Consumer Health Data Privacy Policy

Parents can save health information about their children in Braidly so that both parents can care for them. We ask for your consent before we save it, we use it only to provide Braidly to your family, we never sell it, and we take the exact words you saved out of what we send to our AI provider. You can see it, correct it, delete it, withdraw your consent, and appeal if we turn down a request.

1. Who this policy is for

This policy explains how Braidly Technologies LLC ("Braidly", "we") handles consumer health data, as Washington's My Health My Data Act (RCW 19.373), Nevada's consumer health data law (SB 370) and Connecticut's consumer health data rules use that term: information that identifies a person's past, present or future physical or mental health. It applies to everyone who uses Braidly, wherever they live. It adds to our Privacy Policy (braidly.co/privacy); where the two differ about health data, this policy applies.

2. The health data we collect, and why

Braidly is a co-parenting app. Most of the health data in it is about children, entered by their parents. Before a parent saves health information in the first five places listed below, the app asks for their consent. We use health data only to provide Braidly to that family: to show it to both parents and to the people a parent gives medical access to, so that whoever has the child can care for them. We do not use it for advertising, profiling, research or anything else.

A child's health details: allergies, blood type, medications (name, dose and how often), medical notes, and the primary doctor's name and phone number.
Health insurance: the insurance provider and the member ID.
Medication dose logs: which medication was given, the dose, notes and when.
Medical decisions: a decision one parent asks the other to agree to (for example a treatment or an appointment), its details, the provider, the urgency, any documents and the answer.
Handoff logs: a health note about the child at a handover, and whether medicine was given and when.
What can reveal health in other records: a message, an expense (for example a doctor's bill), a calendar event, a document or a journal entry can mention health if a parent writes it there. We store those as the parent wrote them, as part of the family's record. The consent screen does not cover them: you choose to write it there, and we use it only to show it where you put it.
What a parent writes about themselves: the Co-Parenting Advisor and the journal are private to the parent who uses them, and what you write there can include your own health or how you are feeling. We keep it only to show it back to you and to answer you, and you can delete it at any time.

We do not collect health data from the child. The Kids View link a parent gives a child shows no health information.

3. Where it comes from

From the parents who use Braidly: what you and your co-parent type or upload. We do not buy health data, receive it from other companies, infer it, or collect it from devices or locations.

4. Who it is shared with

Your co-parent. Health information in the family's record is shown to both parents.
People you choose. A parent can give a grandparent, caregiver, attorney or other person access in Family Access, and can include a child's medical summary or full medical record. That person sees it only because a parent chose to share it, and the parent can end the access at any time.
Our service providers (processors), which store or carry it for us under their data processing terms and may not use it for their own purposes: Supabase, Inc. (database and storage, hosted on Amazon Web Services in Virginia, USA); Vercel, Inc. (hosting); Resend (e-mail, for example a notification that a medical decision is waiting); OneSignal, Inc. (push notifications). The categories shared with them: all of the health data in Section 2, as stored.
Our AI provider, Anthropic, PBC, as a processor, only when you or your co-parent use an AI feature (Privacy Policy, Section 4 lists them). Before a feature that reads your messages or your family's records sends anything, we take out the exact words saved in your children's health details, dose logs and handoff health notes. Other wording of the same thing (for example "peanut" when "Peanuts" is saved), and health information you write in your own words, is sent as written so that the feature can work. Anthropic does not train on it and deletes it within 30 days (Privacy Policy, Section 4).
Legal process: only as the law requires or allows (Privacy Policy, Section 5).

Braidly has no affiliates, never sells health data, and never shares it for advertising.

5. Your consent

Before Braidly saves new health information that you enter in a child's health details or insurance, a dose log, a medical decision or a handoff health note, the app asks for your consent on a separate screen, and records your answer with the version of the text, the time and a scrambled form of your IP address. You can withdraw it at any time in Settings, Privacy. After you withdraw, information already saved stays in the family's record until it is deleted, and no new health information can be saved in those places from your account until you consent again: our database refuses it.

6. Your rights, and how to use them

Know and access. Ask whether we collect, share or sell your or your child's health data (we never sell it), and get a copy of it with the list of every third party and processor it has been shared with, and an email address or online form you can use to contact each of them.
Correct and delete in the app. Either parent can change or clear a child's health details at any time: open the child, edit, and clear the field. A cleared field is deleted. Deleting a dose log or a medical decision in the app hides it from both parents but keeps it in the family's record, so that the record cannot be quietly rewritten; to have it removed for good, ask us.
Ask us to delete. Email privacy@braidly.co (subject "Health data deletion request") or use "Ask us to delete health information" in Settings, Privacy. We delete it from the family's record, including what the app only hides, and tell every processor, contractor and other third party we shared it with to delete it. Copies in our database backups age out within 7 days.
Withdraw consent in Settings, Privacy.

We answer within 45 days. If we need longer, we tell you within those 45 days, together with the reason, and the extension is no more than 45 more days. We may ask you to confirm the request comes from your account, and we will not charge you. Two limits, explained in the answer if they apply: health information in a family's shared record is also the other parent's record, so we will not remove what one parent entered at the other parent's request without a legal reason; and while a legal hold is on the family, nothing in its record can be deleted until the hold ends.

7. If we say no: appeal

If we turn down your request, in whole or in part, you can appeal by replying to our answer or e-mailing privacy@braidly.co with the subject "Appeal" within 60 days. The founder reviews every appeal personally. We answer within 45 days in writing, with what we did or did not do and why. If we turn down the appeal, you can complain to the Washington State Attorney General (www.atg.wa.gov/file-complaint), the Nevada Attorney General (ag.nv.gov) or the Connecticut Attorney General (portal.ct.gov/ag), or to the regulator where you live.

8. How we protect it

Health data is encrypted in transit and at rest, protected by row-level security so only your family (and people you give access to) can read it, and reachable by Braidly staff only to run and support the service. Our security measures are in Privacy Policy Section 7.

9. Changes and contact

If we change this policy in a way that affects how we collect, use or share health data, we ask for your consent again before the change applies to you. Questions: privacy@braidly.co · Braidly Technologies LLC, c/o Registered Agents Inc, 6650 Rivers Ave., STE 100, Charleston, SC 29406.