Data Usage Policy1. What This Policy CoversThis Consumer Health Data Privacy Policy describes how Recira Health Corp (“ReciraHealth") collects, uses, and shares consumer health data, as defined under Washington's My Health My Data Act and similar state laws. It supplements our general Privacy Policy.2. Categories of Consumer Health Data We CollectMedical records, diagnoses, and treatment history retrieved from your connected healthcare providersLab and test resultsAppointment and visit historyMedications and allergy informationInformation inferred about your health status from the above (for example, AI-generated plain-language summaries)Precise location information, only if and to the extent you enable location-based features 3. Purposes for CollectionTo provide the core Service: aggregating and displaying your health records in one placeTo verify your identity and accurately match records to your accountTo generate summaries and insights you requestTo enable optional features you activate, such as family sharing and provider messagingTo maintain the security and integrity of the Service4. Categories of Third Parties and Affiliates We Share Consumer Health Data WithHealthcare providers and hospital/health-system partners you authorizeCaregivers or family members you invite through family sharingService providers who process data on our behalf under contract (e.g., cloud hosting, security infrastructure) [list actual vendors before publishing]Parties involved in a merger, acquisition, or similar transaction, as described in our general Privacy PolicyWe do not sell consumer health data, and we do not share it with third parties for advertising purposes.5. Your RightsThe right to confirm whether we are collecting, sharing, or selling your consumer health data, and to access that dataThe right to withdraw your authorization for us to collect or share your consumer health data, at any time, subject to applicable lawThe right to have your consumer health data deleted, subject to limited legal exceptionsThe right not to be discriminated against for exercising these rightsWe will not sell your consumer health data or share it for advertising without first obtaining your valid, opt-in authorization, separate from any other consent or terms of service, as required by law.6. How to Exercise Your RightsTo exercise any of these rights, contact us at info@recirahealthcare.io or through the in-app privacy settings. We will respond within the time required by applicable law. You may designate an authorized agent to act on your behalf where permitted by law.7. Geofencing[If ReciraHealth does not use geofencing around healthcare facilities for advertising or data collection purposes, state that explicitly here — Washington's My Health My Data Act specifically restricts this practice. Confirm actual practice before publishing.]8. Changes to This PolicyWe may update this Policy from time to time. Material changes will be communicated as described in our general Privacy Policy.Privacy Policy1. Introduction & ScopeRecira Health Corp (“ReciraHealth," "we," "us," or "our") provides a personal health record platform that lets users view and manage medical records, lab results, and appointment information from multiple healthcare providers in one place. This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have. It applies to recira.io, our mobile applications, and related services (collectively, the "Service"). By using the Service, you agree to the practices described here.If you are located in Washington State, Nevada, Connecticut, or another jurisdiction with its own consumer health data law, please also review our separate Consumer Health Data Privacy Policy, which describes additional rights that apply to you.2. Information We Collecta. Information you provide directlyAccount information: name, email address, phone number, date of birth, mailing address, and passwordIdentity verification information: information used to confirm you are who you say you are before we link medical records to your account (see Section 9)Health information you add, upload, or connect: medical records, lab results, appointment history, medications, allergies, and notes you choose to add or importCommunications: messages you send to us, to your care team through the Service, or to customer supportFamily/caregiver sharing settings: information about caregivers or family members you authorize to view your records, and their contact information if you invite themb. Information from your healthcare providersWith your authorization, we connect to your healthcare providers' and hospital systems' electronic systems (for example, via FHIR/HL7 interfaces) to retrieve your medical records, lab results, and appointment data. We only request the records needed to provide the Service, and only after you have authorized that connection.c. Information collected automaticallyDevice and usage information: IP address, browser type, device identifiers, operating system, pages viewed, and actions taken in the ServiceCookies and similar technologies: used for authentication, security, and understanding how the Service is usedd. Information from other third partiesIf you choose to connect other services (for example, a pharmacy, lab portal, or wearable device), we receive the information you authorize those services to share with us.3. How We Use InformationTo provide, maintain, and improve the Service, including aggregating and displaying your health recordsTo verify your identity and match retrieved records to the correct accountTo generate plain-language summaries and insights about your lab results and recordsTo enable features you choose to use, such as family sharing and provider messagingTo communicate with you about your account, appointments, and updates to the ServiceTo detect, investigate, and prevent fraud, abuse, and security incidentsTo comply with legal obligationsWe do not use your health information to serve you targeted third-party advertising, and we do not sell your health information. 