Consumer Health Data Privacy Policy
This policy explains how MedRec List handles “consumer health data” as defined by the Washington My Health My Data Act and similar laws in other states, such as Nevada and Connecticut. It adds to our Privacy Policy.
[COMPANY LEGAL NAME]
[MAILING ADDRESS]
Our approach
MedRec List is built so that your health information stays on your device. Medication, allergy, question and person information is stored only on your device, encrypted. Label photos are processed on your device and never uploaded. We cannot read this information.
Consumer health data we collect
We collect consumer health data only if you choose to create an account and turn on backup:
- Encrypted backup file. It contains your list, allergies, questions and people. It is encrypted on your device with your passphrase before upload. We store it but cannot read it.
- Account information. Account ID, sign-in provider, email address, created date and the version of the Terms you accepted. On its own this is not health information. Because it shows that you use a medication-list app, we treat it as consumer health data under this policy.
If you use the app without an account, we do not collect any consumer health data about you.
Why we collect it
- To store your encrypted backup and return it to you when you restore.
- To create and run your account, including sending sign-in codes.
- To reply to your requests and meet legal requirements.
We do not use consumer health data for advertising.
Where it comes from
Directly from you, through the app on your device. When you sign in with Apple or Google, that company confirms your identity and email address.
Who we share it with
We share consumer health data only with service providers (processors) that run the service for us:
- Supabase — stores account information and the encrypted backup file.
- Google — delivers sign-in code emails (email address only).
- Apple and Google — confirm your identity when you choose to sign in with them.
We have no affiliates that receive consumer health data. We do not share consumer health data with advertisers, including Google AdMob. We may disclose information if the law requires us to.
We do not sell consumer health data
We do not sell consumer health data, and we do not use geofencing around health care locations.
Your consent
We collect consumer health data only after you choose to create an account and turn on backup. You can withdraw consent at any time by deleting your account, which deletes the account and the backup.
Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data;
- get a list of the third parties and affiliates we share it with, and a way to contact them;
- get a copy of your consumer health data. Because your backup is encrypted, we can give you the encrypted file, which only your passphrase can open;
- delete your consumer health data; and
- withdraw your consent.
How to use your rights
- In the app: Settings → Encrypted backup → Delete account and backup. See Delete your account.
- By email: write to [email protected] from the email address on your account.
We may need to confirm that the request comes from you. We will respond within 45 days, as the law requires. If we need more time, we will tell you why.
Appeals
If we deny your request, you can appeal by emailing [email protected] with “Appeal” in the subject line. We will reply in writing within 45 days and explain our decision. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov, or the attorney general in your state.