Family Agent Consumer Health Data Privacy Notice

Last Updated: August 27, 2026
Effective Date: August 27, 2026

This Consumer Health Data Privacy Notice (“Health Data Notice”) supplements the Family Agent Privacy Policy. It describes how Family Agent LLC (“Family Agent,” “we,” “us,” or “our”) collects, uses, shares, and protects “consumer health data.”

This Notice is intended to address consumer-health privacy laws that may apply, including laws in Washington and Nevada. We voluntarily apply the principal rights and disclosures in this Notice to U.S. users where reasonably practicable, even when a particular state law does not apply.

1. What Consumer Health Data Means

Consumer health data is personal information that identifies or can reasonably be linked to a person and identifies or reveals that person’s past, present, or future physical or mental health status. It can include information a person provides directly and information inferred from other data.

Consumer health data is broader than information protected by HIPAA. Family Agent is a consumer family-coordination service and is not itself a health care provider, health plan, or medical-records system. Do not assume information submitted to Family Agent is protected by HIPAA.

2. Consumer Health Data We May Collect

Depending on the features used and information submitted, we may collect or derive:

• symptoms, diagnoses disclosed by a user, conditions, disabilities, injuries, and health concerns;
• medication names, schedules, refill information, reminders, and adherence reports;
• medical, dental, vision, therapy, pharmacy, home-health, hospice, and other appointments;
• laboratory results, visit notes, care instructions, discharge information, and patient-portal records that a user authorizes us to access;
• measurements such as weight, blood pressure, glucose, temperature, oxygen saturation, heart rate, activity, sleep, and other wellness or device data;
• mental health, mood, memory, cognitive, behavioral, mobility, functional, nutrition, and substance-use information;
• reproductive or sexual health information if a user chooses to submit it;
• health insurance or payment information associated with obtaining health-related services;
• health-related precise location, such as information indicating a visit to a health care facility, if a feature collects it;
• health-related images, documents, voice communications, and messages;
• family and caregiver observations about the Primary Adult’s health, safety, routines, or ability to manage daily activities;
• information about requested health-related products or services; and
• inferences about health status, needs, risks, patterns, routines, or possible follow-up based on information submitted to the Service.

We do not use geofencing around health care facilities to identify, track, collect data from, or send health-related messages to a person without legally sufficient authorization.

3. Sources of Consumer Health Data

We may collect consumer health data from:

• the Primary Adult;
• Authorized Family Members, caregivers, and other people communicating with Family Agent;
• connected devices, wearables, applications, calendars, patient portals, and other integrations authorized by a user;
• health care providers, pharmacies, insurers, or service providers when a user directs or authorizes the disclosure;
• communications with customer support; and
• information generated or inferred by the Service from the sources above.

A user may provide health information about another adult only with the authority and consent required by law and our Terms.

4. Why We Collect and Use Consumer Health Data

We collect and use consumer health data only as reasonably necessary to provide features requested by users, including to:

• create and maintain the shared Family Record;
• conduct routine check-ins and organize user responses;
• deliver medication, appointment, routine, and follow-up reminders;
• help Authorized Family Members coordinate and understand relevant needs, concerns, requests, preferences, and updates;
• retrieve information from a user-authorized integration;
• generate AI-assisted summaries, responses, pattern notices, and suggested follow-ups;
• personalize communication and apply family-defined rules;
• respond to support requests and correct errors;
• secure the Service, prevent fraud or abuse, and investigate incidents;
• comply with law and protect a person from serious harm, abuse, neglect, or exploitation; and
• create and use deidentified or aggregated information that cannot reasonably be linked to a person or household.

Family Agent does not use consumer health data for employment, housing, credit, insurance underwriting, or other legally significant decisions. We do not use consumer health data for targeted advertising.

5. Separate Consent for Collection and Sharing

Where required by law, we obtain affirmative consent before collecting consumer health data unless collection is necessary to provide a product or service specifically requested by the consumer or another legal exception applies.

We obtain a separate affirmative consent before sharing consumer health data beyond what is necessary to provide the requested Service. The sharing consent identifies the Authorized Family Members or categories of recipients who will receive access.

Acceptance of our Privacy Policy or Terms of Service is not itself consent to collect or share consumer health data where separate consent is required.

A person may withdraw consent as described in Section 10. Withdrawal applies prospectively after verification and processing.

6. Shared Family Record Disclosure

Family Agent is a shared service. When the Primary Adult authorizes adult family members or trusted adults, each Authorized Family Member can see all consumer health data and other information that Family Agent intentionally retains about the Primary Adult in the Family Record. Per-item selective privacy is not currently available.

The Family Coordinator manages people, rules, schedules, integrations, and settings but does not receive broader content visibility than another Authorized Family Member solely because of the coordinator role.

Raw messages may be processed temporarily and then deleted or redacted under our retention schedule. Substantive health details, summaries, needs, concerns, requests, and follow-up items retained in the Family Record remain visible to every Authorized Family Member until deleted or access is revoked.

