Consumer Health Data Privacy Policy

This policy is separate from our Privacy Policy and applies specifically to consumer health data. It is provided for residents of Washington State under the My Health My Data Act, for residents of Nevada under SB 370, and for residents of any other state with comparable consumer health data laws. If you live elsewhere, we apply these practices to you as well.

Famlo is operated by The Hive Network, LLC, Lee County, Florida, USA.

1. The short version

You enter your child’s health details from your own account. The organizations your family belongs to, and any organization you register that child with, can see them, so the people running the activity can keep your child safe. Other parents cannot. The free-text fields are encrypted, and they are erased when you remove the child or ask us to erase them.

The rest of this page is that paragraph in detail, including the parts that are less tidy than the paragraph.

2. Not HIPAA Data

Famlo is not a health care provider, health plan, or health care clearinghouse, and is not a business associate of one. The health information you give us is not protected health information under HIPAA. It is protected under this policy and applicable state consumer health data laws.

3. What We Collect, and Who Sees It

You enter all of it yourself, on your child’s page or at the attendee step of checkout. We do not infer health data from your browsing, we do not buy it, and we do not derive it from any other source. Every field is optional.

Medications and dietary restrictions are on no organizer screen, but they are in the class roster download. There is a field for each on your child’s page, and no organizer screen displays either one. The roster spreadsheet an organizer can download for a class (§4.4) does have a column for each, filled in for the same people who can see the medical notes and allergy note under §4. If you would rather an organization not have them, leave them blank; you can clear either one from your child’s page at any time. We would rather tell you this than let you assume otherwise.

There is no allergy severity anywhere. A severity value can be stored alongside an allergy tag, and no screen in Famlo displays it — not to you, not to an organizer. So if how severe an allergy is matters, do not rely on a rating: write it into the allergy note.

Free-text answers are shown to organizers exactly as you typed them. Nothing is summarized, scored or interpreted.

These fields can also leave Famlo in two downloads an organizer can make for a class, both described in §4.4: the registration-forms download, which carries the fields marked “Yes” above but not medications or dietary restrictions, and the class roster spreadsheet, which carries the allergy note, medical notes, medications, dietary restrictions and the emergency contact. Signed agreements (waivers and permissions) are not health data and carry none.

4. Who Can See It

One rule governs the four safety fields — the allergy note, medical notes, the special-needs note described in §7, and the emergency contact. A person can see those only if one of these is true:

• They are the account holder on the child’s own family.
• They hold an organizer role in an organization your family currently belongs to.
• They hold an organizer role in an organization the child currently has an active registration with.

“Organizer role” means someone the organization has given its school settings (the owner or a co-leader), all of its classes (a class organizer), or check-in for every child (front desk). A teacher whom the organization has limited to their own classes counts too, but only for children registered in a class they are assigned to teach. It does not mean every member. Other parents in your co-op cannot see those four fields, and neither can someone whose only access is to the organization’s money (a bookkeeper) or to approving families who ask to join.

Access follows current standing. Leave an organization and its organizers stop seeing your child. Cancel or refund a registration and the organizers of that activity stop seeing your child, unless your family is still a member of that organization.

A registration does not lapse on its own. It counts as active while it is confirmed, or once the child has been marked as attended, and nothing about the date of the activity narrows that. An organization you registered with for a single class keeps this access after the class is over, until the registration is cancelled or refunded, or you leave and ask us to remove it. That is what the software does; we would rather publish it than publish an expiry we have not built.

4.1 What is not covered by that rule

These parts of a child’s record are shown to anyone who can open the management console of an organization the child is currently registered with. That includes people whose only access is to the organization’s money or to approving families, who are refused the four fields above:

• The child’s name, age, grade level and your family name
• Your own name and phone number, as the guardian
• The list of people authorized to collect the child, and your pick-up note
• Your photo answer
• Which of that organization’s activities the child is enrolled in, and their attendance

We separate these out rather than folding them into the rule above, because the rule does not reach them. Saying “everything about your child is gated” would be the easier sentence and the false one.

4.2 Reveals are recorded

On the management console, the allergy, medical, emergency-contact and pick-up panels start hidden, and an organizer has to press a button to reveal them. Each reveal is recorded with the organizer’s name, the time, the child, and which panel — never the value itself, because an audit log holding “peanut” would be a second, longer-lived copy of the thing it exists to protect. Activity rosters and check-in sheets are not hidden this way; those show the allergy line directly to the organizers who open them.

4.3 Outside Famlo

One other party holds this data: Amazon Web Services, where our database, file storage and outbound email run. AWS processes it on our behalf under contract and may not use it for its own purposes. Our other vendors do not receive consumer health data at all — Stripe handles payments, Mapbox geocodes addresses, and our analytics and error-reporting paths are blocked in code from receiving health fields, as described below.

We have never sold consumer health data, and we will not. We do not share it with advertisers, data brokers, or analytics providers. Our analytics and error-reporting code refuses, by property name, to send anything named as a medical, allergy, special-need, accommodation, medication, dietary, birthdate, date-of-birth, diagnosis or emergency-contact value, or as a child’s name, age, date of birth or family member; outside production that refusal raises an error at the call site rather than dropping the value quietly. It is a guard on names, so it cannot catch a child’s name typed into some other free-text value, and we would rather say so than claim it is airtight.

