Community Liver Alliance
← Home

Legal

Data Privacy Policy

Effective: July 14, 2026

DRAFT — pending final legal review by Community Liver Alliance counsel. This page describes the app’s current practices and is published for transparency. The exact legal wording may be adjusted before it is finalized.

We do not share or sell your health data

  • No third-party sharing. Your check-ins, treatments, notes, and survey answers are not sold, licensed, traded, or otherwise disclosed to researchers, pharmaceutical companies, advertisers, data brokers, analytics vendors, or artificial-intelligence providers.
  • No advertising. The app contains no advertising and performs no ad targeting or profiling of any kind.
  • No AI processing of your entries. Your health entries are never sent to an AI model or AI gateway.
  • No admin browsing of your health record. CLA administrators cannot open an individual patient’s check-ins, notes, or treatments. They see only account and activity information needed to support you, plus aggregate counts used to run the program.
  • You control what leaves the app. You generate your own Discussion Guide and decide whether to print, download, or show it to your clinician. CLA does not send it anywhere on your behalf.
  • Aggregate program metrics only. CLA reviews internal totals and averages (for example, how many people checked in this week) to operate and fund the program. These are counts, never individual records, and are not published or provided to outside organizations as patient data.

Limited exceptions: service providers strictly needed to run the app (hosting, database, authentication, email delivery) process data under contract on CLA’s instructions, and CLA may disclose data if legally compelled or to address a safety emergency.

1. Scope

This policy explains how the Community Liver Alliance (“CLA,” “we”) handles information in the PBC Itch Tracker & Discussion Guide (the “App”). The App is a personal tracking tool: you record your itch and related symptoms, and you produce a printable Discussion Guide to take to your own appointments.

2. Who is responsible for your data

Community Liver Alliance, a 501(c)(3) nonprofit organization, is responsible for data collected in the App. Contact: info@communityliveralliance.org.

3. What we collect

a. Account & profile

Email address (for sign-in), a display name you choose, preferred language, year of diagnosis if you provide it, reminder preferences, time zone, and your consent record.

b. Check-ins

Itch severity, affected body regions, time of day, sleep and mood impact, stress level, life-impact areas, triggers, reliefs, medication-taken status, side effects, whether scratching caused skin damage, and any free-text notes you type.

c. Treatments you add

Treatment names, categories, dose notes, start/end dates, and timestamped notes you write.

d. Weather (optional)

If you turn on weather capture, your device supplies an approximate location, rounded to roughly 10 km. We use it only to look up the current temperature, humidity, pressure, sky condition, and allergen index, and we store those environmental values with the check-in. We do not store your coordinates on your check-ins. The single approximate coordinate is kept on your profile only while weather capture is switched on; turning weather capture off clears it, and deleting your account deletes it. We do not set a separate fixed retention period, because the coordinate exists only for as long as the feature is enabled.

e. Technical & security data

Standard server, authentication, and error logs needed to keep the App running and secure. Error reports are automatically scrubbed of email addresses, identifiers, and long numbers.

4. How we use your data

  • To show you your own dashboard, trends, and Discussion Guide.
  • To send the reminders you asked for and account emails (sign-in links, password resets).
  • To keep the App secure, prevent abuse, and fix errors.
  • To produce internal aggregate counts (for example, weekly check-in totals) so CLA can operate and fund the program.

5. Who we share your data with

We do not sell your data, and we do not share your health entries with researchers, pharmaceutical companies, sponsors, advertisers, data brokers, or AI providers. There is no research-sharing pathway and no export tool in the App.

We use a small number of service providers strictly to operate the App — hosting, database and authentication, email delivery, and the public weather service used for the optional lookup above. They act on our instructions under contract and may not use your data for their own purposes.

We may disclose data if required by valid legal process, or where necessary to address a safety emergency or protect someone from harm.

A note on in-app insights: the observations on your dashboard are rule-based statistics only — simple counting and averaging of your own check-in entries computed inside the App. They are not produced by any AI model or third-party service, no health data leaves the App to generate them, and they are not medical advice.

6. Who inside CLA can see your data

CLA administrators cannot open an individual person’s check-ins, notes, or treatments in the App. Administrative tools show account status, activity dates, roles, support requests, and aggregate counts only. Administrative actions are recorded in an append-only audit log.

7. Cookies & local storage

We use only what is necessary: a session token to keep you signed in and local settings such as language. No advertising cookies, no cross-site tracking, no third-party analytics profiling.

8. How long we keep your data

We keep your data while your account is active. When you delete your account, your profile, check-ins, treatments, notes, and survey answers are deleted. Audit and consent records required for accountability are retained without your health entries.

9. Your rights and choices

  • Access / download. Export a complete copy of your data as JSON from Settings.
  • Correction. Edit any check-in or treatment at any time.
  • Deletion. Delete your account and all associated entries from Settings.
  • Withdraw optional features. Turn off reminders or weather capture at any time.
  • Complaints. Email us; we respond within 30 days.

10. Children

The App is for adults 18 and older. We do not knowingly collect data from children.

11. Data security

Data is encrypted in transit and at rest, access is restricted by row-level security so each account can read only its own entries, and administrative access is limited and logged.

12. Location of processing

Data is processed in the United States. The App is intended for U.S. residents only.

13. Changes to this policy

If we make a material change, we will notify you in the App and ask you to review the updated policy.

14. Contact

Community Liver Alliance — info@communityliveralliance.org.