, targeted advertising, and profiling that produces legal or similarly significant effects; and appeal a refusal. See the Texas rights, request instructions, and statutes.
Separately, health information in Care Spaces may be disclosed electronically as described in this notice. Where Texas Health and Safety Code Chapter 181 applies, electronic disclosure requires separate authorization for each disclosure unless a statutory exception applies. See our Texas records-request and complaint instructions.
Minnesota
When the Minnesota Consumer Data Privacy Act applies, sensitive-data processing generally requires consent, and consumers have access, correction, copy, deletion, appeal, and applicable opt-out rights. They may request specific third-party recipient lists and review or challenge qualifying profiling decisions. For a known child, the law requires parental or guardian consent as specified by applicable children’s privacy rules. Separately, Minnesota health-records law generally requires signed, dated consent or another permitted legal basis before a provider, or a person who received records from a provider, releases those records. See the Minnesota rights, request instructions, and statutes.
Connecticut
Connecticut’s consumer-health protections apply to consumer health data controllers doing business in Connecticut or targeting Connecticut residents regardless of their size. Applicable protections include consent for sensitive-data processing, withdrawal of consent, access, correction, copies, deletion, appeals, and opt-outs. Additional rights include a list of third parties that bought personal data about the consumer and, where applicable, access to profiling information and review of qualifying automated decisions. See the Connecticut rights, request instructions, and statutes.
Nevada
Nevada’s consumer health data law has no minimum revenue or consumer-count threshold. Subject to its exclusions, it protects people who have requested a product or service from us and who reside in Nevada or whose consumer health data is collected there. It covers identifiable or reasonably linkable information we use to identify past, present, or future health status, including medicines, symptoms, and care needs. This notice’s categories, sources, uses, processing, sharing, and choices also describe our handling of that information.
Where consent is required, collection needs prior affirmative, voluntary consent, and sharing needs separate consent. The law also permits collection or sharing necessary for a service requested by the person whose data is involved, and disclosures authorized or required by law. Nevada provides rights to confirmation, a list of third-party recipients, cessation of collection, sharing, or sale, deletion, and appeal. See the Nevada rights, request instructions, and statutes.
Oregon
When the Oregon Consumer Privacy Act applies, health conditions and diagnoses are sensitive data and processing generally requires consent. Coverage generally requires processing data about at least 100,000 Oregon consumers in a year, excluding data processed solely to complete payment transactions, or at least 25,000 consumers while deriving 25% or more of annual gross revenue from selling personal data. Statutory exemptions also apply; using a health-related service does not itself make information exempt.
Applicable rights include access, correction, a copy, deletion, withdrawal of consent, appeals, and a list of specific third parties that received personal data. Consumers may also opt out of sale, targeted advertising, and profiling for decisions with legal or similarly significant effects. See the Oregon rights, request instructions, and statutes or submit a privacy opt-out.
California
When the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies, consumers may request access, correction, and deletion; opt out of the sale of personal information or its sharing for cross-context behavioral advertising; limit certain uses and disclosures of sensitive personal information; and exercise their rights without unlawful discrimination. Coverage requirements and exemptions apply. See the California rights, request instructions, and statutes.
Separately, California’s Confidentiality of Medical Information Act (CMIA) may apply to qualifying health applications under Civil Code section 56.06. Where CMIA applies, disclosure of protected medical information requires a valid authorization or a statutory exception. A workspace role or acknowledgment of a privacy notice does not itself provide that authorization.
Categories and sources
Information Covered by This Notice
Giver’s Atlas LLC operates Giver’s Atlas and determines how the information described here is processed. Questions about this notice or a person’s rights can be sent to privacy@giversatlas.com.
Categories Collected
- Account and contact information, including name, email, optional phone number, member profile photo, optional care-recipient profile photo, notification preference, and text-size preference.
- Care-profile and authority information, including relationship, adult-or-minor classification, caregiver-authority basis, state of residence, workspace role, permissions, invitations, and sharing choice. Giver’s Atlas does not request a date of birth or precise location.
- Care information entered into the workspace, including medications and dose history; vital readings; daily plans and observations; appointments; providers; pharmacy and refill information; insurance information; tasks; notes; and care-team information. Observation and incident images must be staged or illustrative, without real symptoms, injuries, or identifying information. Do not upload real symptom, injury, or identifying observation photos.
- Subscription and billing information, including the selected plan and billing interval, Stripe customer and subscription identifiers, billing status, and payment or billing details entered directly into Stripe’s hosted pages. Giver’s Atlas does not intentionally send care-workspace content to Stripe.
- Consent, eligibility, privacy-request, appeal, export, correction, and deletion records needed to honor choices and document fulfillment.
- Limited security and operational information, including account/session identifiers, generic audit events, invitation metadata, request identifiers, and a short-lived one-way network fingerprint used to rate-limit the public access form.
Care entries and uploads may reveal sensitive information, including physical or mental health conditions, diagnoses, treatments, reproductive or sexual health, disability, and a child’s personal information. Their sensitivity does not depend on which workspace role entered or viewed them.
Sources
- The account holder and other authorized workspace members.
- An authorized agent who submits a request on a person’s behalf.
