This notice covers consumer health data in the caregiver app, as required by Washington’s My Health My Data Act and comparable state laws. The equivalent notice for this website is the Website Consumer Health Data Privacy Policy.
FlourishBx Caregiver App — Free Accounts
FlourishBx LLC d/b/a FlourishBx
Effective Date: 25 October 2026 Last Updated: 25 October 2026 Version: 1
1. WHAT THIS DOCUMENT IS
This is FlourishBx's Consumer Health Data Privacy Policy. It is required by the Washington My Health My Data Act and by comparable laws in other states, and it tells you what health information the FlourishBx Caregiver App collects, why, who it goes to, and what you can do about it.
It is a separate document from the FlourishBx Caregiver App Privacy Policy, and it has to be. The law requires it to stand on its own.
Where the two differ as to Consumer Health Data, this one governs.
2. WHO THIS APPLIES TO
This policy applies to you if you use the FlourishBx Caregiver App on your own, with no provider connected — a Free Account.
It does not apply if a BCBA, therapist, or clinic is connected to your account. In that case the information about your child is protected health information under HIPAA, which the My Health My Data Act does not cover (RCW 19.373.010(8)(b)), and the FlourishBx Caregiver App Privacy Policy — Accounts Connected to a Provider governs instead.
Not sure which you are? Open Settings in the app. If it shows a provider, this policy is not the one that applies to you.
FlourishBx applies this policy to every Free Account, wherever you live — not only to residents of the states whose laws require it.
3. THE CONSUMER HEALTH DATA WE COLLECT
We collect only what you type in. We do not buy it, and we do not obtain it from data brokers, social media, public records, or any other outside source.
| Category | What it is |
|---|---|
| Information about your child's behavior | The behaviors you choose to track, each behavior log you record, the strategy you tried, how it went, how long it lasted, and the time you recorded it |
| Free-text notes | Anything you type into a note. We do not read, filter or screen it |
| Information identifying your child | Their first name, and a date of birth if you choose to enter one |
| Your relationship to your child | For example parent, grandparent, respite worker |
| Your account information | Your name, email address, and password (stored only as a cryptographic hash) |
3.1 Everything in the first four rows is Consumer Health Data, because it relates to a person's mental or behavioral health status.
3.2 What we do not collect. The App does not request or use your camera, microphone, photo library, location, contacts, calendar, health data from Apple Health or Google Fit, any biometric identifier, or any advertising identifier.
3.3 No geofencing. We do not, and will not, use a geofence around any health care facility, provider's office, pharmacy or similar location. This is prohibited by RCW 19.373.100 and we commit to it everywhere.
3.4 Reminders stay on your phone. The App builds reminders on your own device. We do not send push notifications and we do not collect a push token.
4. WHY WE COLLECT IT
We collect Consumer Health Data for these purposes and no others:
- to show you your child's information;
- to save the behavior logs you record;
- to remind you to log, if you want reminders;
- to sign you in and keep your account secure;
- to answer you when you contact us;
- to operate, maintain, secure, back up and troubleshoot the App; and
- to comply with law.
4.1 What we will never do with it. We will not:
- sell it — not for money and not for anything else of value;
- share it for advertising, or use it for advertising ourselves;
- use it to train artificial intelligence or machine learning, ours or anyone else's;
- de-identify it for research, benchmarking, publication or sale;
- profile you or your child for any purpose beyond running the App; or
- make automated decisions about you or your child.
4.2 These are commitments, not descriptions of what we happen to do today. We cannot start doing any of them without changing this policy, telling you, and — where the law requires consent, which for Consumer Health Data it does — getting your consent first.
5. WHO WE SHARE IT WITH
We do not sell Consumer Health Data and we do not share it for advertising.
On a Free Account there is no clinician, so nothing you record goes to any provider, clinic, school, agency or insurer.
The only parties who process it are the companies that run our systems, on our instructions only:
| Who | What they do | What they receive |
|---|---|---|
| Google LLC (Google Cloud Platform) | Runs our servers, database, file storage and sign-in, in the United States | The data, in order to store it |
| Google LLC (Google Workspace) | Sends and receives account email such as password resets and support | Your email address |
| Supabase, Inc. | Being retired. Nothing flows there any more; the suspended project still holds records created before the move to Google, pending deletion | Only records created before the move |
| Crash diagnostics | Processed on our own servers and scrubbed of personal information before they are sent | No third-party crash reporting service is used |
5.1 Each is contractually prohibited from using it for its own purposes, from selling it, and from keeping it after the work ends. We remain answerable to you for what they do.
