Privacy Policy

PRIVACY AND CONSUMER HEALTH DATA

This Part is our privacy notice and, for individuals covered by the consumer health data statutes described in Section 31, our consumer health data privacy policy. It is written to be read on its own.

16. Our privacy commitments

Care Copilot helps adults organize and coordinate information relating to the care of an Elder. Depending on how a Profile is managed, an Elder may manage their own Profile; an Elder and one or more Caregivers may manage it jointly; or an authorized Caregiver may manage it for an Elder who does not use the Service.

The Service may contain highly sensitive information, including diagnosed conditions, medications, laboratory results, appointments, and uploaded medical records.

Our core commitments:

• We use health information to provide the Service requested by users.
• We do not sell Consumer Health Data.
• We do not use Consumer Health Data for targeted advertising.
• We do not permit advertising technologies in authenticated areas containing health information.
• We do not use identifiable Consumer Health Data to train general-purpose artificial intelligence models. No artificial intelligence operates in the Service at all today.
• Users control which Caregivers receive access, subject to the authority and dispute rules in Sections 7 and 26.
• Information leaves the Service only at the direction of an authorized user — and once it does, our in-app permissions cannot recall or control that copy.
• We apply access controls and other safeguards designed for the sensitivity of the information. Section 28 describes them, and describes their limits.
• We provide methods to request access, correction, export, withdrawal of consent, and deletion, subject to identity, authority, security, and legal requirements. Some of these are handled by written request rather than through a feature in the Service; Section 29 says which.

17. Relationship to HIPAA

This is not a HIPAA Notice of Privacy Practices.

HIPAA applies to certain healthcare providers, health plans, healthcare clearinghouses, and their business associates. Health information stored in a consumer-directed application is not automatically “Protected Health Information” under HIPAA merely because it concerns health.

Under the current Service model:

• users independently choose to use the Service;
• physicians and other healthcare providers do not access or operate the Service;
• we do not provide diagnosis, treatment, prescribing, telehealth, or insurance billing; and
• users independently choose whether to show or send information to their healthcare providers.

If we later provide services on behalf of a HIPAA-covered entity or business associate, receive information under a business associate relationship, or materially change our provider integrations, HIPAA may apply to some information and activities. We will update our practices and notices as required.

Regardless of whether HIPAA applies, we treat identifiable health information as sensitive Consumer Health Data under these Terms.

18. Consumer Health Data we collect

The table describes the categories we collect as the Service is currently built, the primary sources, how we use the information, and who may receive it.

Not every category is required. Users choose which information to provide, subject to what a requested feature needs.

A note on laboratory information. Laboratory results cannot currently be entered through the Service by any user. Our personnel enter them directly, from information the family provides to us outside the Service. This means a member of our staff handles laboratory information by hand as part of normal operation.

What we do not collect

Unless we separately disclose it and obtain any required permission, the Service does not collect:

• date of birth;
• Social Security numbers;
• full payment-card numbers or card security codes;
• biometric templates or facial-recognition data;
• genetic-testing data;
• precise or continuous geolocation;
• audio or video recordings of medical visits;
• provider portal or electronic health record credentials;
• insurance claims or billing records;
• psychotherapy notes obtained from a regulated provider;
• substance-use-disorder records received from a regulated treatment program;
• information used to build health-based advertising profiles;
• artificial-intelligence-generated or artificial-intelligence-extracted content of any kind (Section 23); or
• generated reports, printable summaries, or narratives (Section 24).

Users should not enter information that is unnecessary for the features they choose to use.

19. Other personal information we collect

Account and contact information. The name and email address Google provides when you sign in, and your account role. During onboarding we also collect your time zone, preferred language, how you want to be alerted, and — if you are a Caregiver — your stated relationship to the Elder. Where an Elder chooses phone check-ins, we collect that Elder’s phone number; we do not collect a phone number from anyone who does not choose that option.

Authentication and security information. A signed session cookie that keeps you logged in for up to seven days, an optional device passcode stored only as a cryptographic hash, and an audit trail of security-relevant actions.

