Consumer Health Data Privacy Policy

• For residents of Washington and Nevada. This policy is separate from our Privacy Policy, as the law of those states requires, and it prevails over the Privacy Policy for the information it covers.

1. Who this covers and what it covers

• This policy applies to you if you are a resident of Washington or Nevada, or if your consumer health data was collected while you were in either state. It applies whether or not you have an account with us and whether or not you paid us anything. It covers consumer health data, which those states define far more broadly than the federal health privacy rules do: any information that identifies your past, present or future physical or mental health status. That includes what you tell us about an injury, the records you upload, what we can work out about your health from information that is not itself health information, and anything a computer program of ours infers about your health, which the law names expressly.
• Information we hold about you as a patient of a covered health care provider, under a business associate agreement, is not consumer health data under these laws and is governed instead by that agreement and by our Business Associate Agreement.

2. The categories we collect, and why

• What you tell us in Understand My Options: the type of situation, the type of injury, how it happened, how bad it is, when it happened, the treatment you have had, your county and the month. We collect it to produce the summary you asked for.
• What you upload: medical records, bills, images, audio and video that you choose to send us. We collect it to produce your summary and, where you direct it, to pass it to a professional you have chosen yourself.
• What we work out: an internal classification of the situation, produced by software. Under Washington law that inference is itself consumer health data, and we treat it as such. It is not shown to you as the value of your case and it is not the reason any professional accepts or declines anything.
• What we record about your use: which pages you opened, when, and from what device. We use it to run and secure the service and, once it has been stripped of what identifies you, to measure how the service is used, to train our own software and to publish or license figures in aggregate, as Section 7.3A of the Terms of Service describes. It never carries the content of your matter, the words you typed or what videos you have watched.
• Where it comes from: from you directly, and, where a law firm or a health care provider you are dealing with places information about you on the platform, from them. We do not buy consumer health data, we do not obtain it from data brokers, and we do not build it from your activity elsewhere on the internet. We do not buy consumer health data, we do not obtain it from data brokers, and we do not build it from your activity elsewhere on the internet.

3. What we do with it

• To give you what you asked for: your summary, your account, and the ability to send your own information to a professional you chose. This is the only purpose for which we do not need your separate permission, because it is the service you requested.
• To keep a record of the facts of your situation, without your name, if you give us permission on a screen of its own. We describe that screen and its exact words in our Consent Screens document.
• To train our own software, if you give us that permission separately. We ask to keep and to train as two questions rather than one because they are different things and you should be able to allow one and refuse the other. What Washington and Nevada require to be separate is the permission to collect and the permission to share; we go further than that.
• To write aggregated counts by type of situation, county and month, which carry no identifier of any kind. We write them at the moment you submit, from information we already hold to give you the summary you asked for, and they are not consumer health data because nothing in them points to a person. We never publish or license a count covering fewer than ten people. We license none of them today. If we do license them to other businesses for money, which is part of how Octicase would pay for itself, that rule still holds.
• We do not use consumer health data for advertising. We do not sell consumer health data today, and the aggregated counts we would license are not consumer health data. The only sale these documents provide for is of the record described in this Section, and it can happen only under the separate signed authorization described in Section 3A. We do not use it to decide your eligibility for anything, and we do not provide it to anyone who would.

3A. If we ever sell the record of your situation

• We do not sell consumer health data today and we have never sold it. Washington and Nevada both require your signed permission before anyone may sell it, and this Section is how we would ask for it. Until we do, nothing in this Section is in use.
• This Section is a change to this policy, and we apply it the way Section 9 requires: it is not applied backwards. No record we already hold is sold on the strength of a permission you gave before this Section existed. Every sale needs an authorization signed after the buyer is named.
• One thing does carry your name, and we say it here rather than leave it to be discovered: the authorization itself carries your signature and your printed name, and the law requires the buyer to keep a copy of it for the same six years we do. The buyer therefore holds that signed page as well as the record. The record reaches the buyer under an identifier that is not your name, and the buyer's contract forbids it from linking the two, from identifying you, and from contacting you.
• The permission is a document of its own, separate from this policy and from anything else you have accepted. It names the company buying the record, states exactly what that company may use it for, and says plainly that we are paid for the sale and you are not.
• It covers only the record described in Section 2 and kept under the permission described in Section 3: the type of situation, the type of injury and its extent, the case factors we record, each one named, your county and the month, under an identifier that is not your name. It never covers your name, your contact details, anything you typed in your own words, any document, image, audio or video you uploaded, what videos you have watched, the internal classification our software produces about your situation, which we keep for our own use and do not sell, or any information a law firm or a health care provider placed on the platform.
• It expires one year after you sign it and does not renew by itself. After that we stop, and if we want to continue we ask you again.
• You may withdraw it at any time, in the same place and with the same number of clicks it took to give. We then stop selling and instruct the buyer to delete what it holds, which it must do within ten business days of the list we send it. We send that list monthly, so in the worst case the buyer's deletion falls a little over a month after you ask; we say so rather than promise ten days from the day you ask. The same list carries the records we deleted because the permission expired, because you asked us to delete, or because the record reached its twenty-four month limit. Withdrawing does not undo a sale that already happened.
• Signing is not a condition of anything. Your access, your features and your price are identical if you refuse, and we will not ask you again about the same buyer.
• We keep the signed permission, and the record of any refusal or withdrawal, for six years, counted from the latest of the day you signed it, the day you withdrew it and the day it expired, which satisfies both the Washington formula of RCW 19.373.070(5) and the Nevada one, and the buyer keeps its copy for the same period. You may have a copy of yours whenever you ask.
• We never ask anyone under eighteen, the permission is not offered at all in the guardian flow, and we keep no record of anyone under eighteen that could be sold.
• The buyer signs a contract before it receives anything. That contract forbids it from working out who you are or trying to, from combining the record with anything else in order to identify you, from contacting you, from passing the record to anyone else, and from using it to decide anything about you, including anything to do with insurance, credit, employment or housing.

4. Who else sees it

• What goes to whom. To our service providers, only what each needs for the function we hired it for: to Amazon Web Services, which hosts the platform, and to Google Cloud, which runs the artificial-intelligence features (Google Vertex AI as the primary processor and Amazon Bedrock as failover), the information described in Section 2 that the feature requires to answer, in that same session, the question you asked, and, only where you have separately agreed on Screen C5 of our Consent Screens, to look again at a record we keep for you; to Twilio and SendGrid, which carry our messages: your email address or phone number, and account, billing, scheduling and notification content. We do not send health information by email. But a message somebody sends to a case address reaches our email provider before it reaches us, and until the inbound filtering control described in our Subprocessor List is built and in operation we treat that route as one through which health information can reach that provider, and we say so rather than let you find it out; to Retell AI, where you use a voice agent, and only after you have agreed on Screen C5, what you say to it; to SRFax, where records are sent or received by fax, the documents that pass through it; to Microsoft Azure, which will hold our encrypted disaster-recovery copies when that replication is in operation and holds none today; to our error-tracking, security and monitoring providers, access and event records and the contents of error reports. Filtering at the point of capture is not yet enforced, so until it is we treat an error report as capable of carrying information about you, including information about your health; our Subprocessor List records that condition and the date it is met; to the payment processor named in our Subprocessor List, which processes payments, no health information at all. Every one of them is named in our Subprocessor List, which we keep current and which is linked from this policy. Our own team is located outside the United States and accesses data that stays hosted in the United States.
• A professional you chose yourself, when you direct us to send them your information. You choose the person, we never suggest one. Where California's Confidentiality of Medical Information Act governs that information, we take your signed permission on our Authorization to Share Your Medical Information before we send anything, because Cal. Civ. Code Section 56.10(a) does not let us disclose it without one and Section 56.07(b) says that asking us for your own copy is not one.
• Someone who legally compels it, in which case we tell you first where the law allows.
• To a professional you chose yourself, only the records and the summary you select in the share dialog. To someone who legally compels it, only what the demand covers. Nobody else, except a buyer to whom you have given the signed permission described in Section 3A: we do not share consumer health data with advertisers, with data brokers, or with anyone else who wants it for their own purposes.

