Privacy Requests

Your rights and the law

Find Your State’s Privacy Rights and Statutes

Use the request instructions below to ask for deletion or exercise another privacy right. You do not need to identify a statute, have an account, or be a Care Space Admin to submit a request about your own information. This includes information another person entered about you. If you act for someone else, we may need to verify your authority. The rights and exceptions that apply depend on the law, the information involved, and the circumstances.

• Washington — consumer health data
• Texas — consumer data and health-record protections
• Minnesota — personal data and health records
• Connecticut — personal and consumer health data
• Nevada — consumer health data
• Oregon — personal and sensitive data
• California — consumer privacy and medical confidentiality

Submit a privacy choice or opt-out. The official statutes are linked under each state; the summaries are not the full legal text.

Existing account

Open the Privacy Request Center

1. Sign in with the email already connected to Giver’s Atlas.
2. Open Account & privacy.
3. Choose access, correction, export, deletion, withdrawal, or an authorized-agent request.
4. Track acknowledgment, verification, due date, decision, fulfillment evidence, and any available appeal in the same center.

No account access

You do not need to create a new account.

If you cannot use an existing account, email privacy@giversatlas.com with only your name, an associated account email if you have or know one, whether you are acting for yourself or as an authorized agent, and the type of request. You can request rights over your information even if someone else entered it and you have never had an account. Do not include medications, diagnoses, readings, notes, documents, or other health details in email. For access, correction, or deletion, Giver’s Atlas may require identity and, when applicable, agent-authority verification as permitted by law. Different verification rules apply to the opt-outs described below.

Texas records and complaints

Request Your Health Records or Contact a Regulator

1. Request records from Giver’s Atlas: use the existing-account instructions above and choose access or export. If you cannot use an existing account, email privacy@giversatlas.com with your name, the email associated with the service if you have one, and the fact that you are requesting your records. Tell us if you are acting as a representative. We will arrange identity and authority verification and a secure way to identify and deliver the requested records. Do not email health details.
2. Find the appropriate regulator: for a privacy complaint about Giver’s Atlas, use the Texas Attorney General’s complaint route below. The Attorney General’s patient-privacy page also helps identify other agencies with jurisdiction. If your concern involves a separate licensed clinician or facility, use that guidance to contact its disciplinary or licensing authority.
3. File a consumer privacy complaint: open the Texas Attorney General’s consumer complaint page, choose the Privacy complaint route, and follow its instructions. Identify Giver’s Atlas LLC, describe the issue and relevant dates, and include our website and privacy@giversatlas.com. Follow the Attorney General’s instructions about sensitive information; complaints may become public records.

Available requests

Privacy Requests You Can Submit

Timing and safety

Immediate Receipt; 30-Day Operating Target

The signed-in center acknowledges a case immediately and uses a 30-day operating target. This target and the standard workspace recovery window do not extend a deadline required by applicable law. Verification is required for sensitive fulfillment, and Giver’s Atlas may request only the additional information reasonably needed to authenticate the request. Do not place health details in the public email pathway.

Read the Consumer Health Data Privacy Notice for categories, purposes, recipients, retention, and withdrawal effects.

Privacy choices and opt-outs

Tell Us Which Use or Disclosure You Want to Stop

Email privacy@giversatlas.com with the choice you want to exercise and an associated account email, if you have or know one. You do not need to create an account or send health details. Applicable choices include opting out of sale, targeted advertising or sharing for cross-context behavioral advertising, and profiling for decisions with legal or similarly significant effects. California residents may also request limits on certain uses and disclosures of sensitive personal information when that right applies.

You may separately request withdrawal of consent to collection or sharing of your consumer health data using the existing-account or no-account channels above. California’s advertising “sharing” opt-out has a specific legal meaning; if your concern is a caregiver or Viewer’s access to your health information, identify the request as a consent-withdrawal or Care Space access concern.

Access, correction, and deletion may require verification. We do not require the identity-verification process used for those requests when the applicable law prohibits it for an opt-out or sensitive-use limitation request. We may ask for information needed to identify the affected data and apply the choice, and may verify an agent’s authority as permitted by law. The state sections explain the relevant rights and response periods.

Washington consumer health data

Access, Recipients, Withdrawal, Deletion, and Appeals

Where Washington’s My Health My Data Act applies, you may confirm whether we collect, share, or sell your consumer health data, access it, request all third parties and affiliates that received it with their online contact information, withdraw consent to collection and sharing, or request deletion. Use the existing-account or no-account request channels above. The separate Washington Consumer Health Data Privacy Policy describes our collection, uses, and disclosures.

Washington requires action without undue delay and within 45 days after receipt; authentication does not extend the clock. One reasonably necessary extension, based on the complexity and number of the consumer’s requests, may add up to 45 days, with notice and reasons within the initial period. Deletion includes the required recipient notifications and downstream deletion; archived or backup deletion may be delayed only as the law permits, for no more than six months after authentication. Information requests are free up to twice annually, with any fee or refusal subject to the law.

