Consumer Health Data Privacy Policy

This policy supplements the Turtle AiP Privacy Policy and applies to consumer health data covered by the Washington My Health My Data Act. The current website does not collect consumer health data through an onsite form or account flow. The app- and device-related categories below apply when a relevant feature is offered and links to this policy.

Consumer health data is personal information that identifies or can reasonably be linked to a person's past, present, or future physical or mental health. It can include information inferred from non-health information, including by an algorithm or machine-learning system.

Sources

• Automatically when you request or interact with a website page.
• You or an adult caregiver with permission or lawful authority.
• A supported connected device or sensor you choose to use.
• An app, mapping, identity, notification, or care-coordination integration you choose to enable.
• A provider or organization at your direction when a requested feature involves that party.
• Turtle AiP rules or other automated systems, if enabled, that derive a pattern, status, or potential concern from collected events.

Purposes

• Deliver, secure, maintain, and troubleshoot the website.
• Provide the feature or service you request.
• Create requested activity summaries, caregiver views, notifications, or alerts.
• Coordinate an appointment or third-party service at your direction.
• Secure, maintain, troubleshoot, and support the Services.
• Comply with law and protect legal rights and safety.

Categories shared may include website request information and, if an app, device, or pilot is activated, activity events and inferences, home or location information, care context, device identifiers, and linked-user information. Actual sharing depends on the feature you request and the choices you make.

Website providers and future product updates

The website uses Vercel for hosting and YouTube for embedded videos. It does not provide an onsite consumer-health intake form or account flow and does not load Google Analytics. Vercel receives request information needed to deliver and secure the site, and YouTube receives request information when the Demo page loads.

Turtle AiP does not share consumer health data with SIG AI, Covid Response Partner, PLLC, or any other affiliate. Before a new app, device, pilot, affiliate sharing arrangement, or vendor begins collecting or receiving consumer health data, we will update this policy with the applicable categories and specific recipients and obtain any consent required by law.

Turtle AiP does not sell consumer health data and does not use or disclose it for cross-context behavioral advertising. Before any future sale, Turtle AiP would obtain the separate signed authorization required by law.

Subject to applicable law, you may request to:

• Confirm whether we collect, share, or sell your consumer health data and access the data.
• Receive a list of third parties and affiliates with whom your consumer health data has been shared or sold, including an active email address or other online contact information for each third party.
• Withdraw consent from future collection or sharing.
• Delete consumer health data from Turtle AiP's network and require affiliates, processors, contractors, and other third parties to honor the deletion request, subject to lawful exceptions. Covered backup data will be deleted no later than six months after authentication.
• Appeal our refusal to act on a request.

To start a request, email legal@turtleaip.com or use our data request instructions. Do not include health records or other sensitive details in ordinary email. We may request information reasonably necessary to verify your identity, authority, and the service involved.

If we deny a request, our response will explain how to appeal. Appeals may be sent to legal@turtleaip.com with “Privacy appeal” in the subject line. You may also contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Collection consent and sharing consent must be freely given, specific, informed, and separate and distinct from each other. Each request must identify the consumer health data involved, purpose, recipient categories, and withdrawal method. Accepting general Terms of Use is not consent to a consumer-health-data practice. Withdrawing consent stops the applicable future collection or sharing but does not affect processing already completed lawfully.

We keep consumer health data only as long as reasonably necessary for the requested feature, security, support, legal obligations, and dispute resolution. When it is no longer needed, we delete it from active systems and direct processors to do the same, subject to lawful exceptions and limited backup retention.

We use administrative, technical, and physical safeguards appropriate to the sensitivity of consumer health data and limit access to authorized purposes. No security method is perfect.

We will not collect, use, or share a new category of consumer health data, or use it for a new purpose, without first updating the disclosure and obtaining any affirmative consent required by law. We will update the date above when this policy changes.