Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how LynCare, LLC ("LynCare," "we," "us," or "our") collects, uses, shares, and protects consumer health data in the LynCare mobile app and the LynCare website (together, the "Services").

We publish this as a separate, dedicated document because Washington's My Health My Data Act (MHMDA), Nevada's SB 370, and Connecticut's consumer-health-data law require companies that handle consumer health data to disclose these specific practices in a policy of their own. It sits alongside — and does not replace — our general Privacy Policy, which covers all of the other information we handle.

What is "consumer health data"? Under these laws, it is information that is linked to you and that identifies your past, present, or future physical or mental health. In LynCare, the consumer health data we handle is the participant's care record — medications, health events, and care notes. Other people in a care circle — family members, caregivers, and Care Managers — use the app, but we do not collect consumer health data about them.

Questions about this policy or your consumer health data? Email us at privacy@lyncare.net.

Table of contents

1. Consumer health data we collect, and why
2. Where we collect it from
3. Consumer health data we share
4. Who we share it with — third parties and affiliates
5. We do not sell your consumer health data
6. Your rights and how to exercise them
7. How we protect consumer health data
8. Changes to this policy
9. How to contact us

1. Consumer health data we collect, and why

We collect consumer health data only to deliver the care-coordination service to your care circle. We do not collect it for advertising, and we do not use it to profile you. The categories below, and the purpose of each, are:

Category of consumer health data	Examples	Purpose / how we use it
Medication records	Scheduled medication administration (eMAR) and as-needed (PRN) records — the medication, dose, and the time it was given or skipped	Deliver medication management; show the care team what was given and when; maintain the participant's medication history
Health events and observations	Health events a caregiver or family member records (for example, a fall, a symptom, or a change in condition)	Surface health changes to the right members of the care circle and keep them in the participant's care history
Care and daily notes	Shift narratives and daily care notes about the participant	Coordinate day-to-day care and hand off between caregivers
Tasks and daily-living records	Care tasks and activities-of-daily-living (ADL) completions tied to the participant's care	Track which care tasks were completed, by whom, and when
Shift records	Clock in/out and shift notes for care provided to the participant	Coordinate who provides care and when, as part of the care record
Care communication	Work-communication messages among the care circle about the participant's care	Let the care team communicate about care
Attachments	A photo or image a member chooses to add to a note or record	Support the care record it is attached to
Identifiers linked to the above	The participant's name, and the name of the circle member who authored a record (attached to that record)	Identify the participant and attribute each record to its author, so the care team knows who did what

We do not collect your precise geolocation, we do not use geofencing around any health facility, we do not collect biometric data, and the app contains no advertising network and no third-party analytics or marketing SDK.

2. Where we collect it from

We collect consumer health data from these categories of sources:

• Directly from you. The records you create in the app about the care you give or receive.
• From other members of your care circle. LynCare is collaborative: a caregiver, family member, or Care Manager in your circle records care activity about the participant, which becomes part of the participant's records.
• Automatically from your device (limited, non-record signals only). Push-notification tokens so the app can send reminders, a short-lived device attestation token (App Check) that confirms a request came from the genuine app, and — on released app versions, only when the app crashes — crash-diagnostic information. These security and diagnostic signals do not include your care records.

We do not buy consumer health data, and we do not obtain it from data brokers or other outside health-data sources.

3. Consumer health data we share

We share consumer health data only as needed to run the Services, in two ways:

• Within your care circle. The care records described in Section 1 are visible to other members of the same care circle, according to each member's role and the visibility you choose for a given record (for example, a note limited to the admin team or to the Care Manager only). This sharing is the core function of the app.
• With the providers that operate LynCare for us. We entrust consumer health data to the providers that host and run the app — and, for the optional Allowables search, generate AI suggestions — on our behalf (see Section 4). These providers act as our processors under contract and may use the data only to provide their service to us — not for their own purposes.

We do not otherwise disclose your consumer health data, and we do not share it with advertisers, data brokers, marketing companies, or analytics providers.

4. Who we share it with — third parties and affiliates

Categories of third parties

• Other members of your care circle — the participant, family members, caregivers, and the Care Manager, each seeing records per their role and the visibility you set.
• Infrastructure and hosting provider (processor): Google LLC (Google Firebase / Google Cloud) — hosting, database (Firestore), file storage, authentication, device attestation, and crash diagnostics. Google processes this data on our behalf under Google's data processing terms.
• AI processing provider (processor): Anthropic, PBC (Claude API) — used only for the optional "Allowables" search feature (beta), and only when a member of your care circle runs a search or sweep. The relevant care-record excerpts (with caregiver names replaced by tokens) are processed by Anthropic on our behalf to generate suggestions. Anthropic does not use this data to train its models, and we have requested Zero Data Retention so the data is not stored after processing.
• Legal and safety recipients — courts, regulators, or law enforcement, only if we are required to disclose by law or believe in good faith it is necessary to protect the rights, property, or safety of LynCare, our users, or others.
• A successor in a business transfer — if LynCare is involved in a merger, acquisition, financing, or sale of assets, data may transfer as part of that transaction; we will note any such change of control in this policy.

Our email-delivery provider (Resend) sends account emails such as verification and password-reset messages; these messages do not contain your care records, so Resend does not receive consumer health data.

Specific affiliates

LynCare, LLC has no parent company, no subsidiaries, and no affiliated entities. We do not share your consumer health data with any affiliate.

5. We do not sell your consumer health data

LynCare does not sell your consumer health data. Under these laws, a "sale" means exchanging data for money or for other valuable consideration. We do not do this in any form — we do not trade your consumer health data for money, for services, for advertising, or for any other benefit. Because we do not sell it, we do not ask you to authorize any sale.

6. Your rights and how to exercise them

You have the following rights over your consumer health data:

• Confirm and access. Confirm whether we are collecting, sharing, or selling your consumer health data, and access the data we hold.
• Know who received it. Get a list of the specific third parties and affiliates with whom we have shared your consumer health data.
• Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data.
• Delete. Request that we delete your consumer health data, subject to the medical-record limit described below.

How to make a request

Email privacy@lyncare.net, or delete your account in the app (Settings → Danger Zone → Remove Account). We will verify that a request comes from you — typically by matching the email address on your account — and may ask for more information if we cannot otherwise confirm your identity. Exercising a right is free.

Our response time

We will respond to your request within 45 days. When reasonably necessary, we may extend that period once by another 45 days, and we will tell you before we do. If we cannot honor a request, we will explain why. You may appeal by replying to our response; if you still have concerns, you may contact your state attorney general.

One important limit on deletion

For the full detail of what is deleted and what is retained, see our Account Deletion page and our Privacy Policy.

7. How we protect consumer health data

We limit who can reach consumer health data and how. Access is role-based and rule-based: members of a care circle can read only the records their role and the record's visibility allow, enforced by security rules on the database. Data is encrypted in transit, access requires authentication, and device attestation (App Check) blocks requests that do not come from the genuine LynCare app. No system is perfectly secure, but we design access around the principle of least privilege — each person reaches only the consumer health data they need.

8. Changes to this policy

We may update this policy from time to time. The current version is shown by the "Effective" date at the top of this page. If we make material changes to how we handle consumer health data, we will take steps to notify you, such as by posting a prominent notice or notifying you through the app.

9. How to contact us

For any question about this policy or to exercise a right, email privacy@lyncare.net.

LynCare, LLC
Idaho, United States