Consumer Health Data Privacy Policy

This policy is required by Washington’s My Health My Data Act (chapter 19.373 RCW). It says what consumer health data CustodyComms, Inc. collects, why, where it comes from, who receives it, and how to use the rights that law gives you. It adds to our Privacy Policy.

It is for you if you live in Washington, or if your health information is collected in Washington. You do not have to be a CustodyComms customer. People use CustodyComms to organize messages from a custody case, and those messages can mention the health of someone who never used the service, such as the other parent.

Consumer health data we collect, and why

We do not ask anyone for health information. It reaches us only inside what a person brings to CustodyComms: messages between parents, and what a person writes to us. Those can mention health information of any kind, such as a health condition or diagnosis, a medication, treatment or therapy, mental health, pregnancy, reproductive or sexual health, gender-affirming care, substance use, an injury, or a child’s medical care. The information can be about the person using CustodyComms, about the other parent, or about a child.

Messages kept only in the desktop or iPhone application stay on that person’s own device and are not collected by us. We receive them only when one of these is used:

The demo on our website. A person uploads a conversation file or pastes messages. We process the text and send it to our AI provider to produce a sample report. The report can repeat what the messages say, and it labels messages by subject, such as a child’s welfare or a risk of harm. We keep the text and the report for up to 24 hours. If the file is a scan whose text cannot be read directly, the file itself is sent so that its pages can be read. If the person sends the report to their phone, we keep that report, and the messages it was drawn from, until they delete it from their account page or delete their account.
Cloud AI in the desktop application, which is off until the user turns it on. The messages in the incidents the user chooses pass through our server to our AI provider, and so do the excerpts of up to 280 characters each that Matter Builder sends. We do not store them.
Sharing a case with another person. An encrypted copy is stored so that the recipient can open it. We hold no key that opens a case shared from version 2.0 or later of the application. Three things are different, and section 8 of our Privacy Policy describes each: a case that an emailed invitation key can still open, a case shared from an earlier version, and a report sent to a phone from our website, which we are able to open for as long as it exists. The name of a shared case and any note its sender typed are stored in a form we can read. The name is also carried in the invitation email and in the notification sent to the recipient’s phone.
The help assistant. A question typed into it is sent to our AI provider so that it can be answered. We do not store the question. Before this policy took effect we saved a short excerpt of a question the assistant declined; those excerpts are still in our support system.
Writing to us. A message sent through our contact form is delivered to our support mailbox. If it asks for parent support or is a press enquiry, it is also kept in our support system. A copy of a contact form message also stays in our outgoing email queue, and we have set no deletion date for that copy. A message sent to one of our email addresses is kept in our mailbox. Feedback sent from inside the iPhone application is kept with the account that sent it and delivered to our support mailbox.

We use this information to do what the person asked: to produce the analysis or report, to deliver a shared case to the person chosen, to answer the question, or to reply to the message. We keep what a person writes to us so that we can refer back to it when helping them and when improving the service. We also use this information where needed to keep the service secure and to meet a legal obligation. We do not use it for advertising.

Where it comes from

From the person who uses the feature: the file they upload or the messages they paste, the messages they choose to send or share, the question they ask, the message they write. That person may be you. It may also be someone else whose messages mention you, such as the other parent in a custody case.

What we share, and with whom

We share the consumer health data described above only as follows.

With companies that process it for us, under their terms for handling customer data: our AI provider (OpenAI), which receives demo text, the file itself when it is a scan whose text cannot be read directly, cloud AI messages and excerpts, and help questions; our hosting and network provider (Cloudflare), through which the demo, cloud AI, the help assistant, our contact form and the emails we send pass, and which holds the demo text and report for the 24 hours, a report sent to a phone until it is deleted, and the copy of a contact form message in our outgoing email queue; our storage, sign-in and mailbox provider (Google), which holds encrypted shared cases and reports sent to a phone, the names and notes of shares, feedback sent from the iPhone application and the messages in our mailboxes, and which delivers the notification of a share to the recipient’s iPhone through Apple’s push notification service; our support system (HubSpot), which holds parent support requests and press enquiries sent through our contact form and the earlier help excerpts; and our email delivery provider (Twilio SendGrid), which carries contact form messages, iPhone feedback and invitation emails.
With the person a case is shared with, when a user chooses to share it.
Where the law requires it, such as a court order.

We do not share it with any affiliate, and we do not sell it.

Your rights, and how to use them

You may ask us to:

confirm whether we are collecting, sharing or selling consumer health data about you, and give you access to it, with a list of the third parties and affiliates it has been shared with and a way to contact them;
stop collecting and sharing it, by withdrawing any consent you have given;
delete it.

To make a request, write to privacy@custodycomms.com. You do not need an account and we will not ask you to create one. If you have an account, you can also delete a report you sent to your phone, or your whole account, from your account page. Tell us what you are asking for and what would help us find it, such as an email address used with us. You do not need to describe the health information itself. We ask only for what we reasonably need to confirm who you are.

We answer within 30 days. We will not charge a fee for reasonable requests.

Much of what passes through CustodyComms is not kept, is kept encrypted under a key we do not hold, or cannot be connected to a person by name. If we find nothing about you, or cannot confirm who you are, we will tell you that.

If we say no

If we decline a request, you may appeal by replying to our answer or by writing to the same address. We decide an appeal within 45 days and explain the decision in writing. If the appeal is denied, you may complain to the Washington State Attorney General at www.atg.wa.gov/file-complaint.