WhatsInYourMeds Consumer Health Data Policy

This policy explains what health information WhatsInYourMeds collects, why we collect it, who can get it, and how you can see it, take back your consent, or delete it.

This policy is from ExciIQ LLC, an Ohio limited liability company ("we" or "us"). It covers the WhatsInYourMeds app at app.whatsinyourmeds.com and the website at whatsinyourmeds.com (together, the "Service"). It is a separate document from our Privacy Policy, which covers all of your information. Some state laws, such as Washington's My Health My Data Act, ask for a separate policy about health data. Where both policies speak to your health information, this one gives the detail. We apply it to everyone who uses the Service in the United States.

1. WHAT WE MEAN BY HEALTH INFORMATION

Consumer health data is information that links to your health or to the medicines you take. On WhatsInYourMeds, that means your medicine list and the records tied to it. In this policy we call it "health information".

2. THE HEALTH INFORMATION WE COLLECT, AND WHY

This is what we collect to give you the Service you asked for.

• The medicines you add. For each one, we store its FDA label codes (the set ID and the NDC), the label version you are on, and the date you added it. We use this to show you the ingredients its FDA label lists, and to tell you when the label changes. We don't ask for doses or schedules.
• Label-update records. We store your choice about label-update alerts, and which notices you have seen or dismissed. We use them to show you updates and to stop showing the same one twice. When you move a medicine to a newer label version, we also log the move: the medicine's codes, the two label versions, and the time, under your list's code. Removing a medicine doesn't remove this history.
• Sharing records. When you share a view or send a copy, we store a record of the link or code. For a copy code, we also store a saved copy of your list as it was when you made the code. Removing a medicine from your list doesn't change that saved copy. We use these records to run the sharing you asked for, and to end it when you ask.
• What you search for. The medicine names, NDC or imprint you type are sent to our servers to find results. We don't save your searches to your account. They can appear in our server logs, with your IP address.
• Daily counts. We count how many searches and label look-ups each account makes each day, under your account code. We use the counts to spot automated copying of our data. They don't say which medicines you looked up.
• Server logs. Our servers log each request: the time, your IP address, the web address requested, and the result. The web address can include your list's code, a medicine's FDA codes, or the words you searched for. If an account's counts look like automated copying, an alert line can include the account code. Fly keeps them for a short time. We don't send them anywhere else.
• Ingredient lists and tables. You don't give us these. We work them out from the public FDA label data we hold, when you open a screen. We don't save them as a record about you.
• Your private notes. If you add a note to a medicine, it stays in your browser's storage on your device. We don't receive it. It is never shared or sent to anyone. Signing out or deleting your account in the app clears them on that device.

We keep your medicine list under a random account code, not your name. We don't copy your sign-in email into our database. Our sign-in provider, Clerk, holds your email address and gives us the account code. Our team can match a code to an email using Clerk's records, so we can handle a request from you.

We use your health information to run the Service, keep it secure, and follow the law. We don't use it for advertising. We don't sell it. We don't use it to build profiles about you. We don't infer or record a diagnosis or a health condition for you.

3. WHERE IT COMES FROM

• From you. You choose the medicines you add.
• From public FDA label data. We match your choices to it to show ingredients.
• From your device and browser. Your IP address and the details of each request reach our servers.

We don't get health information about you from pharmacies, doctors, insurers, or data brokers.

4. YOUR CONSENT

We collect your health information to give you the Service you asked for. When you accept the Terms and add a medicine to your list, you ask us to do that.

Sharing needs a separate OK. Each kind of sharing has its own screen. The box on it is never ticked for you, and it is never part of signing up. You must tick it yourself before you can share. Each screen lists these points.

The "Let someone view your list" screen lists:

• Anyone with this link can see your med list and its ingredient lists.
• They see your meds and ingredients only.
• They must sign in to WhatsInYourMeds to open it.
• They can look, but they can't change anything.
• They see your list as it is today, and as it changes.
• Your private notes are never shared.
• You can stop sharing at any time.

The "Send a copy to your care team" screen lists:

• Your care team opens it in ExciIQ, our app for health professionals.
• Anyone with this code and a professional account can open the copy. Give it only to your care team.
• This sends a copy of your med list and its ingredient lists.
• Your private notes are not included.
• It's a copy. Changes you make later won't reach your care team.
• If you delete your account, their copy is not deleted.
• The code works once. It expires in 72 hours.
• You can cancel until your care team opens it. After that, you can't take it back.

We can't take back what someone already saw. Please share only with people you trust.

To take back your consent:

• Stop a live view in the app. They lose access right away.
• Cancel a copy code in the app before it is opened.
• Remove a medicine from your list in the app.
• Delete your account in the app, as in Section 7. That ends our collection of your health information.

5. WHO GETS YOUR HEALTH INFORMATION

We share health information in only these ways.

