Consumer Health Data Privacy Policy

1. The consumer health data we collect, and why

Most health information we handle is Protected Health Information (PHI) that we process for your provider under HIPAA and a Business Associate Agreement (BAA). That information is exempt from this policy. The categories below are the limited consumer health data we may collect and control through our own consumer channels.

• Interest in care and caregiving. Information that can show you are seeking or learning about care after a hospital stay, Transitional Care Management (TCM), or caregiving support. We may infer this from the pages you view and the actions you take on comaracare.com, such as visiting our page for patients and family caregivers.
• Technical and device data tied to that activity. A device or browser identifier, general location based on your Internet Protocol (IP) address, and similar data, to the extent it is reasonably linkable to you and to your interest in care.
• Information you send us. Your name, email, and the content of any message or form you choose to submit through the website, if it reveals or suggests a health condition or a need for care.
• Consumer app activity. Usage data from our optional patient and caregiver mobile app that may indicate you take part in a care program, to the extent that data is not handled as PHI under a BAA.

Why we collect it and how we use it. We use this data only to run, secure, measure, and improve our website and app, to respond to you, and to understand interest in our service. We do not use it for advertising. We do not use it to train general or third-party artificial intelligence (AI) models. We do not sell it.

2. The sources we collect it from

We collect the consumer health data described above from these sources.

• Directly from you, when you fill out a form, send a message, or use our app.
• Automatically from your device, when you use our website or app, through analytics technology. Our analytics use input masking, so text you type into form fields is masked and not captured. We use no advertising pixels and no advertising networks.

We do not buy consumer health data from data brokers.

3. The consumer health data we share, and the third parties and affiliates we share it with

We do not share consumer health data with third parties for their own use. We share it only with service providers that process it on our behalf, under contracts that bar them from using it for their own purposes. The categories of consumer health data that these service providers may process are the same categories listed in Section 1, limited to what each provider needs.

The categories of third parties are:

• Cloud hosting. A provider that runs and stores our website and app.
• Product and website analytics. A provider that helps us measure and improve our website and app, configured with input masking and no advertising.

Affiliates. Comara Care, Inc. has no affiliates. We do not share consumer health data with any affiliate.

We do not sell consumer health data. We do not share it for advertising or for cross-context behavioral advertising. We may disclose it only if the law requires it, or to protect the safety of a person.

4. How we ask for your consent

We do not collect, use, or share any category of consumer health data, for any purpose, that is not described in this policy, unless we first get your consent.

If we ever want to collect consumer health data that is not needed to provide something you asked for, we will ask for your consent first. We will ask for separate consent before we share it.

We do not sell consumer health data. We would not sell it without first getting a signed, valid authorization from you that meets the requirements of the law.

5. Your rights, and how to use them

If you are a Washington resident, and to the extent the law applies to you in another state, you have the following rights for the consumer health data we control.

• Confirm and access. The right to confirm whether we collect, share, or sell your consumer health data, and to access that data.
• Withdraw consent. The right to withdraw your consent to our collection and sharing of your consumer health data.
• Delete. The right to have your consumer health data deleted. When you ask, we will delete it from our records and tell our service providers to delete it from theirs.

To use any of these rights, email us at hello@comaracare.com. We will confirm your identity before we act, to protect your data. We respond free of charge within 45 days. If we need more time, we may extend once by another 45 days and will tell you why.

If we deny your request, we will explain why, and you may appeal by replying to our decision. If we deny your appeal, you may contact the Washington State Attorney General's office.

6. We do not use geofencing

We do not use a geofence around any health care facility, such as a hospital, clinic, or pharmacy, to identify or track you, to collect your consumer health data, or to send you messages or advertising about your health.

7. Residents of other states

Nevada and Connecticut also protect consumer health data. Where their laws apply to consumer health data we control, we extend the practices in this policy to residents of those states. Most data we handle for providers remains Protected Health Information under HIPAA and is exempt from these laws.

8. Changes to this policy

We may update this policy as our service, technology, or the law changes. When we make a material change, we will update the effective date above and, where appropriate, provide more notice.

9. How to contact us

For any question about this policy, or to use your rights, contact us at hello@comaracare.com.

Comara Care, Inc.