Consumer Health Data Privacy Policy

This policy explains how Thylib (operated by Perceptive One LLC) handles consumer health data, as defined by the Washington My Health My Data Act and similar state laws. It supplements our Privacy Policy.

Categories of consumer health data we collect

• Health records you direct us to import from your healthcare providers' patient portals: conditions and diagnoses, lab results and vital signs, medications, allergies, immunizations, procedures, diagnostic reports, clinical documents and notes, and visit/encounter records.
• An access audit log recording when your health records were viewed or queried through your account.

Purposes — why we collect and use it

• To provide the service you requested: importing, organizing, displaying, and letting you query your own records — including through the AI assistant you choose to connect.
• To secure the service and maintain a tamper-evident record of access.
• To comply with legal obligations.

We collect and use consumer health data only with your consent or as necessary to provide the service you requested. We do not use it for advertising.

Categories of sources

• The healthcare providers whose patient portals you choose to connect (for example, via Epic MyChart or other SMART-on-FHIR patient portals).
• Information you provide directly in the product.

Categories of consumer health data we share, and with whom

We share consumer health data only as follows:

• Processors acting on our instructions to operate the service: Google Cloud (hosting, storage, encryption). Our email provider (Resend) and payment provider (Stripe) do not receive health data.
• The AI provider whose assistant you connect (for example Anthropic, OpenAI, or Google) — only the records responsive to queries you yourself run, as described in the AI/LLM Data-Flow Disclosure you accept at sign-up. Records of an adult connected under provider proxy access are never sent to an AI provider until that person confirms consent themselves; until then they are viewable only by the connecting family creator.
• We have no affiliates. We share consumer health data with no other third parties.

We do not sell consumer health data, and we will not sell it without the separate, signed authorization the law requires.

How to exercise your rights

You have the right to confirm whether we collect, share, or sell consumer health data about you; to access it; to withdraw consent; and to have it deleted.

• Self-service: export or delete your data from your account page; disconnect any provider connection or the AI integration at any time.
• Email: privacy@thylib.com.
• Appeals: if we decline a request, you may appeal by replying to our decision, and we will respond as your state's law requires. Washington residents whose appeal is unsuccessful may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint.