Consumer Health Data Privacy Policy

Jordy Care is operated by Jordy Care, LLC (“Jordy Care,” “we,” “us”). This policy explains how we handle consumer health data, as Washington’s My Health My Data Act (RCW 19.373) defines it, and as similar laws in other states, such as Nevada, do. It sits alongside our Privacy Policy. Where the two differ about consumer health data, this policy is the one that applies.

Who this covers

Consumer health data is personal information that identifies someone’s past, present, or future physical or mental health. It includes conclusions drawn about a person’s health from other information. This policy covers that data for everyone whose information is in Jordy Care: the people who hold accounts, and the person a care record is about.

What we collect, and why

Jordy Care is a place where a family writes down what is needed to care for a loved one. The consumer health data we hold is what you and your care circle choose to add. Depending on what you add, it can include:

• Health history and conditions: diagnoses, seizures, surgeries, and other health events.
• Medications: names, doses, schedules, what each one is for, which one is the rescue medication, and a log of doses given.
• The care team: the doctors, therapists, agencies, and other people who provide care, with their roles and contact details.
• Appointments: visits, what was discussed, and follow-ups a clinician asked for.
• Daily routines: written steps, and videos, which may show personal care such as bathing and dressing.
• Documents: medical records, test results, benefit and insurance letters, guardianship and other legal papers, and the text we read from them so they can be searched.
• Journal notes, photos, and their story: how they were, what they did, who visited, and who they are.
• Daily check-in ratings: the things your family chooses to rate each day, from 1 to 5, such as appetite, water intake, or bowel movements, and a notice we show you in the app when one of them has averaged 3 or lower over a week. The email we send about it says only that something needs a look, with no health details in it.
• Visit surveys: a caregiver’s answers to a short survey after a visit, when you use that feature.
• Photographs of the people in a care circle: if a member of a care circle adds a picture of themselves, so the others can tell one card from another. Each person adds their own, and nobody can add a picture of anybody else. It is optional, and a colour with their initials is used when there is none.

We use all of it for one purpose: to provide the service you asked for. That means storing and organizing the record, showing it to the people you choose, searching it, and running the features you use, such as asking Jordy AI a question, writing a draft Family Update, or reading an uploaded document. We also use it as needed to keep the service secure and to meet legal obligations.

We do not use consumer health data for advertising. We do not sell it. We do not use it to train public or third-party AI models. We do not collect precise location, and we do not geofence places where health care is provided.

Where it comes from

• You, when you type, upload, or record something in Jordy Care.
• People in your care circle, whom the account owner invites and whose access the owner controls.
• Caregivers who answer a visit survey through a link sent from your care circle.
• Our AI features, which produce drafts and search results from the information above. A person reviews what they produce before relying on it.

Who receives it

People you choose. The members of your care circle can see the record, according to the access the account owner gives each of them.

The companies that help us run Jordy Care. Each may use the information only to provide its service to us, under a contract with us, and not for its own purposes. We have no affiliates. These are all of them:

• Supabase, Inc. stores the database and the uploaded files, and handles sign-in. It holds every category listed above.
• Netlify, Inc. hosts the website and the app, and runs the server code that handles your requests. Information passes through it on the way to and from the database.
• Anthropic, PBC provides the AI. It receives the parts of the record needed for the feature you use: answering your question, writing a draft Family Update, or reading an uploaded document. It does not use them to train its models.
• Resend delivers the emails we send. Some emails can include your loved one’s first name, for example an invitation to a visit survey.
• Stripe, Inc. handles payments. It receives your name, email address, and payment details, and so knows that you subscribe to Jordy Care. It receives nothing from the care record.

When the law requires it. We may disclose information if a law, court order, or valid legal process requires it, and we will tell you unless the law forbids us to.

We do not sell consumer health data, and we never will without the separate, signed authorization the law requires.

Your consent

We collect consumer health data only as needed to provide the care record you ask us for, when you create it and add to it. The record is shared within your care circle only when the account owner invites someone. If we ever want to collect or share consumer health data for any other purpose, we will ask for your separate, clear consent first, and we will not make using Jordy Care depend on it. You can withdraw a consent at any time.

Your rights

You have the right to:

• Confirm whether we hold your consumer health data, and see it.
• Get a list of every third party and affiliate that has received it, with contact details.
• Withdraw your consent to our collecting or sharing it.
• Have it deleted. We delete it from our systems and tell every company listed above to delete it too.

These requests are free, at least twice a year. We will not treat you differently for making one.

How to make a request

Email info@jordycare.com and tell us what you would like. We will need to confirm the request is really from you, usually by replying from the email address on the account, so that nobody else can see or delete your information. An authorized agent, such as a guardian, can make a request for someone else; see Your Privacy Choices.

We answer within 45 days. If we need more time, we will tell you why within those 45 days, and take no more than 45 days longer.

If we say no: appeals

If we turn down a request, you can appeal. Email info@jordycare.com with the word “Appeal” in the subject line. We will answer in writing within 45 days, explaining what we decided and why. If we still say no, you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the attorney general in your own state.

How long we keep it

We keep consumer health data while your account is open, so the record is there when it is needed. When you delete something, or ask us to delete your information, it leaves the app straight away. Deleted files are gone at once. Deleted entries can remain in our database backups for up to 7 days, until those backups expire. We keep no other copy.

How we protect it

Only people with a verified sign-in can open a care record, and each family’s record is walled off from every other family’s. Within a care circle, the account owner decides what each person can see. Files are kept in private storage and open only through links that expire. Information is encrypted while it travels over the internet. Inside Jordy Care, access is limited to what running the service requires. See How we protect information.

Changes to this policy

If we change what we collect, why, or who receives it, we will update this page before the change takes effect, and, where the law requires, ask for your consent first. The date at the top shows when it last changed.