Server logs. Our hosting provider’s standard request logs may include your IP address and browser information as part of normal web-server operation. The application itself does not read or store your IP address, device type, or browser.

Customer-support information. If you contact us for support, we collect what you send — your message, contact information, and anything needed to verify your identity or authority. Support content becomes Consumer Health Data when it reveals an Elder’s health or care. Support is provided by email; there is no in-app ticketing system.

Product and website interaction information. We do not currently operate product analytics or usage tracking of any kind, on the Website or in the Service.

20. Information collected on our public Website

This Section applies to Website Visitors, whether or not they hold an account.

We do not require an account to browse the Website, and browsing does not create a Profile or cause us to collect health information.

What we collect from Website Visitors. If you submit a form on the Website — for example, a contact, waitlist, or support form — we collect what you enter, which will typically be your name, email address, and message. Our hosting provider’s server logs may record your IP address, the pages you requested, and your browser type as part of normal web-server operation. We do not ask Website Visitors for health information, and you should not include health information in a Website form.

Cookies on the Website. The public pages of the Website do not set advertising, analytics, or tracking cookies, and we do not use third-party tag managers, tracking pixels, session-replay tools, or advertising SDKs anywhere on the Website. Cookies used in the signed-in areas of the Service are listed in Section 25. If we later add an analytics or advertising technology to the Website, we will update this Section and provide any required notice and choice before doing so.

Do Not Track. Because we do not track Website Visitors across sites, we do not respond differently to Do Not Track or Global Privacy Control signals. We do not sell or share personal information for cross-context behavioral advertising.

21. Sources of information

We collect information from:

• You, through what you enter, select, submit, or communicate to us, whether on the Website or in the Service.
• An Elder or Caregiver, when an authorized person provides information concerning an Elder or another Authorized User.
• The Service, through account activity, permissions, and audit records generated as you use it.
• Our authentication and infrastructure providers — Google for sign-in, and our cloud database, file, email, and hosting providers — used to operate the Website and the Service.
• Our own personnel, for laboratory information specifically (Section 18).
• Legal and safety sources, including valid legal process, authority disputes, incident reports, and fraud investigations, if they arise.

We do not receive medical records directly from physicians, healthcare systems, insurers, or electronic health record integrations, and we do not support calendar or contact imports, email imports, or wearable-device data. Documents reach the Service only because a member of your family uploaded them.

We use a public drug-terminology catalogue published by the U.S. National Library of Medicine to standardize medication names. No information about you or an Elder is sent to that catalogue — we hold our own copy of the public data and search it locally.

22. How we use personal information

Provide and operate the Website and the Service. Serve the Website; respond to inquiries submitted through it; create and authenticate accounts; create Profiles; administer roles and permissions; store and organize information; coordinate conditions, medications, laboratory results, appointments, and documents; and maintain the Service.

Administer caregiver authority and Elder rights. Document who manages a Profile; invite, reduce, or remove a Caregiver’s access; process permission changes; and handle reclamation, competing claims, and incapacity- or death-related requests through our manual process (Section 26).

Secure the Website and the Service. Authenticate users; enforce access controls; detect unauthorized access, fraud, malware, abuse, or incidents; investigate suspicious behavior; maintain audit records; test security; and meet incident-response obligations.

Communicate with you. We send invitation emails when someone invites a Caregiver to a Care Circle, or invites an Elder to create an account. These carry the recipient’s address, the inviter’s name, and an invitation link. They do not carry medications, conditions, laboratory values, appointments, documents, or any other health information. A shareable link is always available as an alternative, so an invitation can be passed on by whatever means the inviting user prefers. Note that an invitation to help manage a named person’s care may itself imply a care relationship. We also reply to messages you send us.

Improve the Website and the Service. We may use minimized technical information and aggregated or deidentified information to measure functionality, diagnose errors, and improve usability. We do not use identifiable Consumer Health Data for targeted advertising or to train general-purpose artificial-intelligence models.

Comply with law and protect rights. Respond to verified requests; comply with valid legal process; establish or defend legal claims; enforce these Terms; investigate misuse; protect safety and rights; and support required records or audits.

