Draft. This policy hasn’t been reviewed by a lawyer yet and isn’t in effect. firstlife is in testing and isn’t collecting real health information.
Consumer Health Data Privacy Policy
This policy is for people covered by state consumer health data laws, including Washington’s My Health My Data Act, Nevada’s consumer health data law (SB 370) and Connecticut’s consumer health data protections. It works alongside our Privacy Policy. firstlife is run by Velez Health, Inc.
Consumer health data we collect
- Symptoms, their severity and how they affect your daily life
- Medications and doses
- Health conditions you have or are looking into, and your family health history
- Medical appointments, visit notes, what providers told you, and questions for providers
- The providers on your care team
- Medical records and test results you upload
- Audio recordings of visits or calls that you choose to record, and your summaries of them
- Your answers about why you’re using firstlife, which may reveal health information
Where it comes from
Directly from you, in the app. If you connect Google Calendar, from appointments you choose to save from it. We don’t buy health data or get it from anyone else.
Why we collect and use it
Only to provide the features you ask for: keeping your timeline, showing trends, organizing visits and questions, storing your records and recordings, and creating summaries you choose to export or send. We collect it only with your consent, which you give when you create your account.
Who we share it with
We share consumer health data only with service providers that process it for us under contract (processors), and only to run the app:
- Supabase: stores your account, entries, files and recordings.
- Resend: sends your sign-in emails. It receives only your email address and the one-time code.
We don’t share consumer health data with any other third party or affiliate. If you choose to send a visit summary to someone, it goes to the person you choose. We don’t sell consumer health data, and we would never do so without your separate, signed authorization as the law requires.
We don’t use geofences
We don’t set up virtual boundaries around health care locations, and we don’t collect your location.
Your rights
- Confirm and access: find out whether we collect, share or sell your consumer health data, see that data, and get a list of every third party and affiliate we’ve shared it with, with their contact details.
- Withdraw consent to our collecting and sharing it.
- Delete it. Settings → Delete my account removes it from our systems right away, and backups are erased within 30 days. We’ll also tell our processors to delete it.
How to use your rights
Use the options in Settings, or email support@healthbyvelez.com from the address on your account. We may ask you to confirm it’s you. We’ll respond within 45 days, and may extend that by another 45 days when reasonably necessary, in which case we’ll tell you.
Appeals
If we deny your request, you can appeal by emailing support@healthbyvelez.com with “Appeal” in the subject. We’ll reply in writing within 45 days and explain our decision. If your appeal is denied, you can contact your state attorney general. In Washington, you can file a complaint at atg.wa.gov.
Contact
Velez Health, Inc.
Email: support@healthbyvelez.com