Consumer Health Data Privacy Policy

This policy is for Washington residents, under the Washington My Health My Data Act (RCW 19.373), and for anyone
who wants to know exactly how Angel Squad treats information about health. It sits beside our general
privacy notice, which covers everything else.

The short version

Angel Squad is a professional network and workforce platform for healthcare people. It is not a health service and
it is not a patient-record system. We do not ask for your health information, we do not infer it, we never sell
it, and we never use it for advertising. The only health information we hold is what you choose to write about
yourself.

What consumer health data we collect

"Consumer health data" means personal information that is linked or reasonably linkable to you and identifies your
past, present or future physical or mental health status.

We collect it only when you write it yourself, in places you control:

• what you post, comment or write in your profile, bio or status;
• what you send in a chat or direct message;
• what you put in a file you upload.

If you mention your own health in any of those places, that text is consumer health data, and this policy applies
to it.

We do not collect it in any other way. No health questionnaire, no symptom tracker, no wearable or app
integration, no precise location that could reveal a visit to a health care provider, no inference from what you
read or who you follow. The location on your profile is a city or postcode you typed, resolved on our own servers
to an approximate point; it is never collected from your device.

Not covered by this policy: information your employer holds about you as its employee — time off, schedules,
credentials, policy acknowledgements — is processed in an employment context, which the Act excludes. It is
protected all the same, under our privacy notice and our agreement with your employer.

Patient information is not allowed at all. Our terms prohibit posting information about patients. If it
appears, we remove it.

Why we collect it

Only to provide the feature you used: to show your post to the people you chose, deliver your message, store your
file, and keep the service secure and free of abuse. We do not use consumer health data for any other purpose.

Where it comes from

From you, directly, and from nobody else.

Who we share it with

• The people you chose. A post is seen by its audience; a message by its recipients.
• Our processors, only to run the service: our hosting provider, which stores the service's data encrypted in
  United States data centres. Our email and push-notification providers never receive it — our notifications carry
  no message text, by design.
• When the law requires it, and then only what it requires.

We do not sell consumer health data, and we do not share it with any third party for its own purposes. We have no
affiliates that receive it.

Your rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and get a list of the third parties and
  affiliates we have shared it with;
• access it — the export in your settings gives you everything you have written, with a copy of every file;
• delete it — delete a post or message yourself at any time, or close your account from your settings, which
  deletes your content and passes the deletion on to our processors;
• withdraw consent — by deleting what you wrote; we do not collect consumer health data on any other basis.

You can use these rights from your account settings, or by writing to us through the help page. We answer
within 45 days, and tell you if we need up to 45 more and why. If we decline, you can appeal by replying to our
answer; we decide an appeal within 45 days and, if we decline again, tell you how to contact the Washington
Attorney General.

We will not discriminate against you for exercising these rights.

How we protect it

Encrypted in transit (TLS 1.3) and at rest (AES-256), stored only in the United States, readable only by the people
it is shared with and — under audit — by our staff when they handle a report or a legal obligation. More detail is
on our trust page.

Changes

If we change this policy we will update the date above, and if the change expands what we collect or how we share
it, we will ask for your consent first.