Privacy Policy

What this is

haau3 is a web app for caregivers. It helps you collect, view, and share health records. This policy is for the person who signs in. It also covers any health data you bring into haau3 about a person you care for.

You must be 18 or older to use haau3, and the person whose records you manage must be 18 or older too. We do not knowingly collect data from children.

When you sign up for haau3, you agree to this policy. That is how you give us your okay to collect and use your data the way this page describes.

When you connect a health data source, we take you through our partner Fasten Health's setup. There, you pick which health networks and sources to include. Each choice is yours. You can add or remove sources at any time. See "Your rights" below.

What we collect

We only collect data we need for haau3 to work, or to keep the app safe and running. We do not collect anything else. If we ever want to collect something new, we will update this page first and ask you.

We collect three kinds of data:

1. Account info. Your name and email when you sign in. We use Google sign-in for this.
2. Health records. When you connect haau3 to a health data source through our partner Fasten Health, we get health data from the networks you pick. You pick the sources. You pick when to connect. We bring in all the records each network has for your person, so you get the full picture.
3. Use logs. We keep error reports and basic use data. This helps us fix bugs and keep the app running.

Where health data comes from

Today, health data comes into haau3 through our partner Fasten Health. Fasten connects us to TEFCA, the national health data sharing network that can find your records across places like hospitals, clinics, and Medicare.

During the Fasten setup, you pick which sources you want to include. You can add or remove sources at any time.

You choose the sources. We never pull data without your action, and we never pull from a source you did not pick.

When you start a retrieval, haau3 brings in all the health records each source has for your person. That can include medicines, conditions, allergies, shots, lab results, and visits. A personal health record (PHR) sits at the core of haau3. It keeps your full history in one place, not one record type at a time.

How we use your data

We use your data to:

• Show your records in haau3
• Help you share them with people and places you choose
• Keep the app safe and running well

Some uses are required for haau3 to work. For example, we need your account info so you can sign in.

Some uses are optional. For example, our AI helper called Cora uses Google to explain a record in plain language. You only use Cora if you choose to. AI summaries are optional too. If you turn them on for a person, Google's AI writes a few sentences about their records on their Overview page. You can turn them off at any time in Settings. If no one opens Cora or turns on AI summaries for a person, their records never go to the AI. Your conversations with Cora are never saved. When you close Cora, nothing you said or typed is kept.

We do not use your data for ads. We do not sell your data. Ever.

How long we keep your data

We only keep your data as long as we need it. Here is how long we keep each kind:

• Account info. As long as your account is open. If you delete your account, we erase it within 30 days.
• Health records. As long as your account is open. If you delete your account, we erase them within 30 days.
• Smart Health Link bundles. These expire on their own by the sharing spec. We erase expired bundles within 30 days.
• Check-ins. We don't keep a copy of what you send to a website in a check-in. That includes your answers to its questions.
• Share access logs. As long as your account is open. If you delete your account, we erase them within 30 days too.
• Error and app logs. We keep these for 30 days to help fix bugs. Then we erase them.

Google, which stores your health records, removes its own copies from its systems within 180 days after we erase them.

If you do not sign in for one year, we will email you a warning. If you do not sign back in within 30 days of that email, we will delete your account. You can log in at any time to keep your account open.

We will not keep your data for any other reason unless you say yes first. If a new reason comes up (like new research or a new feature), we will ask you to opt in before we use your data for it.

Who we share data with

We share data only in these cases:

1. When you tell us to. For example, when you make a Smart Health Link to share with a doctor or family member. Or when a website, like your doctor's check-in page, asks for your health information before a visit. You pick what to send. It goes only to that website, locked so only that website can open it. When you answer its questions for someone you care for, it also gets your name and how you're related to them. After that, the website keeps it under its own rules. Or when you ask what a medication would cost: we send a medication code, how much, and a ZIP code to the price sources we connect to. Nothing about you or the person you care for goes with it, and we save none of it. Or when you sign in to your insurance company to see a price under your plan: we read your member details from it, then send it the medication, the amount, the prescriber and the pharmacy with those details and your language, and how the medication is taken when your records say. We save none of it. The sign-in lasts up to an hour, kept only in your browser and locked so only haau3 can read it.
2. With the companies that help us run the app. These are:
   • Google Cloud (for storing health data)
   • Fasten Health (for connecting to health data networks like TEFCA)
   • Neon (for app logs and audit records)
   • Clerk (for sign-in)
   • Google Vertex AI and Gemini (only if you use Cora or turn on AI summaries)
   • Vercel (for hosting the website)
   • Resend (for sending email: our notices to you, and what you send us through the contact form)
   • Google Workspace (for our email inbox)
3. When the law requires it. For example, a court order. We will tell you if this happens unless the law stops us.