To appeal a refusal, select appeal in the Privacy Request Center or email privacy@giversatlas.com with “Privacy appeal” and the request reference, if available. Do not email health details. Washington requires a written outcome and reasons within 45 days after receipt. You may submit a complaint to the Washington Attorney General.

Texas consumer data and health-record protections

Requests under the Applicable Texas Law

When the Texas Data Privacy and Security Act applies, you may confirm processing and access your personal data, correct inaccuracies, request deletion of data provided by or obtained about you, obtain a portable copy as the law provides, and opt out of targeted advertising, sale, or qualifying profiling. Use the request channels or privacy-choice instructions above. Coverage and exemptions matter; these consumer rights do not arise solely because another Texas health-privacy law applies.

The Act requires a response within 45 days after receipt. A reasonably necessary extension may add up to 45 days with timely notice and reasons. To appeal a refusal, use the center’s appeal option or email privacy@giversatlas.com with “Privacy appeal” and your request reference, if available. The written appeal outcome is due within 60 days after receipt. A denied appeal must include the route to contact the Texas Attorney General.

Texas Health & Safety Code Chapter 181 separately addresses health-record privacy and electronic-disclosure authorization, subject to its exceptions. Read our records-request and regulator instructions. The provider electronic-record access rule in §181.102(a)–(b) applies to qualifying healthcare providers; it is not a general deletion right for every health-related service.

Minnesota personal data and health records

Requests, Specific Recipients, Profiling, and Appeals

Where the Minnesota Consumer Data Privacy Act applies, you may confirm processing and access categories of your personal data, correct inaccuracies, request deletion, obtain a portable copy as provided by law, and opt out of sale, targeted advertising, or qualifying profiling. You may request a list of specific third parties to which your personal data was disclosed. If consumer-specific recipient information is not maintained, the law permits a list covering all consumers instead. For qualifying profiling, you may question the result, receive reasons and, if feasible, information about actions that could have led or could lead to a different decision, and review the data used. If the decision was based on inaccurate personal data, you may have that data corrected and the decision reevaluated using the corrected data. Use the request channels or privacy-choice instructions above.

Minnesota requires notification of action without undue delay and within 45 days after receipt, with one necessary extension of up to 45 days and timely notice and reasons. Opt-outs must be fulfilled as soon as feasibly possible and within 45 days. Consent-dependent processing must stop as soon as practicable and within 15 days after receipt of withdrawal. To appeal, use the center’s appeal option or email privacy@giversatlas.com with “Privacy appeal” and your request reference, if available. The appeal decision is due within 45 days after receipt of the appeal; a reasonably necessary extension may add 60 days with timely notice and reasons. The written outcome must give reasons and explain how to complain to the Minnesota Attorney General.

Minnesota’s health-records law separately protects release of records by a provider or someone who received them from a provider. It requires signed, dated consent or another legal basis permitted by §144.293, subdivision 2. That protection is distinct from the consumer data deletion right.

Connecticut personal and consumer health data

Requests, Consent Withdrawal, and Appeals

Where Connecticut’s law applies, you may confirm processing and access your personal data, including applicable inferences and profiling-use information; correct inaccuracies; request deletion; obtain a portable copy; and opt out of targeted advertising, sale, and qualifying profiling. The law also provides feasible explanations and review of qualifying profiling, with certain correction and reevaluation rights specific to housing decisions. If personal data is sold, you may request a list of the third parties that bought it, subject to the law’s trade-secret protection; an all-consumer buyer list is permitted if consumer-specific information is not maintained. Use the request channels or privacy-choice instructions above.

Connecticut requires a response within 45 days after receipt, with one reasonably necessary extension of up to 45 days and timely notice and reasons. Consent-dependent processing must stop as soon as practicable and within 15 days after receipt of withdrawal. To appeal, use the center’s appeal option or email privacy@giversatlas.com with “Privacy appeal” and your request reference, if available. The written outcome is due within 60 days after receipt. A denied appeal must include a route to contact the Connecticut Attorney General.

The official supplement displays more than one version of these sections. Read the text effective July 1, 2026.

Nevada consumer health data

Requests, Deletion, and Appeals

Where Nevada’s consumer health data law applies, use the existing-account or no-account process above to ask for confirmation of collection, sharing, or sale; a list of all third parties with whom we shared your consumer health data or to whom we sold it; cessation of collection, sharing, or sale; or deletion. You may withdraw collection or sharing consent through the same channels. You may also use our correction process to review or request changes to information; that process is available separately from Nevada’s listed statutory rights.