• People you choose. A viewer you share with sees your medicines and their ingredients. A care team professional you send a copy to gets the saved copy of your list. We don't keep a record that ties the copy to the professional who opened it. After they open it, the copy belongs to them and is kept in their records, under their own rules. They may add details of their own to it.
• Companies that help us run the Service. They may use your health information only to do that work for us. Neon hosts our database, so it holds the records in Section 2 that we keep in our database, under your account code. It never receives your private notes. Fly.io runs our servers, so it sees the medicine codes and search words in each request, along with your IP address. Cloudflare hosts the app and the website, so it sees page addresses, which can include a medicine's FDA codes, along with your IP address. Clerk, our sign-in provider, gets no health information from us: the addresses we send it when you sign in carry no medicine codes or share codes. It holds your email address and sign-in records. Google Workspace hosts our email, so it handles messages you send us. All of these companies work under their standard data-processing terms, and the Privacy Policy lists them.
• The law. We may share it when the law requires, such as a valid court order, or to protect people from serious harm. Where the law allows, we will tell you first.
• A buyer. If we sell or merge our business, your information may go to the new owner. We will tell you before that happens, and you can delete your information first.

We don't sell health information. We don't share it with advertisers, data brokers, social media companies, or analytics companies.

The categories of third parties are the people you choose, the service providers above, and public authorities when the law requires. We share your health information with no affiliate.

If you live in Washington, you can ask us for a list of all the third parties and affiliates we have shared your health information with, and an active email address or other online way to contact each one. Email us at the address below.

6. NO LOCATION FENCES

We don't ask your device for your location. We don't set up a virtual boundary around any place to collect health information, to send you messages, or to track you.

7. ACCESSING AND DELETING YOUR HEALTH INFORMATION

You have these rights, wherever you live in the United States:

• Know. Ask whether we collect your health information.
• Access. See your medicine list in the app at any time. You can also ask us for a copy of what we hold about you, and for the list of third parties.
• Withdraw consent. See Section 4.
• Delete. You can remove a medicine in the app at any time. To delete your account and your health information, open Me in the app and choose "Delete my meds and my account". We ask you to confirm. The app then removes your medicine list, label-update records, sharing records, daily counts and account code from our database. It also deletes your account with our sign-in provider. If you can't use the app, email legal@exciiq.com from the email address on your account. We will delete your account with our sign-in provider, which sets off the same removal from our database. We will act on a request within 45 days.

What deleting does not reach:

• If you only remove a medicine, its label-update records stay, and so does the saved copy in a copy code, until you delete your account.
• A copy a care team has already opened. It is in their own account. Please ask them to delete it.
• Your Terms record, which we keep so we can show that our agreement was made.
• Server logs, and backups, branches and snapshots of our database, until they expire. We delete from them no later than 6 months after your request. If we ever restore one, we delete your information again before the Service uses it.
• Private notes and display choices on other devices and browsers. The app clears your private notes on the device where you sign out or delete. Clear your browser's site data to remove the rest.

If we say no to a request, tell us why you disagree. We will review it and answer within 45 days. You may also contact your state attorney general. We will not treat you worse for using these rights.

8. HOW LONG WE KEEP HEALTH INFORMATION

• Your medicine list, label-update records, sharing records and daily counts: until you remove them or delete your account. Label-update records stay after you remove a medicine until you delete your account.
• Server logs: kept by Fly for a short time. We don't send them elsewhere.
• Backups and copies: our database provider keeps backups and history for a short time. A branch or snapshot of the database we make for testing or recovery is a copy too.
• If you cancel a copy code, or it expires, the saved copy of your list stays with the code record until you delete your account.
• A copy a care team has opened: it belongs to them.

9. SECURITY

We use encrypted HTTPS connections. We keep identity and health information apart: your email lives with our sign-in provider, and your medicine list lives under a code. Database rules limit each account's records to that account. The link or code is shown to you once when you make it, and we keep only a scrambled copy (a hash). Unused sharing codes expire. No system is perfectly secure, so we can't promise that nothing will ever go wrong.

If your health information is exposed without your OK, we will notify you as the law requires, without unreasonable delay and no later than 60 days after we find out. We will also tell the Federal Trade Commission and others as the law requires.

10. WHO CAN USE THE SERVICE

The Service is for adults who are 18 or older and live in the United States. We don't knowingly collect health information from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it.

11. CHANGES

We may update this policy. We will post the new version, and change the date at the top. We will ask for your consent again before we collect a new kind of health information, or use it in a new way. We will ask you to accept the new Terms before you keep using the Service.

12. CONTACT

Questions about this policy, or requests about your health information.

By mail: ExciIQ LLC, 6545 Market Ave. North, Ste 100, Canton, OH 44721. This is the address on our registration, not an office you can visit.

By email: legal@exciiq.com.

For information and education only — not medical advice. Never stop, start, or change a medication without talking to your prescriber.