23. Artificial intelligence and automated processing

No artificial-intelligence processing is enabled in the Service at this time. We do not use artificial intelligence to extract, summarize, organize, or generate any content from your information, and no artificial-intelligence vendor receives any information from us.

If we enable an artificial-intelligence feature in the future, before doing so we will:

• update these Terms to disclose the vendor, model, purpose, and data involved;
• limit artificial intelligence to extraction and summarization, never diagnosis, prescribing, or a final authority decision;
• require an Authorized User to review generated information before it is saved, relied upon, or shared, since such information may be incomplete, inaccurate, or misleading and is not verified medical advice; and
• not permit any vendor to train a general-purpose model using identifiable Consumer Health Data.

24. How we disclose and share information

Authorized Users

We make information in a Profile available to Authorized Users according to their permissions. Depending on those permissions, a user may view, add, edit, upload, invite another Caregiver, modify permissions, or request deletion.

An Elder’s ability to exercise rights may take priority when identity and ability to act are established, subject to valid legal authority, court orders, and applicable law.

Viewing and user-directed disclosure

The Service lets an Authorized User view information on screen, subject to their permissions. There is no self-service export or download feature in the Service. You may request a copy of the information in a Profile by writing to us at support@healthsagas.com; we prepare and provide these copies manually, subject to the verification and timing described in Section 29.

We do not provide physician accounts and do not deliver information to physicians from the Service.

Once information leaves the Service — by screenshot, copy, print, or a copy we provide at your request — our permissions cannot recall it. The recipient may copy or redisclose it, ordinary email may not be secure, the recipient may not be governed by HIPAA, and these Terms no longer control that copy.

Service providers

Currently in use:

• Cloud database and file hosting (Supabase) — hosts substantially all information described in Section 18, including uploaded documents, held in a private storage bucket rather than at any public address.
• Google (sign-in only) — we receive your name and email, not your Google account contents. No information about an Elder’s health is sent to Google.
• Resend (transactional email) — delivers the invitation emails described in Section 22. No health information.
• Website hosting — serves the Website and the Service and generates the server logs described in Section 19.

We also hold a local copy of a public drug catalogue from the U.S. National Library of Medicine. Nothing about any user is sent to it.

Not currently used. Enabling any of these would require updating these Terms and approving the vendor first: content-delivery providers; any storage provider beyond the host above; SMS, push-notification, or telephony providers — including one that would be needed to deliver the Phone Call check-in an Elder can select; malware-scanning and file-processing providers; report-generation providers; artificial-intelligence and document-extraction providers; workflow and automation providers; customer-support platforms; observability, logging, and error-monitoring providers; product-analytics providers; and payment and subscription providers.

Other disclosures

Legal, safety, and rights protection. We may disclose information to comply with applicable law or valid legal process; respond to lawful government requests; protect rights, property, security, or safety; investigate fraud, abuse, unauthorized access, or incidents; enforce these Terms; resolve authority disputes; address a concern about harm to an Elder as described in Section 7.6; or establish or defend legal claims. We review legal demands for validity, jurisdiction, scope, and available user-notification rights.

Business transactions. Information may be disclosed during due diligence, financing, reorganization, merger, acquisition, sale of assets, bankruptcy, or another corporate transaction. A successor must handle Consumer Health Data consistently with applicable law and the commitments in effect, unless required notice and choice are provided.

Affiliates. We do not currently share Consumer Health Data with corporate affiliates.

With consent or at your direction. We may disclose information for another purpose when the relevant individual gives valid consent or directs the disclosure.

If we cease operations

If we decide to discontinue the Service, we will give reasonable advance notice by email and on the Website, provide a period during which you may request a copy of the information in a Profile, and then delete or deidentify information in accordance with Section 27 and applicable law.

25. Sale, advertising, cookies, analytics, and tracking

We do not sell Consumer Health Data for monetary or other valuable consideration, and we do not condition access on an authorization to sell it.

We do not use Consumer Health Data for targeted advertising, to create advertising audiences, or to build unrelated commercial profiles.

We do not permit advertising pixels or advertising SDKs in authenticated areas that contain or reveal health information, and we do not permit third parties to collect Consumer Health Data across unrelated websites or services for targeted advertising.

