Introduction

GoldieCircle LLC (“GoldieCircle,” “we,” “us,” or “our”) is committed to protecting the privacy and security of consumer health data.

What does this Policy cover?

This Consumer Health Data Policy supplements our general Privacy Policy and related disclosures, and applies to personal data defined as “Consumer Health Data” under the privacy laws of certain US states — including Washington’s My Health My Data Act (MHMDA) and Nevada’s health data privacy law (NHDPA). If there is any conflict between this Consumer Health Data Policy and our general Privacy Policy with respect to consumer health data, this Policy controls — except that where our Privacy Policy gives you stronger protection, the stronger protection generally applies. Nothing here is intended to reduce a promise we have made you elsewhere.

This Consumer Health Data Privacy Policy describes how we collect, use, disclose, and protect consumer health data as required by applicable laws in certain states.

Our Services may contain links to other sites. We do not control these sites and we encourage you to read their privacy notices and consumer health data privacy policies.

Our Services should not be used by individuals who are less than 18 years old.

If you are not comfortable with this consumer health data privacy notice, please reconsider your use of this Site/Service.

What is Consumer Health Data?

“Consumer health data” means personal information that directly or indirectly:

• is linked or reasonably linkable to an identified or identifiable individual; AND
• identifies the individual’s past, present, or future physical or mental health status.

Consumer Health Data We May Collect

Our collection of consumer health data will vary depending on your interactions with us, the Services you utilize, and your preferences and consents. In the course of providing our Services, we may collect or process the following types of consumer health data:

• Individual health conditions, treatment, diseases, or diagnosis
• Social, psychological, behavioral, and medical interventions
• Health-related surgeries or procedures
• Use or purchase of prescribed medication
• Bodily functions, vital signs, symptoms, or measurements of health information
• Diagnoses or diagnostic testing, treatment, or medication
• Gender-affirming care information
• Reproductive or sexual health information
• Precise location information that could reasonably indicate an individual’s attempt to acquire or receive health services or supplies
• Data that identifies an individual seeking health care services
• Information derived or extrapolated from non-health information that is used to identify an individual’s health status
• Other health-related information you may choose to provide to us
• Other information that may be used to infer or derive data related to the above or other health information

We do not set out to collect health information, and we encourage you not to share detailed health information through our Services. In practice, health information can reach us in these ways — so you know where to be careful:

• What you type to Goldie. Benefit questions often carry health details (“I’m on dialysis”, “my husband has Alzheimer’s”). Goldie needs enough to point you at the right programs, and no more. She will not give medical advice and is built to redirect health questions to your doctor or pharmacist.
• Documents you upload. A denial letter, an insurance notice, or a medical bill may contain diagnoses, procedures, or medications. We aim not to keep your document — it is processed and deleted in accordance with our retention practices. See “Documents You Upload” in our Privacy Policy.
• Benefit eligibility screening. Some programs turn on disability status, Medicare enrollment, or medical expenses, so we may ask. Your answers are used to check program rules and to save a profile if you ask us to.
• What you post in the Chatrooms. Rooms such as Health & Wellness, Caregiver Corner, and Grief Support are conversations between members. Anything you post there is visible to other members under your nickname, and rooms are safety-screened. Please treat them as public.

Categories of Sources

We collect consumer health data from the following categories of sources:

• Directly from you: information you type, upload, speak, post, or provide in a profile, benefit screening, support request, or other feature you choose to use
• From your use of our Services: information generated when you use a requested feature, but only when that information itself reveals or can reasonably be used to infer health status
• From inferences: health-related conclusions that may be inferred from information you provide, such as answers used to identify potentially relevant benefit programs
• From an organization you direct us to contact: information returned as part of the connection or service you specifically requested

We do not buy consumer health data from data brokers. We do not intentionally obtain it from healthcare providers, insurers, pharmacies, or government benefit agencies unless you direct or authorize the connection needed for a service you requested.

We will retain and use your consumer health data for the length of time needed to carry out the purposes outlined in this Policy and in accordance with our data retention policies.

How We Use Consumer Health Data

If we collect consumer health data, we use it only for the following purposes:

• Answering what you asked: To respond to your question, explain a document you uploaded, or check which benefit programs you may qualify for
• Service Provision: To provide and maintain our Services
• Communication: To respond to your inquiries and provide customer support
• Legal Compliance: To comply with applicable laws and legal obligations
• Safety and Security: To protect the safety, security, and integrity of our Services, including responding when someone may be at risk of harm
• Research and Analytics: For internal research, analytics, and development purposes, in aggregated or de-identified form

Goldie’s memory is deliberately built to keep health out of it. The system that writes those short summaries is instructed never to record diagnoses, medications, symptoms, treatments, or mental-health descriptions, and it additionally screens its own output for that kind of language and discards it. Everyday life events are kept (“lost her husband last spring”); health facts are not (“has dementia”, “takes blood pressure medicine”). No automated system is perfect, so please still avoid sharing health details you would want kept completely private.

How We Share Consumer Health Data

We disclose consumer health data only with your consent or to the extent necessary to provide a product or service you requested. We do not sell consumer health data.

