Consumer Health Data Privacy Policy

This policy is for people covered by Washington's My Health My Data Act (RCW 19.373). It explains what consumer health data ParentPulse LLC ("we") collects, why, where it comes from, who it goes to, and how to use your rights. Our Privacy Policy covers everything else.

1. What We Collect and Why

ParentPulse is a family organizer, not a health app. The only place it asks for health information is the caregiver prep sheet. Other things a parent or child chooses to enter can also reveal health information about someone in the family:

• Caregiver prep sheets a parent saves to the family (a ParentPulse+ feature): a child's allergies, medications or routines, a pediatrician's name and contact details, and an emergency medical authorization note. We use these to show, edit and print the sheet for your family.
• Calendar events: an event's title, date and time can name a medical, dental, therapy or other health appointment, along with the family members tagged on it. We use these to show your family calendar, to notify the family's parents when an event is added or changed, and, for each parent who turns them on, to send event reminders by email and notification.
• Photos for adding events: a photo or screenshot a parent chooses, such as an appointment card, can show health details. We use it only to read the dates in it, and we do not store it.
• Photos you attach to a chore, a to-do or a child's request, which can show something health-related. We use these to show the item to your family, and we delete them in a weekly cleanup.
• Other text you write: chore and to-do titles (for example "allergy medicine"), messages between parents, a child's requests, Blue Ribbon messages, goal, reward and project titles, trophy notes, feedback on a goal, notes a parent adds for an AI coaching report, and messages sent through the in-app support form. We use these only to run the feature they were written in, including notifying your family about them and, for the AI coaching report, writing it.
• Behavior chart data: clip chart positions, stars, streaks, and the AI coaching reports a parent asks for, to the extent they describe a child's behavior. We use these to show the chart and, when a parent asks, to write a coaching report.

We use consumer health data only to provide these features to your family. We do not sell it, use it for advertising, or use it to train AI models.

2. Where It Comes From

• Parents and guardians in your family, who type it in or choose a photo.
• Children in your family, through their own profile (for example, a request a child writes).
• What our features produce from those: draft events read from a photo, suggested events from a child's request, and AI coaching reports.

3. Sharing

We do not share or sell consumer health data to any third party or affiliate.

To run the features above, these service providers process it on our behalf, only to provide their service to us. Under the Act they are processors, not third parties:

• Supabase: database, file storage and sign-in.
• Anthropic: the AI that reads dates in a photo, turns a child's request into a suggested event, and writes coaching reports.
• Resend: delivers event reminder emails, which list tomorrow's event titles, times and the first names of the family members tagged, and the messages you send through the in-app support form.
• Cloudflare and Google: Cloudflare forwards email sent to our support and privacy addresses to an inbox Google hosts, so a message you write to us passes through both.
• GitHub: holds our nightly database backup, encrypted with a key GitHub does not have.

Notifications (a new or changed event, an event reminder, a finished chore or to-do, a child's request, a Blue Ribbon) travel encrypted through your browser's or phone's push service (Google, Apple, Microsoft or Mozilla), so those services cannot read them.

4. Your Rights

If the Act covers you, you have the right to:

• Confirm and access: find out whether we collect, share or sell consumer health data about you, and get a copy of it, with a list of every third party and affiliate we shared it with and how to contact them. As section 3 says, that list is empty.
• Withdraw consent to our collecting and sharing it.
• Delete it. We delete it from our systems, including our encrypted backups, which expire within 90 days, and tell the service providers that hold a copy to delete it too.

A parent or guardian can make these requests for their child.

You can also do much of this yourself in the app: delete an event, a chore or a saved prep sheet; download or remove a child's data from Settings; or delete your whole account from Settings > Danger Zone.

5. How to Make a Request

Email privacy@myparentpulse.app from the email address on your ParentPulse account and say which right you want to use. You do not need to create an account to make a request, but if you have one, we may ask you to confirm the request from it. If we cannot confirm a request comes from you, we may ask for more information.

Requests are free up to twice a year. We answer within 45 days. If we need more time, we may extend that once by another 45 days, and we will tell you why within the first 45.

6. Appeals

If we decline to act on your request, you can appeal by replying to our decision, or by emailing privacy@myparentpulse.app with "Appeal" in the subject. We will tell you in writing within 45 days what we did and why. If we deny your appeal, you can file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint.