Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements the Care Messaging Privacy Policy and describes how Care Analytics LLC, operator of Care Messaging, handles consumer health data where applicable state consumer-health privacy laws apply. It does not replace notices or agreements that apply to regulated healthcare organization deployments.

Consumer health data we may collect

Depending on how Care Messaging is used, consumer health data may include medication or refill reminder information, appointment or therapy reminders, wellness or daily-routine information, reminder schedules, recipient responses such as confirmed, snoozed, skipped or HELP, consent and opt-out records, and inferences that can reasonably be derived from those interactions. We encourage caregivers to use privacy-conscious, generic SMS wording and to avoid unnecessary clinical detail.

Sources of consumer health data

We may receive consumer health data from the account holder or caregiver who creates reminder information, from the recipient through SMS replies and consent or opt-out interactions, from authorized care-team members, and from service providers that transmit messages or support operation of the service.

Why we collect and use it

We collect and use consumer health data only as reasonably necessary to provide the Care Messaging service requested by the user, including creating and delivering reminders, recording responses, scheduling follow-ups, notifying authorized caregivers, documenting consent and opt-out requests, preventing abuse, maintaining security, troubleshooting delivery, and complying with applicable law. We do not use consumer health data for targeted advertising.

Categories of consumer health data disclosed to service providers

When necessary to provide the service, the categories of consumer health data disclosed to processors may include recipient contact information, reminder topics and schedules, message content and responses, consent or opt-out status, and delivery metadata. We limit disclosure to what the processor needs for the service it performs.

Categories of processors and third parties

Care Messaging uses categories of processors that may handle consumer health data on our behalf, including cloud application, database and hosting providers; SMS messaging and telecommunications providers; security, logging and technical-support providers; and email infrastructure when an email workflow requires it. Current core service providers include Supabase for application/database infrastructure and Twilio for SMS delivery. Resend may process account or transactional email information; we do not intentionally place reminder content or recipient consumer health data in transactional email. Stripe processes billing information and is not intended to receive reminder content or recipient consumer health data.

Affiliates: Care Analytics LLC does not currently share Care Messaging consumer health data with an affiliate for the affiliate's independent purposes. We may disclose information when required by law or when reasonably necessary to protect the service, users or others. We do not sell consumer health data and do not share it for third-party targeted advertising.

Authorization before collection

Care Messaging requires documented recipient consent before reminder texts can be sent. Before enrollment, the recipient is informed that the service may collect and use reminder information and message responses—including information that may qualify as consumer health data—to provide the requested reminder service. The caregiver records the consent source and confirms the recipient expressly agreed.

Your consumer health data rights

Depending on where you live and the law that applies, you may have the right to confirm whether we collect or share your consumer health data; access that data; request correction; request deletion; withdraw consent to collection or sharing; obtain information about categories or sources of data and third parties or affiliates with whom it is shared; and appeal a refusal to act on a request.

How to exercise your rights

Use the Care Messaging privacy request form. Choose the request type that best describes your request. We may need to verify your identity or authority before fulfilling a request. Do not put medication names, diagnoses, account passwords or other sensitive health details in the request form.

Deletion and withdrawal

If you request deletion, we will delete eligible consumer health data from our systems and instruct applicable processors to delete eligible copies, subject to legal exceptions and records that must be retained to document consent, opt-outs, security incidents, billing, fraud prevention or legal obligations. Withdrawing consent stops future consent-based processing but does not invalidate processing that lawfully occurred before withdrawal.

SMS opt-out

A recipient can reply STOP or otherwise clearly request that Care Messaging stop texting the number. We will treat reasonable revocation language as an opt-out request and will maintain sufficient records to honor the request. Reply HELP for service assistance. Care Messaging is not an emergency service.

Security and retention

We use reasonable administrative and technical safeguards designed to protect consumer health data. Retention varies by data type and legal or operational need. Our service uses defined retention schedules for messaging, reminder events, alerts and audit records; records needed to document an opt-out or legal obligation may be retained longer where required.

Changes to this policy

We may update this policy as the service or applicable law changes. We will update the date above when revisions are made and will provide additional notice when required by law.

Questions

Submit privacy or consumer-health-data questions through the Care Messaging privacy request form.

Legal notice mailing address

Care Analytics LLC
5 Bouchard Drive
Middleton, MA 01949