Washington Consumer Health Data Privacy Policy

Categories and purposes

Consumer Health Data We Collect and Use

• Care information: medicines, medication schedules and dose history; vital readings; health observations; care routines and daily plans; appointments; providers; pharmacy and refill information; insurance information; care-related tasks, notes, and care-team information. We use these details to organize the Care Space, display requested care-coordination features, maintain history, and provide requested exports.
• Care-related files and images: information in attachments and profile images submitted through enabled features. We use it to display and organize the associated care information.
• Identity, relationships, and choices linked to care: account and contact details, care-recipient and caregiver relationships, adult-or-minor classification, representative-authority information, state of residence, roles, permissions, invitations, and consent or sharing choices. We use these details to associate information with the appropriate person, manage access, and identify applicable privacy rights.
• Privacy and service records linked to care: consent, withdrawal, request, appeal, export, correction, and deletion records; account/session identifiers; and limited security and operational events. We use them to secure the service, honor privacy choices, and document fulfillment.
• Subscription records linked to care: account-link, customer, and subscription identifiers, selected plan, billing interval, invoice information, and billing status that may reveal use of a care-coordination service. We use these records to provide and manage the requested subscription and related service access.
• Health information revealed by combinations of data: the categories above may identify or support an inference about a person’s physical or mental health, treatment, or receipt of care. They are used for the same care-coordination, access, security, and privacy-request purposes described above.

Sources

Where Consumer Health Data Comes From

• The person whose information is involved, account holders, and other Care Space members who enter or upload information.
• Representatives or authorized agents who provide information or make privacy requests.
• The user’s device and service providers, including Microsoft Azure for hosting, storage, delivery, and security information, and Clerk for account, authentication, session, and invitation information. Account information can become health-related when linked to a Care Space.
• Stripe for subscription, invoice, and billing-status information associated with the requested service.
• Care-related information within the records, files, and images submitted through the service.

Sharing and recipients

Categories Shared, Third Parties, and Affiliates

The categories described above may be shared to provide the requested care-coordination feature, manage permitted access, secure the service, or fulfill a privacy request. Recipients receive only information needed for their function:

• Care Space members: people given access through the Care Space’s sharing choices, roles, and permissions. Access may include viewing information, even when a person cannot edit it.
• Service providers: hosting, database, storage, security, authentication, and invitation providers. Microsoft Azure processes stored care and related service information. Clerk processes account and invitation information; Giver’s Atlas does not intentionally send care-record content to Clerk.
• Subscription providers: Stripe receives the account-link identifier, plan and billing information needed for subscriptions. Giver’s Atlas does not intentionally send care-record content to Stripe; account associations may nevertheless reveal use of a care-coordination service.
• Legal recipients: authorities or other recipients when disclosure is permitted or required by applicable law.

Giver’s Atlas has no affiliates with which it shares consumer health data. Giver’s Atlas does not sell consumer health data.

Your Washington rights

Access, Withdraw Consent, Delete, or Appeal

• Confirm whether we collect, share, or sell consumer health data about you and access that data.
• Request a list of the third parties and affiliates that received your consumer health data, with an active email address or other online contact method for each.
• Withdraw consent to collection and sharing, or request deletion of your consumer health data.
• Appeal a refusal to act on your request.

How to Submit a Request

With an existing account, open Account & privacy → Privacy Request Center. If you cannot use an existing account, email privacy@giversatlas.com with your name, an associated account email if you have one, and the right you want to exercise. Do not email health details. You do not need to create a new account. We may request information reasonably needed to verify your identity and, if someone acts for you, their authority.

Responses and Appeals

We act on applicable requests without undue delay and within 45 days of receipt; identity verification does not extend that deadline. If a permitted extension is necessary, we explain the reason within that period; it may add up to 45 days. To appeal, use the same request channel and identify the decision. We provide a written appeal decision with our reasons within 45 days after receiving your appeal. You may contact the Washington Attorney General to submit a complaint.

Information responding to requests is free up to twice annually. A fee or refusal is permitted only as allowed by law for a manifestly unfounded, excessive, or repetitive request. We do not discriminate against you for exercising your rights. Features that need particular health information may be unavailable if you decline or withdraw the necessary permission.

A deletion request includes notifying recipients required to honor it. Washington law permits delayed deletion from archived or backup systems where needed to enable their restoration, for no more than six months after authentication of the deletion request.

Effective September 29, 2026