Cookies. We use a small number of first-party cookies in the signed-in areas of the Service, all strictly necessary to operate it: a signed session cookie that keeps you logged in; a device cookie, set only if you enable passcode quick-unlock, marking a browser as one that has completed a full sign-in; a short-lived cookie that remembers whether you have been shown a one-time notice after signing in; and a signed administrative-session cookie for our own personnel. None is used for tracking, advertising, or analytics. Cookies on the public Website are addressed in Section 20. We use no third-party cookie, tracking pixel, or similar technology anywhere on the Website or in the Service.

Analytics and observability. We do not currently operate product analytics, crash reporting, or session replay.

26. Caregiver-managed Profiles and information about another person

A Caregiver may provide information about an Elder only when the Caregiver represents that they have permission or other lawful authority.

Before a Caregiver can create or manage a Profile for someone else, we ask them to make that representation explicitly and on the record. We collect and retain: the basis of authority selected; a description in their own words where they select “other”; their stated relationship to the Elder; whether they say the Elder is able to use the Service; whether they say the Elder gave permission; their name, typed as an electronic signature; the date and time; and the version of the authority terms accepted.

We do not verify these representations, and we make no medical or legal determination. We rely on what the Caregiver tells us. What we can do is record precisely what was represented, by whom, and when.

Where a Caregiver represents that an Elder is not able to use the Service, that Caregiver receives access immediately rather than waiting for the Elder to grant it. We record that this representation was made.

For higher-risk situations — an authority dispute, Elder reclamation, full-Profile deletion, or action after death — see Section 7.5. These are handled manually, and we may request additional identity or authority information as part of that process.

27. Retention

We retain information only as long as reasonably necessary for the purposes for which it was collected, including to provide the Service, maintain security and auditability, administer permissions and authority, comply with law, process requests, maintain financial records, resolve complaints, enforce agreements, and establish or defend legal claims.

In general:

• Active accounts and Profiles, and the health records in them — conditions, medications and doses, laboratory results, appointments, providers, daily check-ins, and uploaded documents — are retained while the account or Profile is active and needed for the Service, and until removed or deleted through the process in Section 36.
• Authority, permission, and consent records are retained after an account closes, for a period reasonably necessary to document what access existed, what a Caregiver represented, and what each person accepted, and to establish or defend legal claims.
• Audit and security records and support records are retained for a limited period after the relevant activity or case, for security, accountability, and dispute-resolution purposes.
• Billing and tax records, once any exist, are retained for the period required by applicable tax and accounting rules. No payments are processed today.
• Backup copies expire on a rolling basis according to our then-current backup configuration.
• Legal holds — where a valid legal hold applies, information subject to it is retained until the hold is released, which suspends every other period above.
• Deidentified or aggregated information may be retained only where it cannot reasonably be linked back to an individual.

After an approved deletion request, we remove or deidentify information from active systems according to our deletion process. Information in backup copies may remain until those copies expire in the ordinary course. We do not use deleted backup information for normal operations, and our restoration procedures are designed to prevent deleted information from returning to active use. Where applicable law establishes a shorter maximum retention period, we follow it.

28. Security

We maintain administrative, technical, and physical safeguards designed to protect information appropriate to its sensitivity. Our controls include unique individual accounts; role- and object-level access permissions enforced on our servers for every request; audit logging of material actions taken by Elders and Caregivers; encryption in transit and at rest; private storage for uploaded files, reachable only through short-lived signed links; individually attributed administrative sign-in against a restricted list; and attempt-limiting and lockout on the optional device passcode.

Limits you should know about. No system is completely secure, and we describe our safeguards rather than promise a result. In particular:

• We do not scan uploaded files for malware or malicious content, and we do not inspect the contents of a file to confirm it is the type it claims to be. A file uploaded to a Profile may be opened by other members of that Care Circle.
• We do not control your Google account, and the security of your access depends on the security settings you apply to it.
• Information you print, screenshot, forward, or ask us to send you leaves our safeguards entirely.

