Consumer health data privacy policy

This policy is part of our privacy policy. It covers “consumer health data”: personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health. We apply it to everyone, wherever they live.

What we collect

• Medications you list in a caregiving or leave plan, such as names, doses and schedules.
• Care profiles, such as health conditions, allergies, doctors and emergency details for the person you care for.
• Appointments, such as visits, providers and questions to ask.
• Daily check-ins and trackers, such as mood, sleep, energy, pain and symptoms.
• Health information in other places if you choose to put it there, such as notes, documents in your vault, health care directives and conversations with our AI care specialists.

Some of this may be about someone else, such as a parent you care for. Please add only what you have the right to share.

Where it comes from

From you, and from people you invite to your plan who add it. We do not buy health information or get it from your employer, insurer or anyone else.

How we use it

• To show it to you and the people you share your plan with.
• To make things you ask for, such as a medication list, an emergency sheet or a summary for a doctor’s visit.
• To answer your questions, if you allow our AI care specialists to read your plan. They use it only to write the answer to you.
• To keep Gracekeeps secure and working, and to meet legal obligations.

We do not use it for advertising, and we do not sell it. Organizations that offer Gracekeeps never see it, only anonymous totals.

Consent

Before you first save a medication, care profile, appointment or check-in, Gracekeeps asks for your consent, separately from our terms and privacy policy. Nothing is saved until you agree. You can withdraw consent at any time in the app under Settings, Privacy and account. When you withdraw, you can also delete the medications, care profiles, appointments and check-ins in your plans in one step.

Who we share it with

• People you choose, such as family members you invite to a plan, and trusted contacts after a death is reported, as you set up.
• Service providers who process it for us under contract and only on our instructions: our hosting provider, which stores it encrypted; our AI provider, only when you allow the care specialists to read your plan or ask them to read a document, under business terms that do not allow training on it; and our email provider, for emails you ask for, such as reminders with the names of your steps. We never put medications, conditions or check-ins in emails or text messages.
• When the law requires it, such as a valid court order. Where we can, we will tell you first.

We do not share it with advertisers, data brokers, employers, insurers or affiliates.

Your rights

• Know and access. Confirm whether we collect, share or sell your consumer health data, see it, and get a list of the third parties we share it with.
• Withdraw consent at any time, in the app or by contacting us.
• Delete it, in the app or by contacting us. We delete it within 30 days. Backup copies are removed on a rolling schedule after that.
• Appeal. If we say no to a request, you can appeal by replying to our answer or contacting us with “Health data appeal” in the subject. We will answer within 45 days. If you are not satisfied, you can contact your state attorney general.

To make a request, use the app or email hello@gracekeeps.com. We answer within 45 days and verify your identity first. We will not treat you differently for using these rights.

How we protect it

Health information is encrypted when stored, sent over encrypted connections, and not visible to Gracekeeps staff. Read more on our security page.

Changes and contact

If we make important changes to this policy, we will tell you in the app or by email before they take effect, and ask for consent again where the law requires it. Questions? Email hello@gracekeeps.com or use our contact form.