• Response: Nevada law requires a response without undue delay and within 45 days after authentication. An extension of up to 45 additional days is permitted when reasonably necessary because of the complexity and number of requests from the same consumer, with the reason and notice provided during the initial period.
• Deletion: the separate deadline is 30 days after authentication to delete all consumer health data covered by the request from our records and networks, subject to the backup exception below, and notify recipients. Recipients must delete within 30 days after notification. The general response extension does not extend these deletion deadlines.
• Backups: Nevada permits delayed deletion only as necessary to restore archived or backup systems, for no more than two years after authentication. This is a legal maximum, not our standard retention period; a shorter applicable commitment still controls.
• Charges and treatment: at least two information requests each year are free. Further requests are also free unless manifestly unfounded, excessive, or repetitive. Any fee permitted by Nevada law must be reasonable. We do not discriminate against you for exercising these rights.

Appeal a Refusal

Select appeal for the decision in the Privacy Request Center, or email privacy@giversatlas.com with “Privacy appeal” and the request reference, if available. Do not email health details. Nevada requires a written outcome with reasons within 45 days after receipt of the appeal. If we decline the action requested, we provide contact information for the Nevada Attorney General’s Bureau of Consumer Protection.

Oregon personal and sensitive data

Requests, Withdrawal, Opt-Outs, and Appeals

Where the Oregon Consumer Privacy Act applies, use the request channels above for confirmation, access, a copy, correction, deletion, withdrawal of consent, or an appeal. For a recipient-list request, ask for the specific third parties that received personal data. At our option, the list may cover either your personal data or all personal data we have disclosed. Oregon’s specific-list right excludes natural persons and uses the law’s definition of third party.

• Response: Oregon requires action without undue delay and within 45 days after receipt. A further 45 days is permitted when reasonably necessary because of the complexity or number of requests, with notice and the reason during the initial period.
• Withdrawal: ask to revoke consent and identify the processing concerned. Where processing depends on that consent, Oregon requires it to stop as soon as practicable and within 15 days after receipt.
• Charges: the first information request in a 12-month period is free. Oregon permits a reasonable administrative charge for subsequent information requests, but not for confirming that a prior correction or deletion was completed.

Submit an Opt-Out Request

You may request an opt-out of sale, targeted advertising, or profiling for decisions with legal or similarly significant effects by emailing privacy@giversatlas.com. Identify the choice you want to exercise and an associated account email, if you have or know one; do not send health details. An opt-out request does not require authentication. We may ask for information needed to identify the affected information and apply your choice. An authorized agent may submit an opt-out request, subject to the verification permitted by Oregon law. Our care workspace does not sell care information or use care content for advertising or profiling.

Appeal a Refusal

Select appeal for the decision in the Privacy Request Center, or email privacy@giversatlas.com with “Privacy appeal” and the request reference, if available. Oregon requires a written outcome and reasons within 45 days after receipt. If an appeal is denied, we provide the online route to contact the Oregon Attorney General with a privacy complaint. Exercising these rights does not result in unlawful discrimination.

Oregon’s official link opens Chapter 646A. Search within that page for the section number shown above.

California consumer privacy and medical confidentiality

Know, Correct, Delete, and Control Applicable Uses

When the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, California residents may request access to their personal information, correction of inaccuracies, and deletion, subject to applicable exceptions. They may learn what categories were sold, shared, or disclosed for business purposes; opt out of the sale of personal information and its sharing for cross-context behavioral advertising; limit certain uses and disclosures of sensitive personal information; and exercise these rights without unlawful discrimination. A limit request does not prohibit every use needed to provide a requested service. Use the request channels or privacy-choice instructions above; you do not need to create an account.

• Know, correct, or delete: applicable California rules require acknowledgment within 10 business days and a response within 45 calendar days after receipt. Verification does not restart the clock. A reasonably necessary extension may add up to 45 calendar days, with notice and an explanation of the reason within the initial period.
• Opt out or limit: applicable requests must be fulfilled as soon as feasibly possible and within 15 business days after receipt. These requests do not require the identity-verification procedure used for access, correction, or deletion.
• Deletion exceptions: §1798.105(d) permits retention in specified circumstances, including certain service, security, and legal-compliance needs. A request is assessed under the applicable exception; the standard workspace recovery window does not extend the statutory deadline.
• Questions about a refusal: ask for review through the request channels above. The CCPA does not establish the same general controller-appeal right as the other state laws described here. You may also use the California Privacy Protection Agency’s complaint process.

California’s Confidentiality of Medical Information Act may separately apply to qualifying health applications. When it applies, disclosure of protected medical information requires a valid authorization or a statutory exception. An account role or acknowledgment of this notice does not by itself provide that authorization. Certain medical information is exempt from the CCPA, so these laws do not necessarily apply to the same information in the same way.

Additional request rules are regulations, rather than statutes: 11 CCR §§7021(a)–(b), 7026(d), (f)(1), and 7027(e), (g)(1), covering acknowledgment, response, opt-out, limitation, and verification requirements.