You should protect your credentials, use secure devices, avoid sharing accounts, review Caregiver permissions, verify recipients, and understand that information you print or screenshot may be accessible to anyone with access to that device, email account, printer, or physical copy.

If we identify a security incident, we will investigate and provide notices to affected individuals, regulators, or others when required by applicable law.

29. Your privacy rights and choices

Depending on where you live and the information involved, you may have the right to:

• confirm whether we collect, use, share, or sell Consumer Health Data;
• access personal information concerning you;
• obtain information about third parties or affiliates receiving Consumer Health Data;
• correct inaccurate information;
• obtain a copy of your information in a portable form, where applicable;
• withdraw consent for future collection or sharing that relies on consent;
• request deletion, subject to permitted exceptions;
• review, reduce, or entirely remove a Caregiver’s access to your Profile where you have authority;
• opt out of applicable sale, targeted advertising, or profiling — although we do not sell Consumer Health Data or use it for targeted advertising;
• appeal a refusal where applicable; and
• exercise rights without unlawful discrimination.

How these rights work in practice. Some of these you can exercise yourself inside the Service, and some you exercise by writing to us.

• In the Service, at any time: viewing and correcting information in a Profile you have permission to edit; and reviewing, reducing, or removing a Caregiver’s access, including removing a Caregiver from the Care Circle altogether. These take effect immediately for future access.
• By written request, which we handle manually: obtaining a copy of your information; withdrawing consent; deleting an account or a Profile; obtaining the list of recipients; and appealing a denial. There is no self-service button for these, and we do not want to imply otherwise. We handle each request by hand, within the period required by applicable law.

How to submit a request. By email to support@healthsagas.com, or by writing to the address in Section 40. You do not need to create an account solely to submit a request.

Identity and authority verification. We must reasonably verify the requester’s identity, the Profile and information involved, and — when a person acts for another — their authority. We may request additional information reasonably necessary for verification and will not use it for unrelated purposes. If we cannot reasonably authenticate identity or authority, we may deny or limit the request and explain the basis where required.

Requests concerning an Elder. An Elder may submit a request concerning themselves. A Caregiver or representative may submit one when they have the required permission or legal authority. Routine access authority may not be sufficient for full deletion, control transfer, or action after death.

Timing, fees, and appeals. We respond within the period required by applicable law, and may extend it where permitted with notice. We generally do not charge. Where allowed, we may charge a reasonable fee or decline a manifestly unfounded, excessive, or repetitive request. To appeal a denial, write to support@healthsagas.com with “Appeal” in the subject line; we will respond in writing and, where required, tell you how to contact the applicable regulator or attorney general.

30. Consent and withdrawal

We request affirmative consent before collecting or sharing certain Consumer Health Data. A consent request identifies the categories, purpose, use, recipient categories where applicable, and how to withdraw.

Consent to collect is not consent to sell. We do not sell Consumer Health Data. Where required, consent to share will be separate from consent to collect.

To withdraw consent, write to us at support@healthsagas.com. We handle withdrawal requests manually; there is no self-service control in the Service. Withdrawal applies to future processing that relies on the withdrawn consent. It does not necessarily reverse completed processing, recall information already provided to you or another recipient, or require deletion of records we retain for security, legal, dispute, or recordkeeping purposes. If withdrawal prevents processing necessary for a requested feature, that feature may no longer be available to you.

31. State-specific consumer health disclosures

This Section applies only to the extent the stated law covers the relevant individual, company, information, and processing.

Washington. For Washington consumers, Part B of these Terms is our Consumer Health Data Privacy Policy under Washington’s My Health My Data Act. Subject to the law’s scope and exceptions, Washington consumers may have rights to confirm collection, sharing, or sale; access Consumer Health Data; receive recipient information; withdraw consent; request deletion including required processor and backup handling; appeal a refusal; and exercise rights without unlawful discrimination. We do not sell Consumer Health Data.

Nevada. For Nevada consumers, Part B provides the consumer health privacy disclosures required by Nevada law, including categories and sources, processing purposes, categories shared, recipient categories, request and correction processes, material-change notice, cross-site collection practices, and the effective date. Subject to the law’s scope and exceptions, Nevada consumers may have rights to confirm collection, sharing, or sale; receive third-party recipient information; request that collection or sharing cease; request deletion; correct information; and appeal certain refusals. We do not sell Consumer Health Data.

