Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Entrewoven Company, a Delaware corporation doing business as “Entrowoven,” “Entrowoven.com,” and “Entrowoven Company” (collectively, “Entrowoven,” “we,” “us,” or “our”), collects, uses, shares, and protects “consumer health data” through our communication and coordination service for parents and families connected through school communities (the “Service”).

This Policy supplements — and does not replace — our Privacy Policy and our Terms of Use. In the event of a conflict between this Policy and our general Privacy Policy with respect to consumer health data, this Policy controls.

This Policy is provided to comply with the Washington My Health My Data Act (“WMHMD”), RCW 19.373, and is intended to apply to all consumers from whom Entrowoven collects consumer health data, including but not limited to residents of Washington State.

For purposes of this Policy, “consumer health data” means personal information that is linked or reasonably linkable to a consumer (or a member of the consumer’s household, including a minor child for whom the consumer is the parent or guardian) and that identifies the consumer’s past, present, or future physical or mental health status. In the context of the Service, consumer health data typically includes:

• Food allergies, intolerances, and sensitivities (including life-threatening allergies)
• Dietary restrictions (whether medical, religious, cultural, or ethical, including celiac disease, lactose intolerance, vegetarianism, veganism, halal, kosher, and similar)
• Other health conditions you choose to disclose in connection with a signup, RSVP, family profile, or related coordination feature

We do not knowingly collect: clinical diagnoses, prescription or medication records, biometric data, genetic data, precise geolocation data linked to health activities, mental health treatment records, or reproductive health information. If you provide any of those categories in free-text content (e.g., the body of a message), please contact us at the address below and we will delete it.

We collect only the categories of consumer health data that you (or, where applicable, a parent or guardian acting on behalf of a minor child) voluntarily choose to enter into the Service. These categories are:

• Allergy and intolerance information — including the substance(s) involved, severity, and any free-text notes you provide;
• Dietary restriction information— including the type of restriction and any free-text notes you provide;
• Other health-related notes— to the extent you choose to enter additional context (for example, “carries an epinephrine auto-injector at all times”).

We do not collect consumer health data automatically. We do not infer consumer health data from device, browsing, or location signals.

We collect and process consumer health data solely to:

1. Display the data to the participants in the same signup, event, or group that you have chosen to share it with — for example, displaying a child’s peanut allergy on a classroom snack signup so that the parent bringing the snack can see it;
2. Provide reminders, summaries, and notifications about that data to the participants you have chosen to share it with;
3. Operate, secure, and improve the Service (including troubleshooting, fraud prevention, and maintenance);
4. Respond to your support requests;
5. Comply with our legal obligations.

We do not use consumer health data to serve advertising. We do not use it to train any machine-learning or artificial-intelligence model. We do not use it for profiling. We do not sell it.

Consumer health data on the Service comes from one of three sources:

1. You, when you enter the information about yourself directly;
2. A parent or guardian acting on your behalf, if you are a minor and a parent or guardian has entered information about you under their account;
3. Another adult user with whom you have an explicit relationship, in the limited case where, for example, a spouse has added information about you to a shared household profile and you have agreed to that arrangement.

We do not receive consumer health data from data brokers, advertising networks, public records aggregators, or any other third-party source.

We share consumer health data only:

• With the participants you choose— for example, the other parents in a snack signup, the host of an event you RSVP to, or members of a group where you have posted the information. You control these audiences through the privacy and sharing controls within the Service.
• With our processors and service providers — including cloud hosting providers and security vendors who store or process the data on our behalf, subject to written contracts that prohibit them from using the data for any purpose other than providing services to us. A current list of these providers is available on request at the contact address below.

We do not share consumer health data with advertisers, advertising networks, data brokers, or any party for cross-context behavioral advertising. We do not sell consumer health data. We do not share consumer health data with affiliates for marketing purposes.

We may disclose consumer health data if we believe in good faith that disclosure is required to comply with a legal obligation, respond to a lawful subpoena or court order, or protect the rights or safety of Entrowoven, our users, or the public. We will notify you of any such disclosure unless prohibited by law.

