Consumer Health Data Privacy Policy

1. Scope and roles

Camus LLC, doing business as Habit of Care (“Habit of Care,” “we,” “us,” or “our”), provides software to therapists, care providers, practices, and other organizations (“Customers”). Consumer health data is personal information that identifies, or can reasonably be linked to, a consumer and identifies or permits an inference about the consumer's physical or mental health, health services, medications, bodily functions, reproductive or sexual health, gender-affirming care, precise location indicating an attempt to receive health services, or similar health status.

For Client Data processed for a Customer, the Customer generally decides why and how the data is processed, and we process it under the Customer's instructions as a processor or service provider. Contact that Customer first to exercise rights over Client Data. We act as the regulated entity for consumer health data we control directly, including data used to administer direct accounts, privacy requests, security, and our own legal obligations.

This policy applies to our websites, applications, provider and client portals, communications, and connected features where a state consumer-health law applies. To the extent a particular record is HIPAA-covered protected health information and an applicable consumer-health statute exempts that record, it is handled under HIPAA, the applicable Notice of Privacy Practices, and any Business Associate Agreement; other consumer health data remains subject to applicable law and this policy.

2. Consumer health data we collect and its sources

Depending on the features a Customer enables and what a User chooses to submit, we may collect or derive:

• identity, contact, account, provider relationship, age or guardian status, and authentication information;
• wellness goals, symptoms, mood, habits, sleep, activity, pain, stress, diagnoses, conditions, medications, substance-use information when an approved workflow permits it, and other physical or mental health information;
• journal and assessment responses, care plans, assignments, check-ins, progress measures, notes, memories, messages, support communications, images, audio, transcripts, and files;
• appointments, service usage, provider invitations and connections, plan enrollment, payment or subscription status, and information showing that a person sought or received a health-related service;
• AI inputs and outputs, summaries, recommendations, classifications, trends, risk signals, and other inferences generated from submitted or observed information; and
• device, log, security, and approximate-location information when it can be linked to health-related activity. We do not seek precise location for consumer-health profiling.

Sources include consumers and their authorized representatives; Customers and their authorized workforce; linked providers and care-team members; devices and browsers; features a User activates; service providers operating under our instructions; payment and communications providers; integrations a User or Customer directs us to connect; and information we lawfully derive from use of the Services. We do not obtain consumer health data from data brokers.

3. Why we collect and use consumer health data

We collect and use consumer health data only as reasonably necessary to provide a requested product or service, with consent where required, or as otherwise permitted by law. Purposes include:

• creating and administering accounts, invitations, provider-client connections, care workflows, subscriptions, and requested features;
• storing, organizing, displaying, and transmitting information to the consumer, the applicable Customer, and authorized care-team members;
• personalizing requested tools; generating user-requested AI output, summaries, transcripts, trends, or recommendations; and supporting provider review;
• providing customer support, accessibility, service communications, payment administration, and dispute resolution;
• securing the Services, authenticating Users, preventing fraud and abuse, debugging, maintaining reliability, and responding to incidents; and
• complying with law, valid legal process, professional-record instructions, and applicable contracts.

We will obtain affirmative consent before collecting or using a new category of consumer health data, or using it for a materially different purpose, when required by law. We do not make eligibility, employment, insurance, credit, housing, or other high-impact decisions about consumers.

4. How and with whom we share consumer health data

“Share” may have a broader meaning under consumer-health laws than under other privacy laws. We may disclose the categories above, only as needed for the stated purposes, to:

• the applicable Customer and authorized Users, including a provider, practice, administrator, care-team member, or other person whom the consumer or Customer authorizes;
• cloud and infrastructure processors, including Microsoft Azure and contracted database, storage, security, logging, backup, and delivery providers;
• approved AI and transcription processors, including OpenAI or Microsoft services, only for enabled workflows and subject to applicable contractual and technical controls;
• communications and support processors, including approved email, messaging, customer-support, and notification providers, for requested and operational communications;
• payment processors, including Stripe, for platform billing, practice-direct client charges, subscriptions, refunds, disputes, and fraud review. We do not place clinical content in payment metadata;
• professional advisers and transaction counterparties under confidentiality obligations, including auditors, counsel, insurers, and parties to a financing, acquisition, or reorganization as permitted by law;
• government, legal, and safety recipients when disclosure is required or expressly permitted by law; and
• other recipients at the consumer's or Customer's direction, including an integration or recipient the User affirmatively chooses.

As of the effective date, Camus LLC has no corporate affiliates with which it shares consumer health data. Service-provider identities can change as our operations change; a current subprocessor list or additional information is available by emailing privacy@habitofcare.com. Where required, consent to sharing is separate and distinct from consent to collection.

We do not sell consumer health data. We do not share it for targeted or cross-context behavioral advertising. We contractually restrict processors to documented instructions and require appropriate confidentiality, security, deletion, and assistance obligations.

5. Your rights and choices

Subject to verification, role, jurisdiction, and legal exceptions, you may have the right to:

• confirm whether we collect, use, share, or sell your consumer health data and access that data;
• obtain a list of third parties and affiliates with whom your consumer health data was shared or sold, including available contact information;
• delete consumer health data, including by requiring deletion by processors and other recipients where applicable;
• withdraw consent for collection or sharing; and
• appeal a refusal to act on a request without discrimination for exercising a right.

To withdraw consent, use the relevant account or connection setting if available, or email privacy@habitofcare.com with “Consumer Health Data Request” in the subject. Withdrawal does not affect processing that occurred before withdrawal and may prevent us from providing a requested feature. We will not condition an unrelated product on consent to unnecessary processing.

For data connected to a provider or organization, identify that Customer and contact it first. We will route or assist with the request as required. We may ask for information reasonably necessary to verify identity, authority, jurisdiction, and the account or Customer involved. An authorized agent may submit a request with proof of authority. If we deny a request, our response will explain how to appeal; appeals may be sent to the same address with “Privacy Appeal” in the subject. You may also contact your state attorney general.

Deletion may be limited by an applicable exception, including a provider's lawful record-retention duty, legal hold, security and fraud records, or data needed to complete a requested transaction. Where Washington law applies and no exception permits retention, deletion from archived or backup systems will occur as provided by law and no later than six months after authentication of the request.

6. Retention and security

We retain consumer health data only for as long as reasonably necessary for the requested service, Customer instructions, account and transaction administration, security, dispute resolution, and legal or contractual duties. Retention varies by data type and Customer configuration. We use administrative, technical, and physical safeguards designed to protect confidentiality, integrity, and availability, but no system can be guaranteed completely secure.

7. Changes and contact

We will post changes to this policy and update the date above. If a change would materially expand our collection, use, or sharing of previously collected consumer health data, we will provide additional notice and obtain consent where required before the new processing begins.