Other U.S. states. Residents of other states may have additional rights concerning personal information or sensitive data, including access, correction, deletion, portability, consent withdrawal, opt-out, authorized-agent, or appeal rights. We process verified requests according to applicable law.

32. Children’s privacy

The Website and the Service are intended for adults and are not directed to children under 13. We do not knowingly collect personal information directly from a child under 13.

If you believe a child created an account or provided information without required authorization, contact support@healthsagas.com and we will take appropriate action, including deleting the information.

Caregivers should not create Profiles for children or upload information concerning minors unless the Service expressly supports that use and applicable requirements have been addressed.

PART C — LEGAL TERMS

33. Disclaimers

THE WEBSITE AND THE SERVICE ARE PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT.

WE DO NOT WARRANT THAT THE WEBSITE OR THE SERVICE WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, THAT DATA WILL NOT BE LOST, OR THAT INFORMATION IN THE SERVICE IS ACCURATE, COMPLETE, OR CURRENT. Information in the Service is entered by users; we do not verify it.

WE MAKE NO WARRANTY REGARDING ANY HEALTH OUTCOME.

Some jurisdictions do not allow certain warranty exclusions, so parts of this Section may not apply to you.

34. No monitoring, no alerts, and no duty to act

This Section is important. Please read it.

The Service does not monitor anyone. It does not watch for missed medications, abnormal vital signs, worrying symptoms, missed check-ins, dangerous drug interactions, medical emergencies, or any other condition. It does not evaluate the information in it.

The Service does not alert anyone automatically. It will not call, text, email, page, or otherwise notify you, another Caregiver, an Elder, a physician, a pharmacy, an emergency contact, or emergency services if something appears wrong, if a dose is recorded as missed, if a check-in is not completed, or if a value falls outside a reference range. A displayed reference range is general reference information, not an assessment of any person.

We have no duty to act on any information in the Service, no duty to review it, and no duty to detect or report anything reflected in it. Recording information in the Service does not put us on notice of anything, and does not transfer responsibility for an Elder’s care to us.

You remain responsible for the care of the Elder. The Service is a place to write things down and share them with people you choose. It is not a caregiver, a clinician, a monitoring service, or a safety net. Do not use it, or allow anyone else to use it, as a substitute for direct attention to the Elder’s condition, for professional care, or for emergency services.

In an emergency, call 911 or your local emergency number. Do not record information in the Service and expect anyone to see it.

35. Limitation of liability and indemnification

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE WILL NOT BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST DATA, OR LOSS OF GOODWILL, ARISING FROM OR RELATING TO THE WEBSITE OR THE SERVICE.

OUR TOTAL LIABILITY ARISING FROM OR RELATING TO THE WEBSITE OR THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR (B) $500.00.

Nothing in these Terms limits liability that cannot be limited by law.

Indemnification. You will indemnify, defend, and hold harmless Health Sagas LLC and its members, managers, officers, employees, and agents from and against any claims, demands, investigations, losses, damages, liabilities, and expenses (including reasonable attorney’s fees and the costs of responding to a regulatory inquiry) arising from or relating to: your use of the Website or the Service; Your Content; your breach of these Terms; your representations about your authority to act for an Elder; your disclosure of information to others; and any claim by an Elder or another person concerning your access to or use of a Profile.

You will promptly notify us of any matter subject to this indemnity and will cooperate with us in its resolution. We may assume control of the defense and settlement of any such matter with counsel of our choosing, at your expense, and you will not settle any matter in a way that imposes any obligation or admission on us without our prior written consent. This indemnity survives termination of your account and of these Terms.

36. Suspension, termination, and deletion

By you. You may stop using the Website or the Service at any time. To close your account or delete a Profile, write to us at support@healthsagas.com. We handle these requests manually; there is no self-service deletion control in the Service.

By us. We may suspend or terminate your access if you breach these Terms, if we are required to by law, if there is a credible authority dispute or safety concern, or if we discontinue the Service. Where practical we will give notice.