Organizers are bound by Terms Section 39, which requires them to use what they see only to manage their group’s activities and ensure participant safety, not to share it with unauthorized third parties, to implement reasonable security, to notify us promptly of any incident, and to delete or return member data on request or when a member leaves the group. That is a contractual obligation on them; it is not something we can enforce technically once a person has read a screen.

4.4 Exports

An organizer can download a registration-forms PDF for a class: one page per child, so the people running it have a paper copy for a field trip or a day without signal. It contains only: the class and its schedule; the registration status and date; the child’s name, age and grade; your family name; the allergy note, “No known allergies”, or “Allergy recorded” where only a tag is ticked; medical notes; the free-text special-needs note; the emergency contact; the parent or guardian’s name and phone; the people allowed to pick the child up and your pick-up note; your photo answer; your answers to that class’s registration questions; the status of each agreement for the class; that Famlo’s terms were accepted at checkout; and attendance so far. Medications and dietary restrictions are not in it, and neither is the date of birth, any allergy severity or tag name, your email address, your home address, or any payment detail.

• Who can create it. Only someone who passes the rule in §4 for every child on it. One child they may not see refuses the whole download. A teacher limited to their own classes can make it only for those classes.
• Re-authentication. They confirm their password or an emailed code right before creating it.
• Delivery. It is built on our servers into private storage encrypted with a key kept for these downloads alone, and the link is sent by email, never as an attachment. Opening it requires signing in, and the rule in §4 is checked again at that moment, so someone who has lost access since cannot open it.
• Expiry. The link and the file expire 72 hours after it is ready, and the file is deleted then.
• Audit. Each download is recorded — who made it, when, from where, and which children by record number, never the values — and every opening of it is recorded too. Building it also records, for each child, that their safety details were seen.
• Owner notice. The organization’s owner is emailed whenever someone else creates one.
• Watermark. Every page is marked confidential, with who downloaded it and when.

An organizer can also download a class roster spreadsheet, one row per registration, for the door and for reconciling payments. Besides the registration, payment and agreement details, the child’s name, age and grade, and your name and email, it has a column each for the allergy note (or “None known”), medical notes, medications, dietary restrictions, and the emergency contact’s name, phone and relationship. Those health columns are filled in only for someone who passes the rule in §4 for that child; anyone else who can open the roster, such as a teacher who only takes the register, gets “Not shared” in them. It downloads straight to their device, without the extra steps above, and each download is recorded, for each child, as their allergy, medical and emergency-contact details being seen.

Once an organizer has saved or printed a copy, it is in their hands, under the obligations in Terms Section 39. We cannot recall it, and we say so rather than imply we can.

5. How Long We Keep It

While the child is on your account, we keep whatever you have entered, so the next organizer sees it without you retyping it.

When you remove a child, or ask us to erase their health data, a job that runs daily erases it 31 days later: the allergy note and tags, the “no known allergies” answer, medical notes, the special-needs note and tags, medications, dietary restrictions, emergency contact name, phone and relationship, your pick-up note, and the list of people authorized to collect the child. Copies already inside our encrypted database backups are not edited; those backups expire on their own, the last of them 12 months later. There is one exception, and it is deliberate: if the child is still registered for an activity that has not happened yet, the erasure waits until after that activity, so an organizer is not left running a field trip without an allergy they were told about.

A registration-forms download (§4.4) is deleted 72 hours after it is ready. Erasing a child’s health data does not reach a copy an organizer has already saved.

You can also clear a field yourself, at any time, from your child’s page: the allergy note and tags, medical notes, the special-needs tags, medications, dietary restrictions, the emergency contact, the pick-up list and note, and the photo answer.

6. How We Protect It

• All stored data is encrypted at rest by our database provider.
• These fields carry a second layer of encryption inside the application, so they are unreadable even to someone holding a database dump: the allergy note, medical notes, the special-needs note, medications, dietary restrictions, and the pick-up note.
• Emergency contact name, phone and relationship are not covered by that second layer — they rely on the storage-layer encryption alone. We would rather say so than imply a protection that is not there. Fixing it is tracked internally.
• Who may read the four safety fields is decided by the rule in Section 4, checked in one place that every screen showing them calls. What Section 4.1 lists is not checked that way.

7. Your Rights

You have the right to:

• Know what consumer health data we hold about your child, and who it has been shared with
• Correct it — the allergy note and tags, medical notes, the special-needs tags, medications, dietary restrictions, the emergency contact, the pick-up list and note, and the photo answer are all editable on the child’s page
• Delete it — we erase it from Famlo 31 days after you remove the child or ask us to. Copies already inside our encrypted database backups are not edited; those backups expire on their own, the last of them 12 months later.

One honest limitation, so you do not have to discover it. Besides the special-needs tags you tick, a child’s record carries a separate free-text special-needs note, and three organizer screens display it. Nothing in Famlo writes to that note and no screen shows it to you, so for a child added through this app it holds nothing — but we will not promise you that a record carried over from the previous version of Famlo is empty there. Email us and we will tell you exactly what it says, or clear it. It is the one place where an organizer could read something about your child that your own page does not show you, and we are building the missing field so this paragraph can be deleted.

Exercise any of these from your child’s page, or email support@famlo.co with the subject line "Health Data Request." We will respond within 45 days. If we deny a request you may appeal it at no cost by replying with the subject line "Health Data Appeal"; if we deny the appeal, we will tell you how to complain to your state Attorney General.

Washington residents may contact the Washington Attorney General at atg.wa.gov/file-complaint.

8. Contact

The Hive Network, LLC
Email: support@famlo.co
Jurisdiction: Lee County, Florida, USA