7. Consumer Health Data We Share and Recipients

We may share the categories of consumer health data described in Section 2 with:

A. Specifically Authorized Family Members

We share retained Family Record information with each person the Primary Adult or verified legal representative has affirmatively authorized. The current authorized-person list is available in the account and consent record.

B. Processors That Operate the Service

We may provide consumer health data to processors that perform services on our behalf, such as:

• hosting, databases, storage, and authentication;
• SMS, MMS, email, and voice communications;
• AI inference, orchestration, retrieval, and safety processing;
• calendar, patient-portal, wearable, and other user-authorized integrations;
• customer support, security, logging, and incident response; and
• payment and account administration, to the extent health data is involved.

These categories describe service providers that may process data on our behalf. We do not publish our underlying infrastructure or model-routing architecture as part of this Notice. Where applicable law treats a processor acting solely on our behalf differently from a third-party “sharing” recipient, we follow that distinction while still describing processor categories here for transparency.

C. Third Parties at the User’s Direction

We may share data with a clinician, pharmacy, portal, calendar, service provider, family contact, or another third party when a user asks us to do so and has authority to direct that disclosure.

D. Legal and Safety Recipients

We may disclose consumer health data to courts, law enforcement, regulators, protective-services agencies, emergency responders, attorneys, insurers, or other appropriate recipients when reasonably necessary to comply with law, protect rights, investigate an incident, or protect a person from death, serious harm, abuse, neglect, or exploitation.

E. Corporate Transaction Recipients

Information may be disclosed as part of due diligence or a transfer associated with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to confidentiality and applicable law.

Affiliates

Family Agent does not currently share consumer health data with a corporate affiliate for that affiliate’s independent purposes. If that changes, we will update this Notice and obtain any consent required by applicable law before the new sharing occurs.

8. We Do Not Sell Consumer Health Data

We do not sell consumer health data for money or other valuable consideration. We do not permit processors, Authorized Family Members, or data brokers to sell consumer health data obtained through the Service.

If we ever propose to sell consumer health data, we will first obtain a separate, signed authorization containing the disclosures required by applicable law. A general acceptance of terms or this Notice will not constitute authorization for a sale.

9. AI and Consumer Health Data

Family Agent may use consumer health data as input to AI systems to generate responses, summaries, reminders, pattern notices, and suggested follow-ups. AI output may be inaccurate and is not a diagnosis, treatment recommendation, medical instruction, or substitute for professional care.

Our policy is not to use consumer health data to train a publicly available or general-purpose AI model without separate express opt-in. We select and configure AI processors to support the Service and related security, reliability, or abuse-prevention purposes, subject to applicable provider terms, contracts, and our instructions. We review production AI routes before enabling them and may change providers over time.

10. Consumer Health Data Rights

Subject to verification and applicable law, a consumer may request to:

• confirm whether we collect, share, or sell their consumer health data;
• access their consumer health data;
• receive a list of the third parties or affiliates with whom their consumer health data was shared or sold, including contact information where required;
• withdraw consent for collection or sharing;
• delete consumer health data held by us; and
• appeal our decision on a request.

To submit a request, email support@myfamilyagent.io. Identify the account and describe the request. We may take reasonable steps to verify identity, legal authority, and the correct Family Record.

When a verified deletion request applies, we will delete covered consumer health data from our active systems and instruct applicable processors, affiliates, and other recipients to delete it where required. Backup deletion may be delayed for the period permitted by law, but the data will not be restored to active use except for security or legal purposes.

We ordinarily respond within 45 days. Where permitted, we may extend once by another 45 days and will explain why. If we deny the request, we will explain the reason and how to appeal.

To appeal, email support@myfamilyagent.io with the subject “Consumer Health Data Appeal” within 30 days after our decision. If the appeal is denied, we will provide information about contacting the applicable regulator or attorney general.

A withdrawal of consent does not undo data already viewed, copied, exported, or independently retained by an Authorized Family Member or another recipient. It also does not require deletion when law permits or requires continued retention.

11. Security and Retention

We maintain administrative, technical, and organizational safeguards designed to protect consumer health data. Depending on the feature and risk, safeguards may include encryption, authentication, access controls, role-based or least-privilege restrictions, logging and monitoring, vendor controls, secure development practices, backup and recovery procedures, and incident-response processes.

We retain consumer health data only as long as reasonably necessary for the requested Service, security, legal obligations, disputes, and consent or authorization records. Routine raw message content is generally scheduled for deletion or redaction within 30 days, subject to lawful security, support, dispute, fraud-prevention, or compliance needs. Family Record content generally remains while the account is active and is scheduled for deletion or deidentification from active systems within 30 days after account closure, unless a verified deletion request requires earlier action or law permits or requires continued retention. Backup copies may persist temporarily; where applicable law sets a maximum backup-deletion period, we will comply with that limit, including the six-month outer limit for qualifying Washington consumer-health-data deletion requests.

12. Changes to This Notice

We may update this Notice. We will post the revised version with a new date. If a material change requires new consent, we will obtain it before applying the new practice to consumer health data.

13. Contact

Family Agent LLC
Montgomery, Texas, United States
Consumer Health Data and Privacy Requests: support@myfamilyagent.io