Effect. On termination your license ends and your access stops. Information is retained and deleted according to Section 27.

Removing a Caregiver. An Elder can reduce a Caregiver’s access feature by feature at any time, and can remove a Caregiver from the Care Circle altogether. Both take effect immediately for future access, and both are done inside the Service. When a Caregiver is removed we keep a record that the link existed and what access it carried, as part of the permission history described in Section 18 — this is what lets an Elder see who has had access over time, and lets a removed Caregiver ask to reconnect, which the Elder may approve or decline. Neither reducing nor removing access can recall information a Caregiver already viewed or was given a copy of.

Terminating a Caregiver’s access does not delete the Elder’s Profile, which belongs to the Elder.

Deletion of a Profile. A verified Elder may request deletion. A Caregiver may request full-Profile deletion if they have sufficient authority. Enhanced verification may be required where the Elder is incapacitated, did not create an account, is deceased, where another person disputes the request, or where all information would be permanently removed.

Records retained after deletion. Limited records survive a completed deletion: proof that a versioned notice was accepted; proof of what a Caregiver attested to; audit events with the actor anonymized; and a record that the deletion occurred. Deleted content will be deleted upon the next 30 day backup at which point data other than limited records may be deleted. No health content is retained — not medications, doses, laboratory results, appointments, documents, daily entries, or conditions.

We cannot delete or recall information from a user’s device, email account, printer, physician’s office, family member, or other external recipient after it leaves the Service.

37. Changes to these Terms

We may update these Terms for changes in the Website, the Service, law, technology, vendors, or practices. We will post the updated Terms with a revised date.

If a change is material, we will provide notice — by email, in the Service, by notice on the Website, or by requiring acceptance before continued use — and will state the effective date. For material changes affecting Service Users, we will obtain your acceptance of the updated Terms before you continue to use the Service. For Website Visitors, continued use of the Website after the effective date means you accept the updated Terms.

Where required, before collecting, using, or sharing new categories of Consumer Health Data, or using existing information for a materially new purpose, we will provide the required disclosure and obtain affirmative consent.

We maintain a version record of these Terms and of your acceptance. You may request a copy of a prior version by writing to support@healthsagas.com.

38. Governing law, venue, and jury waiver

Please read this Section carefully. It affects how, where, and in what forum any dispute between us must be resolved, and it includes a waiver of your right to a jury trial.

38.1 Governing law

These Terms, and any dispute arising out of or relating to these Terms, the Website, or the Service, are governed by the laws of the State of Georgia, without regard to its conflict-of-laws rules.

38.2 Informal resolution first

Before filing any action, you agree to contact us at support@healthsagas.com, describe the dispute in reasonable detail, and attempt in good faith to resolve it informally for at least thirty (30) days. This requirement does not limit either party’s ability to seek injunctive relief to prevent immediate and irreparable harm.

38.3 Exclusive venue

For purposes of this Section, the “Principal County” means Fulton County, Georgia, the county of Health Sagas LLC’s principal place of business, or, if that principal place of business changes, the Georgia county in which it is then located.

In this Section, a “claim at law” means a claim seeking only monetary damages or other relief available at law, and a “claim in equity” means a claim seeking equitable relief, including injunctive relief, specific performance, rescission, reformation, an accounting, a declaratory judgment requiring equitable powers, or the imposition of a constructive or resulting trust.

Any action, claim, or proceeding arising out of or relating to these Terms, the Website, or the Service must be filed and maintained exclusively in a court located in the Principal County, allocated as follows:

(a) Actions asserting only claims at law, of $15,000 or less. An action asserting only claims at law, in which the amount in controversy is fifteen thousand dollars ($15,000.00) or less exclusive of interest and costs, must be filed in the Magistrate Court of the Principal County.

(b) Actions asserting only claims at law, exceeding $15,000. An action asserting only claims at law, in which the amount in controversy exceeds fifteen thousand dollars ($15,000.00) exclusive of interest and costs, must be filed in the State Court of the Principal County.

