Legal

Consumer Health Data Policy

Effective: July 14, 2026

DRAFT — pending final legal review by Community Liver Alliance counsel. This page describes the app’s current practices and is published for transparency. The exact legal wording may be adjusted before it is finalized.

We do not share or sell your health data

No third-party sharing. Your check-ins, treatments, notes, and survey answers are not sold, licensed, traded, or otherwise disclosed to researchers, pharmaceutical companies, advertisers, data brokers, analytics vendors, or artificial-intelligence providers.
No advertising. The app contains no advertising and performs no ad targeting or profiling of any kind.
No AI processing of your entries. Your health entries are never sent to an AI model or AI gateway.
No admin browsing of your health record. CLA administrators cannot open an individual patient’s check-ins, notes, or treatments. They see only account and activity information needed to support you, plus aggregate counts used to run the program.
You control what leaves the app. You generate your own Discussion Guide and decide whether to print, download, or show it to your clinician. CLA does not send it anywhere on your behalf.
Aggregate program metrics only. CLA reviews internal totals and averages (for example, how many people checked in this week) to operate and fund the program. These are counts, never individual records, and are not published or provided to outside organizations as patient data.

Limited exceptions: service providers strictly needed to run the app (hosting, database, authentication, email delivery) process data under contract on CLA’s instructions, and CLA may disclose data if legally compelled or to address a safety emergency.

Why this policy exists. The Washington My Health My Data Act (MHMDA) and comparable Nevada, Connecticut, and Oregon consumer-health-data laws require a separate, plainly written policy describing how “consumer health data” is collected, used, and shared, and how you can control it. We apply this policy to all users of the PBC Itch Tracker & Discussion Guide (the “App”), regardless of state.

1. Not a HIPAA-covered service

Community Liver Alliance is not a health plan, health-care provider, or health-care clearinghouse, and the App is not offered on behalf of one. Information you enter is consumer health data under state law, not HIPAA-protected health information. It is still treated as sensitive.

2. What we treat as consumer health data

Itch severity, affected body regions, and time of day
Sleep impact, mood impact, stress level, and life-impact areas
Triggers, reliefs, and skin-damage reports
Medication-taken status, side effects, and treatments you list
Free-text notes you write
Environmental values (temperature, humidity, pressure, sky condition, allergen index) attached to a check-in when you enable weather capture. If you enable this feature we also keep one approximate coordinate (rounded to roughly 10 km) on your profile — never on individual check-ins — retained only while weather capture is enabled, and deleted when you turn the feature off or delete your account.

3. How we collect it

Only from you, directly, when you complete a check-in, add a treatment, write a note, or answer a survey. We do not buy health data, and we do not infer health data from your browsing.

4. How we use it

To display your own history, trends, and PBC Itch Impact Score.
To generate the Discussion Guide you choose to print or download.
To send the reminders you configured.
To compute internal aggregate counts (totals and averages) used to operate the program.

5. How we share it

We do not sell consumer health data, and we do not share it with third parties for their own use. Specifically, there is no sharing with researchers, pharmaceutical companies, sponsors, advertisers, data brokers, or artificial-intelligence providers, and the App contains no advertising module and no AI processing of your entries.

Processors that host the database, run authentication, and deliver email may process data solely to provide those services to CLA. Disclosure may also occur where legally compelled or to address a safety emergency.

You may share your own Discussion Guide with your clinician. That share is performed by you, from your device, and CLA is not a party to it.

6. Administrative access

CLA administrators cannot view an individual person’s health entries in the App. Administrative tools expose account status, activity dates, roles, and support requests only, plus aggregate program counts. Administrative actions are written to an append-only audit log.

7. Your rights

Right to know what consumer health data we hold — download it from Settings.
Right to delete — delete your account and entries from Settings; deletion is honored within 30 days, including with our processors.
Right to withdraw consent for optional features such as weather capture and reminders.
Right to appeal a denied request — email us and we will respond in writing.

8. Security

Encryption in transit and at rest, row-level security scoping every record to its owner, least-privilege administrative access, and audit logging.

9. Breach notification

If consumer health data is breached, we will notify affected users and applicable regulators as required by state law.

10. Not intended for children

Adults 18 and older only.

11. Not intended for EU / UK residents

The App is offered to U.S. residents. We do not target or knowingly serve EU/UK residents.

12. Artificial intelligence

The App performs no AI processing of your health data. Your entries are never transmitted to an AI model, gateway, or vendor.

In-app insights are rule-based statistics, not AI. The observations shown on your dashboard (for example, your most frequently logged trigger, or the percentage of high-itch days on which your sleep was disrupted) are computed by simple counting and averaging of your own check-in entries, on your own data, inside the App. No machine-learning model or AI provider is involved, and no health data leaves the App to produce them. These observations are not medical advice.

13. Changes

Material changes will be announced in the App before they take effect.

14. Contact

Community Liver Alliance — info@communityliveralliance.org.