Categories of Consumer Health Data Disclosed

Depending on the feature you choose, the categories disclosed may include health conditions or symptoms you describe; health-related benefit eligibility information; health information contained in a document you ask us to explain; health-related support communications; and health information you intentionally post in a community area. We disclose only the portion reasonably necessary for the requested feature, support, security, or legal purpose.

Categories of Recipients

Service Providers

We may share consumer health data with service providers who perform services on our behalf, such as:

• Cloud hosting and infrastructure providers
• Data processing and security providers
• Customer support providers, when you request support involving the information
• AI model providers (only as necessary to provide Services)

We do not send identifiable consumer health data to advertising or analytics providers. Community health information you intentionally post may be visible to other members or visitors as described at the point of posting. Information may also go to an organization you specifically ask us to contact, or to a government, court, or other recipient when disclosure is legally required.

Specific affiliates: GoldieCircle has no affiliate with which it shares consumer health data at this time. If that changes, we will update this Policy before the new sharing begins and obtain consent when required.

Our service-provider agreements may require providers to:

• Use consumer health data only for specified purposes
• Implement appropriate security measures
• Comply with applicable health data privacy laws
• Not further disclose the data except as necessary to provide services

Business Partners

We do not share consumer health data with business partners for their own purposes, and we do not sell it. If that were ever to change, we would seek any separate authorization required by applicable law for the specific purpose, and you could refuse or withdraw it as permitted by law.

Organizations You Ask Us to Contact

If you ask us to put you in touch with a specific organization — a senior center, a housing program, an area agency on aging — we pass on what is needed for them to help you. That happens because you asked, and only then.

Legal Requirements

We may disclose consumer health data:

• To comply with valid legal process (court orders, subpoenas, search warrants)
• To respond to lawful government or law enforcement requests
• To protect against fraud, security threats, or illegal activity
• To defend our legal rights or enforce our terms
• As required or permitted by applicable law

Geofencing — Our Current Practice

Based on our current practices, GoldieCircle does not use geofencing or location-based advertising within 2,000 feet of healthcare facilities, mental health providers, reproductive health clinics, substance-use treatment centers, or other sensitive locations. We do not intend to deliver advertisements, gather data, or send health-related messages based on physical proximity to such facilities. We will evaluate these practices in light of applicable laws, including Washington State’s My Health My Data Act (MHMDA).

De-identified or Aggregated Data

We may share aggregated, de-identified, or anonymized health data that cannot reasonably identify individuals, without restriction.

Your Rights Regarding Consumer Health Data

If you are covered by Washington’s MHMDA, the NHDPA, or another applicable consumer health privacy law, you may exercise the rights below, subject to the law’s exceptions:

• Confirm and access: ask whether we collect, share, or sell consumer health data about you and receive a copy of that data
• Recipient list: receive a list of third parties and affiliates with whom we shared or sold your consumer health data, together with an active email address or other online contact mechanism for them
• Withdraw consent: withdraw consent from future collection or sharing of your consumer health data
• Delete: ask us to delete consumer health data concerning you
• Appeal: appeal our refusal to act on a request
• No discrimination: exercise these rights without unlawful discrimination

How to Submit a Request

Email [email protected] with the subject Consumer Health Data Request, or mail the Privacy Department at the address below. Tell us whether you want access, a recipient list, withdrawal of consent, deletion, or another available right. You do not need to create a new account to make a request. If you already have an account, we may ask you to use it to help authenticate the request.

We will take commercially reasonable steps to authenticate your identity. If we cannot authenticate the request, we may ask only for additional information reasonably necessary to do so. A response is free up to twice in any 12-month period. We may charge a reasonable administrative fee or decline a request only when permitted by law, including when we can demonstrate that a request is manifestly unfounded, excessive, or repetitive.

Response and Deletion Timing

For a Washington consumer health data request, we will respond and process requests within the timeframes required by applicable law. When an extension is permitted and reasonably necessary because of the complexity or number of requests, we will provide any notice required by law.

When an authenticated deletion request applies, we will delete covered consumer health data from our records and take steps required by applicable law regarding affiliates, processors, contractors, and other third parties with whom it was shared. Deletion from archived or backup systems may be delayed as permitted by law.

How to Appeal

If we refuse to act, email [email protected] with the subject Consumer Health Data Appeal, or mail the Privacy Department at the address below. We will respond to appeals as required by applicable law and explain the decision. If the appeal is denied, you may submit a complaint to the Washington State Attorney General.

Security Incidents

If a security incident involving consumer health data triggers a notification duty under applicable law, we will provide notifications as required by applicable law. This statement does not replace our incident-response duties or determine whether a particular law applies to a particular event.

Contact Us

If you have questions, concerns, complaints, or requests regarding this Consumer Health Data Privacy Policy, please contact us:

GoldieCircle LLC
Email: [email protected] · [email protected]
Mail: GoldieCircle LLC, Attn: Privacy Department, 8 The Green, Suite B, Dover, DE 19901

Changes to This Health Policy

We reserve the right to update this Consumer Health Data Policy from time to time to reflect:

• Changes in our data practices
• New legal requirements
• Feedback from users or regulators

Revisions to this Policy may occur at any time, and when we make material changes, we will:

• Update the “Last Updated” date
• Post the revised policy on our website