(c) Actions asserting any claim in equity. An action asserting one or more claims in equity must be filed in the Superior Court of the Principal County. Where an action asserts both claims in equity and claims at law, all of those claims — equitable and legal alike — will be brought, tried, and determined together in the Superior Court of the Principal County.

(d) Our right to seek transfer where no equitable claim remains. If an action is filed in the Superior Court of the Principal County and asserts no claim in equity, or if every claim in equity asserted in the action is later withdrawn, dismissed, abandoned, resolved, or determined to be unavailable, Health Sagas may elect to seek transfer of the action to the State Court of the Principal County or, where the amount in controversy is then fifteen thousand dollars ($15,000.00) or less exclusive of interest and costs, to the Magistrate Court of the Principal County. You consent to that transfer, agree not to oppose or contest any motion, request, or application by us seeking it, and agree to execute and join in any stipulation, consent order, or other document reasonably necessary to accomplish it. This right is ours alone and is in addition to any right of transfer available under applicable law or court rule.

(e) Where no State Court exists or it lacks jurisdiction. If the Principal County has no State Court, or if the State Court of the Principal County lacks jurisdiction over the action or its subject matter, the action must be filed in the Superior Court of the Principal County, and subsection (d) does not apply.

Nothing in this Section limits our ability to seek injunctive or other equitable relief in the Superior Court of the Principal County at any time.

You and we each consent to the personal jurisdiction of these courts, waive any objection to venue in them, and waive any argument that they are an inconvenient forum. You agree not to file or maintain any action arising out of or relating to these Terms, the Website, or the Service in any other court or forum. You further agree not to assert a claim in equity, or to characterize a claim as one in equity, for the purpose of avoiding the allocation in subsections (a) and (b).

38.4 Waiver of jury trial

YOU AND HEALTH SAGAS EACH KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVE ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION, CLAIM, OR PROCEEDING ARISING OUT OF OR RELATING TO THESE TERMS, THE WEBSITE, OR THE SERVICE, WHETHER SOUNDING IN CONTRACT, TORT, STATUTE, OR OTHERWISE. Each party acknowledges that it has had the opportunity to consult counsel regarding this waiver, that this waiver is a material inducement to entering into these Terms, and that this waiver applies regardless of which party initiates the action.

38.5 Time limit for claims

To the extent permitted by law, any action, claim, or proceeding arising out of or relating to these Terms, the Website, or the Service must be filed within one (1) year after the claim accrues, or it is permanently barred.

38.6 Severability within this Section

If any provision of this Section 38 is held unenforceable, that provision will be severed and the remainder of this Section will continue in full force.

39. General

• Entire agreement. These Terms, including Part B, are the entire agreement between us regarding the Website and the Service, and supersede any prior understanding on the same subject.
• Severability. If a provision is unenforceable, the rest remains in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.
• No waiver. Our failure to enforce a provision is not a waiver of it.
• Assignment. You may not assign these Terms or any rights under them. We may assign them in connection with a merger, acquisition, reorganization, or sale of assets.
• No third-party beneficiaries. These Terms create no rights in any person other than you and us, except that the persons identified in the indemnity in Section 35 may enforce it.
• Force majeure. We are not liable for delays or failures caused by events beyond our reasonable control.
• Survival. Sections 8, 9, 13, 27, 33, 34, 35, 36, 38, and 39 survive termination of these Terms and of your account.
• Notices. We may give notice by email to your account address, by notice in the Service, or by posting on the Website. Notices to us must be sent to support@healthsagas.com and, for formal legal notices, to the mailing address in Section 40.
• Relationship. No agency, partnership, employment, or joint venture is created by these Terms.
• Headings. Headings are for convenience only and do not affect interpretation.

40. Contact

The entity responsible for these Terms, including the privacy notice in Part B, is:

Health Sagas LLC, a Georgia limited liability company

Mailing address: 1870 The Exchange SE, Ste. 220, #851729, Atlanta, Georgia 30339

General and support: support@healthsagas.com

Legal: support@healthsagas.com

Privacy and privacy requests: support@healthsagas.com

Security: support@healthsagas.com

Website: www.healthsagas.com