4. How We Share Informationa. With people you authorizeWith caregivers or family members you invite through family sharing, and with healthcare providers you choose to message or share records with through the Service.b. With hospital and health-system partnersWhere ReciraHealth has a data-sharing or pilot partnership with a hospital or health system you use, we share the minimum information necessary to retrieve and synchronize your records, consistent with your authorization and any Business Associate Agreement or data use agreement between NexusHealth and that partner.c. With service providersWe share information with vendors who perform services on our behalf, such as cloud hosting, encryption and security infrastructure, customer support tools, and analytics — bound by contract to protect your information. [List actual subprocessors/vendors before publishing.]d. For legal and safety reasonsWe may disclose information if required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of NexusHealth, our users, or the public.e. Business transfersIf ReciraHealth is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy with materially similar protections.f. We do not sell health dataReciraHealth does not sell consumer health data, as that term is defined under applicable state law, and does not share health data for cross-context behavioral advertising.5. Your Choices and RightsAccess and export: you can view and export your aggregated records through the ServiceCorrection: you can request correction of inaccurate account information (corrections to the underlying medical record itself must generally go through the originating provider)Deletion: you can request deletion of your account and associated information, subject to legal and recordkeeping requirementsRevoke provider connections: you can disconnect a provider connection at any timeCommunication preferences: you can opt out of non-essential emails and notificationsCalifornia ResidentsIf you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, request deletion, correct inaccurate information, opt out of the sale or sharing of personal information (which we do not do with health data), and not be discriminated against for exercising these rights. To exercise these rights, contact us using the information in Section 12.Washington, Nevada, Connecticut, and Other Consumer Health Data LawsIf your state has a dedicated consumer health data law, please see our separate Consumer Health Data Privacy Policy for the specific categories of health data we collect, why, who we share it with, and how to exercise your rights, including the right to withdraw consent and the right to have your consumer health data deleted.6. HIPAA and Our RoleReciraHealth is not, itself, a hospital, doctor's office, or health insurer, so it is not automatically a "covered entity" under HIPAA. Depending on the specific data-sharing arrangement with a given hospital or health system partner, ReciraHealth may act as that partner's "business associate" under HIPAA for the records obtained through that partnership, governed by a Business Associate Agreement. [Confirm and finalize this characterization, and the presence/terms of BAAs, with counsel before publishing.]Because ReciraHealth aggregates identifiable health information from multiple sources into a personal health record, it is likely a "vendor of personal health records" under the Federal Trade Commission's Health Breach Notification Rule, which applies independently of HIPAA. See Section 10.7. Data SecurityWe use administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, multi-factor authentication, and access controls limiting who can view your information. [Describe your actual security program and any independent audits/certifications, e.g., SOC 2, HITRUST, once finalized.] No method of transmission or storage is completely secure, and we cannot guarantee absolute security.8. Data RetentionWe retain your information for as long as your account is active or as needed to provide the Service, and for a reasonable period afterward to comply with legal obligations. [Insert specific retention periods once finalized.]9. How We Match and Verify Your RecordsTo make sure the right records are linked to your account, we use a combination of identity verification information and provider-assigned medical record identifiers, along with standard health-data interoperability protocols (such as FHIR/HL7), rather than relying on a single identifier such as a Social Security Number. [This section should be finalized to precisely describe the actual matching method your engineering team implements, and reviewed by counsel.]10. Children's PrivacyThe Service is intended for use by adults managing their own health records, or by a parent/legal guardian managing records on behalf of a minor child through family sharing. We do not knowingly collect personal information directly from children under 13 in a manner inconsistent with the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided us information directly, contact us using the information in Section 12.11. Breach NotificationIf we experience a breach of unsecured, identifiable health information, we will notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, consistent with the FTC's Health Breach Notification Rule and applicable state law, including a description of what happened, the types of information involved, and steps you can take to protect yourself. Where 500 or more individuals are affected, we will also notify the Federal Trade Commission and, where required, prominent media outlets.12. Changes to This PolicyWe may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The "Last Updated" date at the top of this Policy reflects the most recent revision.13. Contact UsIf you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at:info@recirahealth.io
