Privacy Policy

1. Scope

This Privacy Policy explains what information Family Vault ("we," "us") collects through the Family Vault website and application (the "Service"), why we collect it, who we share it with, and the choices and rights you have. It should be read together with our Terms of Service.

2. Information We Collect

Account information. Your name, email address, and authentication credentials (or, if you sign in with Google, the profile information Google provides).

Family and child information you enter, including:

• A child's name, date of birth, and gender
• Emergency contact names, relationships, and phone numbers
• Health information: allergies, reactions and severity, immunization records, medical conditions, medications, and physician contact information
• Insurance information: provider, policy number, group number, and subscriber name

Documents you upload, such as blank forms to be filled in, immunization records, or insurance cards — including any information contained in them.

Usage information, such as which forms you fill out and which fields could or couldn't be matched automatically, which we use to improve accuracy. We do not include the actual sensitive field values you've entered in this usage data.

3. How We Use Information

We use the information above only to:

• Store it so you and anyone you invite into your family account can view, copy, and reuse it
• Automatically or semi-automatically fill in PDF forms you upload, including using an AI service to read documents and match form fields (see Section 6)
• Maintain, secure, and troubleshoot the Service
• Communicate with you about your account or the Service

We do not sell your information, and we do not use it for advertising or share it with data brokers.

4. Consumer Health Data Privacy Policy

This section is our Consumer Health Data Privacy Policy for purposes of Washington's My Health My Data Act and similar state laws, which apply regardless of whether the Service is HIPAA-covered (it is not — see our Terms of Service).

What we treat as consumer health data. Allergy, immunization, medical history, and insurance information you enter about yourself or your children, and any health information contained in documents you upload.

Categories collected. Physical health conditions and status (allergies, diagnoses, medications), health insurance information, and any health information otherwise present in uploaded documents.

Purpose. Solely to provide the Service to you — storing this information for your own reference and using it to fill in forms you choose to upload. We do not use it for any other purpose.

Sharing. We share consumer health data only with the service providers described in Section 6, acting on our instructions to operate the Service. We do not sell consumer health data, and we do not share it for advertising.

Consent. We collect consumer health data only after you give affirmative, opt-in consent that is separate from your acceptance of our Terms of Service — this is the second checkbox presented at signup. You may withdraw this consent at any time by contacting adam.borelli@gmail.com or deleting the relevant information from your account; withdrawing consent will not affect processing that already occurred, and may require us to stop providing features that depend on that information.

Your rights. Regardless of where you live, you may contact us at adam.borelli@gmail.com to:

• Confirm whether we are processing consumer health data about you
• Access the consumer health data we hold about you
• Withdraw your consent to its collection or use
• Request deletion of your consumer health data

We will respond within the time required by applicable law and will not discriminate against you for exercising these rights. If we deny a request, we will explain why and how to appeal.

5. Children's Information

Family Vault is intended for use by adults (parents and legal guardians) who enter information about their children — it is not directed to children, and we do not knowingly collect information directly from a child. If we later add features that would collect information directly from children, we will update this policy and comply with applicable law, including the Children's Online Privacy Protection Act (COPPA), before doing so.

6. Service Providers

We use the following categories of service providers to operate the Service:

• Database and file storage (Supabase) — stores your account data and uploaded documents. Sensitive fields are encrypted at the application layer before storage.
• AI document and form processing (Anthropic) — used to read uploaded documents and match form fields to your stored information. Document content may be sent to this provider to perform this processing.

These providers act on our instructions and are not permitted to use your data for their own purposes.

7. Data Retention

We retain your information for as long as your account is active, or as needed to provide the Service. If you delete a record or your account, we delete the corresponding data within a reasonable period, except where we are required to retain it by law.

8. Data Security

We apply security measures including application-layer encryption for sensitive fields (medical history, allergies, insurance, and immunization data), access controls scoped to your family account, and encrypted storage. No method of storage or transmission is completely secure, and we cannot guarantee absolute security, particularly during the beta period described in our Terms of Service.

9. Changes to This Policy

We may update this policy from time to time. If we make material changes — particularly to Section 4 — we will provide notice and, where required by law, seek renewed consent before continuing to collect consumer health data under the changed terms.

10. Contact Us

Questions about this policy, or requests to exercise your rights, can be sent to adam.borelli@gmail.com.