Consumer Health Data Privacy Policy

This policy applies to consumer health data, as defined by Washington's My Health My Data Act, of Washington residents and of people whose consumer health data is collected in Washington. It covers the VaxFile app by Little Handy Apps:

Consumer health data we collect, and why

• Vaccination records you enter for yourself and your family (vaccine, date, dose, who administered it, your notes), together with the family profile they belong to (name, date of birth, sex): to store and show your records, vaccination schedules and reminders.
• Photos of vaccination documents you choose to scan: to read the vaccination data from them.
• If you opt in to usage statistics: app usage events, which may show that you logged a vaccination: to improve the app.

Sources

All consumer health data comes directly from you. We don't collect it from other sources, and we don't infer it.

Sharing

We don't sell consumer health data. We share it only with service providers that process it on our behalf under contract. We have no affiliates.

• Supabase (supabase.com): stores all categories above.
• OpenAI (openai.com): receives scanned photos, only when you scan.
• PostHog (posthog.com): receives usage events, only if you opt in.

Your rights

You can:

• confirm whether we collect or share your consumer health data, and access it, including a list of everyone we've shared it with and their contact information
• withdraw your consent
• have your consumer health data deleted, including by our service providers

Email support@vaxfile.app, or delete your account in the app under Settings. We respond within 45 days, and if we need up to 45 more days, we'll tell you why. If we decline your request, you can appeal by replying with the subject "Appeal". We respond to appeals within 45 days.

Changes

We'll tell you about material changes in the app, and update the effective date above.