Consumer health data privacy

1. Categories, sources, and purposes

Records may contain conditions or symptoms mentioned in notes, medications and instructions, appointment dates and provider names, care needs, treatment tasks, health documents, family communications, and the identities and relationships of people receiving or providing care. Entered appointment locations may reveal where care is sought. Information can reveal past, present, or anticipated health status.

Sources are you, authorized care-circle members, and uploaded files. We do not automatically connect to medical record systems or use device location to track healthcare visits. We use health data to provide requested coordination: storing and displaying records, organizing tasks, searching, sharing within a circle, exporting, and responding to support or privacy requests. Optional AI, if enabled and chosen, processes submitted notes or relevant record text for organization and retrieval.

2. Categories disclosed and recipients

The categories above are accessible to authorized care-circle members. Hosting and storage providers process records and files to deliver Allayra; these currently include OpenAI's Sites platform and Cloudflare-backed storage. Authorized personnel may access relevant information to operate and support the service.

When available and chosen with consent, OpenAI receives AI inputs and context described in the Privacy Policy. A browser speech-recognition provider may receive spoken health information if you choose voice input. These optional functions have separate controls. There are no current affiliate recipients of health data, and care records are not sent to Stripe.

Information is disclosed through authenticated circle access, downloads, hosted processing, and encrypted provider requests. We do not sell health data or share it for targeted advertising. Legally required disclosures remain subject to applicable health-data protections.

3. Your collection and sharing choices

Supply only information you are authorized to use for requested care coordination. Owners should obtain necessary permissions before adding recipients or members. Each member can see the circle's shared information. You can explore the sample workspace without entering a real person's data.

Where consent is required, collection and sharing must follow that consent. Acceptance of the Terms of Service is not blanket consent to unrelated health-data uses. New categories or purposes require updated disclosures and affirmative consent where required by law. Withdrawal may limit functions that need the information.

4. Requests, deletion, and appeals

Where Washington law applies, you can confirm collection, sharing, or sale; access your health data and recipient contact information; withdraw consent; and request deletion. Email admin@allayra.com with "Health data privacy request." No new account is required. We reasonably verify identity or authority using necessary information.

We respond within 45 days, with one permitted 45-day extension explained during the original period. Required access responses are free twice annually, subject to statutory exceptions.

Verified deletion includes applicable records and notice to processors and other recipients as required. Where permitted, backup or archive deletion may take up to six months from authentication. Removing access cannot technically recall a member's downloaded copy.

Appeal a refusal by emailing admin@allayra.com with "Privacy appeal." We respond with reasons within 45 days. If denied, we explain how to complain to the Washington Attorney General. See Washington's consumer health-data rights law.

Other laws may provide additional rights. Use the same contact address. Do not email medical or identity documents; ask how to provide sensitive verification material.

5. Updates and contact

Contact ALLAYRA LLC at admin@allayra.com. We update this policy's date when it changes and provide further notice and consent options where required. The Privacy Policy explains security, storage, optional processing, and general retention.