5. Your rights, and how to use them

• You have the right to confirm whether we collect, share or sell your consumer health data and to access it, including a list of every third party with whom we have shared it and, for each one, how to contact them.
• You have the right to withdraw any permission you gave us, at any time, in the same place and with the same number of clicks it took to give it.
• You have the right to have your consumer health data deleted. When you ask, we delete it from our active systems within thirty days, we tell every service provider, contractor and third party who received it to do the same, and we ask them to confirm. Where a law, a litigation hold or a preservation obligation requires us to keep something, we keep only what it requires, for as long as it requires, we use it for nothing else, and we tell you which categories were kept and why. Residual copies inside encrypted backups are gone no later than six months after your request, and from the moment you ask, the data is on a suppression list: nobody on our team can reach it, it is used for nothing, and if we ever restored a backup we would apply that list before the system returned to service.
• What happens to software we had already trained, stated plainly rather than left to be discovered: your record leaves the set we train on, you go on a list so that nothing of yours enters any future training, and software we had already trained is not undone by your request, and your request does not require us to retrain it or to discard it; we would retrain or withdraw it only where a court, a regulator or the law required it, and then we would, and we say this now rather than let you find it out later.
• You have the right to appeal if we refuse. Write to privacy@octicase.com and a person who did not make the first decision will answer within forty-five days, in writing, with the reason. If we still refuse, we will tell you how to complain to the Attorney General of your state.
• Exercising any of these rights costs nothing, changes nothing about the service you receive, and never makes anything slower or more expensive.
• If you are in Nevada. NRS 603A.505 gives you the same rights to confirm, to access, to withdraw consent and to delete. We answer a Nevada request within forty-five days, extendable once by a further forty-five where NRS 603A.510 allows, and we delete within thirty days as NRS 603A.515 requires. Nevada gives you the appeal described above as well: NRS 603A.520 requires us to keep that process and to make it available on our website, and a Nevada consumer may also complain to the Attorney General of Nevada directly. Nevada defines its geofencing prohibition by a radius of one thousand seven hundred and fifty feet around a health care facility; ours is absolute and carries no radius, so it covers both.
• If you are under eighteen, or if you are acting for someone else. A person between thirteen and seventeen does not use the service alone: a parent or legal guardian completes the intake and exercises these rights, and the permissions in Section 3 are not offered at all in that flow. An adult may name someone to make a request on their behalf, and we verify that authority before we act on it.

6. How to reach us

• Email privacy@octicase.com, or write to OCTICASE, INC., 2140 S Dupont Highway, Camden, Kent County, Delaware 19934, c/o PARACORP Incorporated. We answer within forty-five days and tell you if we need longer, as the law allows in some cases.
• We will verify that a request is really yours before we act on it, and we will not ask you for more information than we need to do that.

7. Geofencing

• We do not use geofencing around any health care facility, and we never have. We do not build a virtual boundary around a hospital, a clinic, a pharmacy or any other place where health services are provided in order to identify, track, collect data from, or send advertising or messages to anyone near it. Washington and Nevada prohibit this outright and we state it here because the prohibition is absolute and easy to check.

8. How long we keep it

• What you submit through Understand My Options without an account is deleted from active systems thirty days after you submit it, a deletion we run by hand until the automatic process is in place, unless you create an account or extend the period once by a further thirty days, with notice seven days before the first period ends. Your account record lasts until you delete the account or ask us to, and an account with no sign-in for twenty-four months is treated as inactive: we tell you at least thirty days beforehand and then delete it. The record of the facts of your situation, if you permitted it, lasts while that permission stands and in any case no longer than twenty-four months, after which we ask you again. Aggregated counts carry no identifier and are kept indefinitely. Our Data Retention and Deletion Policy states every period.

9. Changes

• If we ever want to collect or share a category of consumer health data that this policy does not list, we will update this policy and ask your permission before we do it, not after. We never apply a change backwards to information we already hold, and prior versions of this policy remain available.