5.2 We may also disclose it when the law requires — a subpoena, court order or warrant — producing only what is required and telling you where it is lawful and practical to do so; where we reasonably believe it is necessary to prevent serious and imminent harm to someone; to establish or defend a legal claim; or in a merger or sale of the business, in which case the buyer must take on this policy, and we will post notice first.
5.3 No sale means no authorization is needed. A sale of Consumer Health Data would require your separate signed authorization under RCW 19.373.110. We do not sell, and we do not intend to seek such an authorization.
6. HOW LONG WE KEEP IT
| What | How long |
|---|---|
| Your child's behavior logs and record | Until you delete them, or you close your account |
| Your account information | Until you close your account, or 24 months after your last sign-in |
| Server logs | 90 days |
| Record that you made a privacy request | 24 months, so we can show we honored it |
6.1 There is no clinician on a Free Account, so there is no clinical retention duty keeping your child's record in existence. When you ask us to delete it, we can.
7. YOUR RIGHTS
All of these are exercised against us. There is nobody else to ask.
7.1 The right to know. You can ask us for a list of all Consumer Health Data we have collected about you or your child, and the identity of anyone we shared it with.
7.2 The right to withdraw consent. You can withdraw your consent to our collecting and sharing it, at any time. Withdrawing is as easy as consenting was, and we will not obstruct it or ask you to explain.
7.3 The right to delete. You can ask us to delete it, including from our backups, as RCW 19.373.080 requires.
7.4 How to ask. Write to contact@getflourishbx.com, or use the delete control in the App.
7.5 How long we take. We respond within thirty (30) days of a request under this policy, and may extend once by a further 45 days where reasonably necessary, telling you why within the first thirty.
7.6 Verification. We will check that a request really comes from you, normally by confirming to the email address on your account. We will not ask you for a government ID to answer a request about your own account.
7.7 If we say no. We will tell you why, and you can appeal by replying with the word "Appeal." A different person will review it and respond within 45 days. If we deny the appeal, we will tell you how to complain.
7.8 No retaliation. We will never deny you the App, charge you, delay you, or degrade the service because you exercised a right. The App is free and stays free.
8. HOW WE PROTECT IT
We encrypt information in transit and at rest. Access is enforced in the database itself, so a request for a record you are not entitled to returns nothing. Sessions expire. Repeated failed sign-ins are throttled. Reads of a child's record are logged, including reads by FlourishBx staff.
8.1 No system is completely secure, and we do not promise otherwise.
8.2 If a security incident affects your information we will tell you, without unreasonable delay and within the time the law requires. On a Free Account there is no clinician to notify you on our behalf — the duty is ours, directly.
9. WHERE IT IS
Our servers are in the United States, and your information is stored and processed there. The App is intended for use in the United States.
10. CHANGES
We may update this policy. The "Last Updated" date shows when.
10.1 If we make a material change we will tell you in the App and by email before it takes effect, and not less than 30 days before.
10.2 We will not apply a materially different policy to Consumer Health Data we already hold without your consent.
11. COMPLAINTS
If you are not satisfied with our response, you can complain to:
- the Washington State Attorney General, who enforces the My Health My Data Act, at atg.wa.gov/file-complaint;
- your own state Attorney General;
- the California Privacy Protection Agency, if you are a California resident; or
- the Federal Trade Commission, at reportfraud.ftc.gov.
11.1 The Office for Civil Rights is not the right place for a Free Account complaint, because it enforces HIPAA and HIPAA does not apply to a Free Account. It is the right place if a provider is connected to your account.
11.2 Washington residents may also have a private right of action under the Consumer Protection Act, RCW 19.86.090.
12. CONTACT US
FlourishBx LLC d/b/a FlourishBx Attention: Privacy
| Purpose | Address |
|---|---|
| Consumer health data requests | contact@getflourishbx.com |
| Security reports | contact@getflourishbx.com |