You have the following rights with respect to your consumer health data, regardless of where you reside, to the maximum extent we can implement them consistent with operating the Service:

1. Right to confirm and access. You may confirm whether we are collecting, sharing, or selling your consumer health data, and request access to a copy of the data we hold about you.
2. Right to withdraw consent. You may withdraw consent for our collection and sharing of your consumer health data at any time. Withdrawal does not require a reason and may not be made difficult or conditioned on any other action.
3. Right to delete. You may request that we delete consumer health data we have collected about you. We will delete it from our active systems within 30 days of a verified request, except where retention is required by law (in which case we will isolate the data and not use it for any other purpose).
4. Right against discrimination. We will not deny you Service, charge you a different price, or provide a different quality of Service because you exercised any of the rights described in this Policy.
5. Right to appeal. If we decline a request, you may appeal by replying to our response or contacting us at the address below. We will provide a written explanation of our final decision within 45 days.

How to Exercise These Rights

To exercise any of these rights, contact us at privacy@entrewoven.comwith “Consumer Health Data Request” in the subject line. We may ask for additional information to verify your identity before processing your request, but we will limit that information to what is reasonably necessary.

Authorized agents may submit requests on your behalf with appropriate authorization documentation.

Before we collect any consumer health data from you, we obtain your specific, informed, voluntary, and unambiguous opt-in consent. This includes:

• At account creation,if you are an adult creating an account, we present a separate consent prompt — distinct from acceptance of the Terms of Use — that explains the categories of consumer health data we may collect, the purposes, and your rights. You must affirmatively check a box to consent. The Service is usable without providing consumer health data, and we will not condition account access or core feature access on consent.
• At the point of collection, if you are entering consumer health data into a specific feature (for example, accepting an RSVP that requests dietary information), we present a separate, contextual consent prompt before you submit the data. This consent is specific to the data being entered and may be granted or refused independently of any prior consent.
• Before sharing,if a particular share of your consumer health data would exceed the scope of the original consent — for example, broadcasting it to a larger audience than originally intended — we obtain a separate consent before that share occurs.

If you withdraw consent, we (a) stop collecting new consumer health data from you, (b) stop sharing your previously-collected consumer health data with other users, (c) notify any host or organizer whose event includes data you had shared that access has been withdrawn (without disclosing the underlying data), (d) make clear to that host that they may re-request access from you, and (e) delete the previously-collected data within 30 days unless retention is required by law.

The Service is designed for parents and guardians. Parents and guardians may, in their discretion, enter consumer health data about their minor children for the purpose of coordinating with the family’s school community.

A parent or guardian providing consumer health data about a minor child represents that they have the legal authority to do so. The parent or guardian may, at any time, review, modify, or delete the data they have entered, and may withdraw consent on behalf of the child. We treat data about a minor as part of the parent’s or guardian’s account for purposes of access and deletion rights.

We do not knowingly collect consumer health data directly from a child under 13. If we learn that we have done so, we will delete it promptly. See our general Privacy Policy Section 10 for additional COPPA-related disclosures.

We protect consumer health data with the technical and organizational safeguards described in our general Privacy Policy, including encryption in transit and at rest, access controls limiting employee access on a need-to-know basis, and regular security review. Access by employees to consumer health data is logged and subject to additional internal authorization requirements.

No method of transmission or storage is perfectly secure. We will notify you and any relevant authority of any breach involving your consumer health data as required by applicable law.

We retain consumer health data only as long as it remains relevant to an active signup, event, group, or family profile in which you have chosen to share it, and for a short additional period to allow for restoration in case of accidental deletion. Specifically:

• Active data: retained while the signup, event, group, or profile is active;
• Inactive data: deleted within 90 days after the related signup, event, group, or profile is closed, deleted, or has been inactive for 12 months, whichever is sooner;
• Withdrawn-consent data: deleted within 30 days of consent withdrawal, except where retention is required by law.

We do not retain consumer health data after account deletion except as required by law.

This Policy applies to all consumers from whom Entrowoven collects consumer health data. Entrowoven currently restricts new account signups from certain U.S. states pending completion of state-specific compliance work. The current list of restricted states is available at our website and may change over time.

We may update this Policy from time to time. When we make material changes, we will notify you by email or through a prominent in-app notice at least 30 days before the changes take effect. The “Last Updated” date at the top of this Policy reflects the most recent revision. Continued use of the Service after a change to this Policy takes effect constitutes acceptance of the updated Policy with respect to data collected going forward; we will not apply changes retroactively to data collected under a prior version of this Policy without obtaining new consent.

To exercise any right described in this Policy, ask a question, file a complaint, or report a concern about our handling of consumer health data, contact:

Entrewoven Company (d/b/a Entrowoven)
privacy@entrewoven.com
Subject line: “Consumer Health Data Request”

You may also contact the Washington State Attorney General’s Office to file a complaint:

Office of the Washington State Attorney General
https://www.atg.wa.gov/file-complaint