- Clerk for account, authentication, session, MFA, and invitation information.
- Microsoft Azure and the user’s device for hosting, storage, network, delivery, and security information necessary to operate the service.
- Stripe for optional subscription, payment, invoice, and billing-status information.
Purposes and processing
How the Information Is Used
- Organize the care workspace and display the features the user requests.
- Use the confirmed state of residence to identify potentially applicable privacy disclosures and rights. Giver’s Atlas does not use GPS, browser geolocation, or health-facility geofencing.
- Authenticate accounts, enforce workspace and role boundaries, deliver invitations, and prevent misuse.
- Enable private or collaborator mode according to the primary Admin’s separate sharing decision.
- Generate requested exports, maintain history, and fulfill access, correction, withdrawal, appeal, and deletion requests.
- Maintain minimal consent, security, and fulfillment evidence; investigate incidents; and satisfy legal obligations.
Giver’s Atlas processes workspace information in Microsoft Azure application, database, and private object-storage services. Clerk processes account and authentication information. Stripe provides hosted subscription pages; no real charge is made. The service uses the information to provide user-requested coordination features; it does not use care content for advertising or profiling.
Processing includes receiving and storing submitted information, organizing medicines and recurring care routines, displaying records to members with the applicable access, recording updates and dose history, producing requested exports, and carrying out corrections or deletion. An Admin maintains the recurring care routine; other caregivers use the shared plan according to their permissions.
Sharing and recipients
Who May Receive Information
- Invited workspace members: only when the primary Admin enables collaborator sharing, and only according to each member’s role and optional permissions.
- Service providers: Microsoft Azure, Clerk, and Stripe process limited categories needed to host, secure, store, authenticate, and support subscription or billing features for the service. See the current service-provider list.
- Legal and safety recipients: courts, regulators, law-enforcement authorities, or professional advisers may receive information when disclosure is required or permitted by applicable law, including lawful measures to protect users, the service, or others.
The categories that may be shared are account and authentication information, workspace and care information including the sensitive information described above, subscription and billing information, consent and request records, and limited operational/security information—only to the extent needed for the recipient’s stated function. Giver’s Atlas has no affiliates and does not sell consumer health data.
Current Service Providers
- Microsoft Azure: Run, store, secure, and deliver Giver’s Atlas. Account, workspace, care, consent, request, security, and stored-file data submitted through the service; limited network and device information needed to deliver and protect requests.
- Clerk: Authenticate users, secure accounts, and deliver invitations. Account identifiers, email address, authentication factors and events, session information, and invitation metadata; not care-workspace content intentionally sent by Giver’s Atlas.
- Stripe: Process and manage optional subscriptions through hosted Stripe services. Giver’s Atlas account-link identifier, selected plan and billing interval, subscription and customer identifiers, and billing status; contact, payment, and billing information entered directly into Stripe; not care-workspace content intentionally sent by Giver’s Atlas.
Third-Party Collection across Websites and Services
Third parties may collect information over time and across different websites or online services when you use connected services such as Stripe’s hosted billing pages. Stripe’s privacy policy describes device, browser, transaction, and usage information it may collect across its services and other websites and apps. Information associating you with a care-coordination service may qualify as consumer health data when it reveals or is used to identify health status. Giver’s Atlas does not intentionally include care-record content in its authentication or billing requests. The service-provider list explains the information each provider receives and links its privacy information.
Choices and rights
Access, Correct, Export, Delete, Withdraw, or Appeal
A signed-in user can open Account & privacy → Privacy Request Center to request confirmation and access, correction, a portable export, deletion, withdrawal of collection consent, recipient information, or an appeal after a denial. The center records receipt immediately and targets completion within 30 days.
- The primary Admin’s workspace control for collection withdrawal requires successful recent MFA and typing WITHDRAW. An optional note may be provided but is not required. People who cannot use that control may submit a withdrawal request through the existing-account or no-account process on the Privacy Requests page. The workspace control pauses care-data access while the workspace remains private; it does not by itself delete stored records.
- Standard workspace deletion uses a 30-day recovery window before active-system purge. A statutory deletion request must meet the applicable deadline described on the Privacy Requests page; the standard recovery window does not extend that deadline. A restoration-suppression record prevents an older backup from silently returning purged workspace data.
- An authorized agent may submit through the signed-in center with a required authority attestation. Giver’s Atlas may request information reasonably needed to verify the person, agent, or request.
- No new account is required to exercise a right. A person who cannot use an existing account may email privacy@giversatlas.com with only their name, an associated account email if they have or know one, and requested right. Do not email health details.
Retention and changes
Deletion, Notice Changes, and Consent
Workspace information remains while the workspace is active, subject to applicable deletion requirements and any retention required or permitted by law. The product currently keeps an anonymized deletion receipt for up to 730 days and a restoration-suppression marker for 90 days after purge; neither contains the deleted care content.
We post notice updates on this page and revise its effective date. Before a change involving new health-data categories, purposes, or recipients takes effect, we disclose the change and obtain any consent required by applicable law. When a change requires new consent, we ask for that consent in the signed-in application before the affected care-workspace processing continues. Service-provider changes follow the process on the service-provider page.