Consumer Health Data Privacy Policy

1. What this policy covers

This policy describes how we handle consumer health data, and it applies to everyone. Washington, Nevada, and Connecticut law require it to be a separate document from our general Privacy Policy, and give residents of those states specific rights, set out in Section 7. We extend the same handling to everyone because running two standards would be worse for everybody.

Life Maintenance is not a HIPAA covered entity or a business associate, and we are not your healthcare provider. HIPAA does not apply to this information. State consumer health data laws do.

2. What we treat as health information

These laws define health data broadly, and we apply the broad reading. In Life Maintenance, this covers anything you record in these fields, for yourself, for another person in your household, or for a pet:

• Allergies
• Blood type
• Medical conditions
• Medications, including dosage and refill information
• Vaccination and immunisation records, including dates and doses
• Health, dental, and vision insurance provider names, member IDs, and group numbers
• Doctor, dentist, pharmacy, and veterinary contact details you save
• Health-related tasks, reminders, and notes you write
• Date of birth and sex at birth, where we use them to suggest a health-related task

All of it is optional. Every one of these fields can be left empty, and the Service works without any of them. Nothing requires you to enter health information to use Life Maintenance.

3. How we collect it

Only from you. We do not buy health information, we do not receive it from data brokers, we do not infer it from your behaviour, and we do not derive it from any source outside what you type in. If it is in your account, you or another adult in your household put it there.

One clarification about inference: we do use a person’s age and sex at birth to decide which routine health reminders to suggest, such as an age-appropriate screening. That suggestion is generated inside your account from what you entered. It is not sent anywhere, and it is not used to build a profile of you.

4. How we use it

We use health information for exactly one purpose: to provide the Service to you.

• Showing you the records you saved
• Generating and reminding you about health-related maintenance tasks
• Answering a question you ask the assistant about it

We do not, and will not:

• Sell it. Not for money, and not for anything else of value.
• Use it for advertising, or share it with any advertising platform.
• Use it to build a profile of you, or to make decisions about you.
• Use it to train artificial intelligence models.
• Share it with an employer, an insurer, or a data broker.
• Use it for research, our own or anyone else’s.

Life Maintenance does not provide medical advice, drug interaction warnings, dosage guidance, or diagnoses, and nothing in it should be relied on for those.

5. Who we share it with

We do not sell health information, and we do not share it for anyone else’s purposes. It reaches only the companies that operate the Service on our behalf, under contract, and only so it can be stored or shown back to you:

The full list of companies that process any Life Maintenance data is on the Subprocessors page. The ones above are the only ones that can receive health information.

We will disclose health information if the law compels it, such as under a court order. Where we are permitted to tell you first, we will.

6. Consent

Every health field in Life Maintenance is optional and blank until you fill it in. Choosing to enter the information, having read this policy, is your consent to us collecting and using it for the purposes in Section 4 and nothing else. You can withdraw that consent at any time by deleting the information in the app or by writing to us, and withdrawing it does not affect anything that happened before.

We will not share or sell health information for any purpose beyond Section 5. Those laws require a separate, signed authorisation before any such sharing, and we have no plans that would need one. If that ever changes, we would have to ask you specifically, and you would be free to refuse.

Health information about someone else. When you record it for another person in your household, you are confirming you have their agreement, or that you are the parent or guardian of a child. We cannot verify this, so it rests with you. Anyone in your household can ask us to remove their own information, and we will act on that request even if you added it.

7. Your rights

These apply to everyone, not only to residents of the states that require them.

• Know what we hold. Everything is visible in the app. You can also ask us for a list of the health information in your account and of every company that has received any of it.
• Withdraw consent to our collection and processing, at any time.
• Delete it. Delete any field or record in the app, or ask us to delete all of it. On request we delete it from our live systems and instruct every company in Section 5 to do the same, and we confirm to you in writing when it is done.
• Appeal. If we refuse a request, we will tell you why, and you can appeal by replying. If we deny the appeal we will explain how to complain to your state attorney general.

How to make a request. Write to privacy@lifemaintenance.io with the subject line “Health Data Request”. We respond within 45 days, and can extend once by another 45 days where a request is complex, in which case we will tell you before the first period is up. There is no charge. We will not treat you differently, or degrade the Service, because you exercised a right.

We may need to verify that a request comes from you, which normally means answering from the email address on the account. For an authorised agent acting on your behalf, we will ask for written proof of that authority.

8. How long we keep it

Health information is kept while the person or pet it belongs to exists in your account, and no longer. Delete the person, delete the field, or delete your account, and it goes. Removal from the live database is immediate, and backup copies age out within 90 days. Deletion requests are completed within 30 days.

We do not keep an archival copy of health information after deletion, and we do not retain it in anonymised form for analytics.

9. How we protect it

• Encrypted in transit with TLS, and at rest with AES-256.
• Row-level security policies in the database mean another account cannot read your household’s records even if application code has a bug. Those policies are audited automatically on every change.
• Within a household, health information follows the same visibility rules as everything else, so a record marked personal is not visible to other members.
• Access to production data is limited to the people who need it to operate the Service.

10. No geofencing

We do not use geofencing around any healthcare facility, and we do not collect precise location at all. Washington law prohibits geofencing near healthcare providers, and we have nothing in the product that could do it.

11. Contact

Health data requests and questions: privacy@lifemaintenance.io, subject line “Health Data Request”.

Life Maintenance is operated by Inner Fire LLC, 1445 Loma Vista St., Pasadena, CA 91104. Washington residents may also contact the Washington State Attorney General, and Nevada residents the Nevada Attorney General, about a complaint under these laws.