We have written deals with each of these companies. They must protect your data the same way we do. They cannot use your data for their own goals.

We do not share your data with anyone else. We do not sell it. We do not give it away.

Your rights

You have rights over how long we keep your data and how we get rid of it. You can:

• See all data we have about you.
• Fix any data that is wrong or out of date.
• Delete your account and all your data. This is sometimes called the right to be forgotten.
• Withdraw your okay to use a connected source at any time.
• Export a copy of your data.

To delete your account, open Settings and choose Delete my account. If you would like help with that, or with any of the others, email us at hello@haau3.com. We will respond within 30 days.

If a record from a hospital or doctor is wrong, you may also need to ask that office to fix it. We can help you understand how. Under HIPAA, you have the right to ask a hospital or clinic to fix records they hold.

How we keep your data safe

We protect your data in many ways:

• Strong encryption. All data is locked with strong encryption when we send it and when we store it.
• Trusted sign-in. We use Clerk with Google sign-in. This is a trusted way to verify who you are.
• Audit logs. We track who looks at what data. This helps us spot problems fast.
• Trusted vendors. Every company we work with has signed a deal to keep your data safe. For health data, we use HIPAA-eligible cloud services with signed Business Associate Agreements.

If your data is ever exposed in a breach, we will tell you within 30 days of finding out.

Records about other people

A health record may include data about other people. For example, a family history record may name your parents or siblings. When you share a record, that data may be shared too.

Think about this before you share. If you are not sure, ask the other person first.

Kids

haau3 is for adults. The person who signs in and the person whose records they manage must both be 18 or older. We do not knowingly collect data from children. If you think a child has used haau3, email us and we will delete the account.

De-identification

De-identified data is data with the parts that name or point to a specific person taken out.

Today, we do not de-identify your data for research, product ideas, or any other use. We also do not share your data with any third party for their own use, de-identified or not. Your health data is for you and the caregivers you pick. It is not something we sell, license, or give away.

If we ever want to change this, we will:

• Tell you clearly what is changing and why.
• Ask every user to opt in before any change affects their data.
• Follow HIPAA's Safe Harbor method for any de-identification. This is a set of rules for removing 18 kinds of identifying data (like names, dates, and ZIP codes) before the data is used.
• Never try to re-link the data back to a person. Our helper companies agree to the same rule.

Marketing and ads

• We do not send marketing email.
• We do not run ads in haau3.
• We do not use your data for targeted ads.
• We do not sell your data.

If we ever start to send marketing email, we will ask you to opt in first. You can always opt out.

We will never sell, license, or share your data with any third party for their own use. haau3 exists to help you and the people you care for. Your data is not a product.

If we ever consider a change to this, like sharing de-identified data for research or a new way data flows, we will tell you clearly, show it in the app, and ask you to opt in before the change affects you. We will not turn on a new use automatically.

Decisions made by computer

haau3 does not make computer-driven choices about you. We do not use your data to decide loans, housing, jobs, insurance, or other big life choices.

The Cora AI helper explains a record in plain language. It does not make choices for you, and your conversations with it are never saved.

If haau3 ever shuts down

If we close the company, we will give you 60 days notice by email. During that time, you can:

1. Export your data and take it with you, or
2. Delete your account, or
3. Move to a new company that agrees to follow these same privacy promises.

You pick what happens to your data. We will not sell or transfer your data without your okay.

Changes to this policy

We may update this policy as haau3 grows. If we make a big change, we will:

1. Email you at least 30 days before the change takes effect.
2. Show a notice in the app before the change.
3. Ask you to agree to the new policy before you keep using haau3.

A big change is anything that changes how we collect, use, or share your data. Small fixes (like a typo) do not count.

If you do not agree, you can delete your account.

If a change would use or share data you have already given us in a new way, we will ask you to opt in first.

This same process applies to our Terms of Service and any other user agreements we add in the future.

How we handle complaints

If you have a problem with how we use your data, email us at hello@haau3.com. We will respond within 7 days.

If you are not happy with our answer, you can also file a complaint with:

• The Federal Trade Commission at ftc.gov
• Your state attorney general
• The HHS Office for Civil Rights at hhs.gov/ocr, for a complaint about a hospital, clinic or health plan

Questions

If you have any questions about this privacy policy, email us at hello@haau3.com.

Learn more

Want to learn more about your rights to your health data? These are good places to start:

• The CARIN Alliance at carinalliance.com
• The HHS Office for Civil Rights at hhs.gov/ocr
• The ONC Cures Act at healthit.gov

We also have videos on our YouTube channel that walk you through how to use haau3. Visit youtube.com/@haau3.