Consumer Health Data Privacy Policy

1. Who we are and the scope of this policy

ChartKey is operated by ChartKey LLC, a Colorado limited liability company located at 2519 S Shields Street, Suite 1K #963, Fort Collins, CO 80526 ("ChartKey," "we," "us," or "our"). ChartKey is a patient-owned tool that helps a person bring fragmented medical information into a single, understandable timeline, document symptoms, and view a plain-language summary of their health.

This policy is ChartKey's dedicated consumer health data privacy policy under the Washington My Health My Data Act. It describes the categories of consumer health data we collect, the purposes for which we collect and process it, the categories of sources, the categories of third parties and the specific affiliates (if any) with whom we share it, and how you exercise your rights. A prominent link to this policy is published on our homepage.

2. What "consumer health data" means

Under the MHMDA, consumer health data is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. For ChartKey, consumer health data includes the clinical information drawn from your connected medical records, the symptoms and health details you document, and information that could reveal an attempt by you to acquire or receive health services or supplies.

3. The consumer health data we collect, and its sources

3.1 Categories of consumer health data

• Connected clinical records — data retrieved, at your direction, from an external health system such as Epic MyChart. This may include encounters, conditions/diagnoses, observations and laboratory results, medications, allergies, immunizations, procedures, and clinical notes.
• Symptoms and health details you document — information you enter through our guided AI intake or the Keeper voice companion, and notes you add to a timeline.
• Voice audio (processed in real time, not retained) — if you opt in to the Keeper voice companion, your microphone audio is processed in real time within our secured AWS environment to power the conversation. The audio itself is not retained; only the transcript-derived note you review and confirm is saved to your record. Voice use requires its own separate consent, which you can withdraw at any time.
• Health-status inferences — plain-language summaries and reminders ChartKey generates from the above, each traceable to its source encounter or symptom.
• Identity and relationship data linked to health data — a patient's name, date of birth, and the caregiver-to-patient relationship, to the extent this data is linked to the health information above.

3.2 Categories of sources

• You — the consumer or patient, through the guided intake, voice companion, and notes.
• A caregiver you have authorized — an adult who documents or manages a patient's record with a valid basis (see our Privacy Policy, Section 9).
• Your healthcare providers, at your direction — via a secure, patient-authenticated SMART on FHIR / OAuth 2.0 connection you initiate (for example, Epic MyChart). We never see your provider-portal password.

4. Why we collect and process consumer health data (purposes)

We collect and process consumer health data only to provide the Service you have asked for, to keep it secure, and to meet our legal obligations. Specifically, to:

• Build and maintain your patient-owned timeline from connected records and documented symptoms;
• Operate the guided AI intake and the Keeper voice companion so you can clarify and document symptoms;
• Generate plain-language, source-cited summaries and care reminders about your health;
• Enable caregiver access strictly under the consent and authorization rules in our Privacy Policy;
• Secure the Service, prevent fraud and abuse, and maintain the access and audit logs that let you see who viewed your information;
• Provide support and respond to your requests, and comply with legal obligations.

We do not process consumer health data for advertising, for building advertising or marketing profiles, or to train general-purpose artificial-intelligence models.

5. Categories of third parties and specific affiliates with whom we share consumer health data

ChartKey is not in the business of sharing your data. We share consumer health data only as described here. The MHMDA requires us to list the categories of third parties and the specific affiliates with whom consumer health data is shared — set out below.

5.1 Specific affiliates

ChartKey LLC currently has no corporate affiliates, parent, or subsidiary entities. We therefore share consumer health data with no affiliates. If this changes, we will update this policy to name each specific affiliate before any such sharing.

5.2 Categories of third parties

A note on Epic MyChart. When you connect a provider such as Epic MyChart, data flows from your provider to you at your direction. Your provider and Epic are the source of that data and are governed by their own terms and privacy practices; they are not recipients of consumer health data we share.

We will keep this list current as our providers change.

6. We do not sell consumer health data

ChartKey does not sell consumer health data, and does not exchange it for anything of value. Under the MHMDA, any sale of consumer health data would require a separate, specific "valid authorization" from you. We do not seek such authorizations because we do not sell your data. We also do not use consumer health data for targeted advertising, and we do not use geofencing around any healthcare facility.

7. Consent — separate opt-ins for collection and for sharing

The MHMDA requires that your opt-in to collect consumer health data be separate from any opt-in to share it, and that neither be bundled, pre-checked, or buried. ChartKey captures three distinct, affirmative, never-pre-checked consents, each recorded durably and tied to the policy version you agreed to, and each revocable:

• Baseline agreement to the Privacy Policy and Terms — an explicit checkbox at account creation.
• Collection / processing opt-in — a separate opt-in to ChartKey collecting and processing your consumer health data beyond what is strictly necessary to run the Service, taken at the point of collection (your first AI intake).
• Sharing opt-in — a distinct opt-in taken before any sharing (for example, before inviting a caregiver or exporting your record), separate from the collection opt-in.

You can withdraw the collection or sharing consent at any time in the Service (Settings → your privacy choices). Withdrawal is honored going forward.

8. Your rights over your consumer health data

You have the following rights, which we honor for all users:

• Right to access. You can access your consumer health data in the Service, and you can obtain a list of the third parties and affiliates with whom we have shared your consumer health data. You can also review an access log showing who accessed a patient's health information and when (Settings → Access log).
• Right to withdraw consent. You can withdraw your consent to our collection or sharing of your consumer health data at any time, and disconnect a connected health record.
• Right to delete. You can request that we delete your consumer health data. You can permanently delete individual self-reported entries, or delete your entire account and all associated data. Deletion is immediate and irreversible — we recommend exporting first. We will honor deletion requests within the time required by law.
• Right to appeal. If we deny a request, you may appeal by replying to our response. We will respond to your appeal in writing and explain our decision. If your appeal is denied, you may contact the Washington State Attorney General (see below).

To exercise any of these rights, use the controls in the Service or contact us at privacy@yourchartkey.com. We will respond within the timeframes required by applicable law, and we will not discriminate against you for exercising your rights. We may need to verify your identity before acting on a request.

9. How to contact us, and how to appeal

• ChartKey LLC
  2519 S Shields Street, Suite 1K #963
  Fort Collins, CO 80526
  United States
• Privacy & rights requests: privacy@yourchartkey.com
• General: hello@yourchartkey.com

Washington State Attorney General. If we deny your request and you are not satisfied after appealing, you may submit a complaint to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.