Privacy Notice

Last Updated: 9 October 2025

Share My Health, Inc. ("ShareMy.Health," "we," "us," or "our") acts as the data processor for all personal data collected through the ShareMy.Health Platform (the "Platform") and related Services. We act at the request of our clients, each a data controller. All processing is governed by written data processing agreements (DPAs) between ShareMy.Health and each data controller, consistent with Article 28 of the GDPR.

ShareMy.Health may change this Privacy Notice from time to time. It is your responsibility to check this webpage periodically to see if any terms have been changed or modified. Continued use after changes constitutes acceptance of the revised notice.

If you have questions about how we process your data or to exercise your rights, contact us using one of the methods at the bottom of this page.

1. Types of Personal Data Collected & Processed

We collect, store, process, and transmit various categories of personal data, including sensitive data, which you explicitly choose to enter or retrieve using the platform.

2. Purposes of Processing

We do not sell or rent your personal information. We process your data for primary and (sometimes) secondary purposes.

Primary / core purposes — for which your consent is required:

• To operate the ShareMy.Health platform: storing, organizing, retrieving, transmitting, and managing your health and wellbeing data
• To enable you to view, upload, and share your health data with trusted parties (e.g. caregivers, clinicians, organizations)
• To sync data across devices / integrate with other trusted health systems/institutions you authorize
• To support collaboration, messaging, invites, and care coordination features
• To provide you with dashboards, insights, reminders, trend tracking, analytics
• To secure, maintain, and protect your data (e.g., encrypting in transit and at rest, backup, auditing)
• To handle support requests, account management, feedback, comments and suggestions, and communications with you

Secondary / ancillary purposes — where you may have opt-in or opt-out options:

• To aggregate or anonymize data — so it longer identifies you or your child — for benchmarking, research, health trends, platform improvement
• To generate de-identified / pseudonymized datasets for internal product research, algorithm development
• To communicate with you about new features, promotions, or surveys (subject to your marketing preferences)

We will clearly inform you (at the moment of consent or opt-in) which secondary uses apply.

We may disclose data where required by law, court order, or governmental request, provided such disclosure is limited to what is legally necessary.

WE AFFIRM THAT SHAREMY.HEALTH PROCESSES SENSITIVE PERSONAL DATA, INCLUDING HEALTH INFORMATION AND OTHER SPECIAL CATEGORY DATA AS DESCRIBED ABOVE. THIS PROCESSING IS CONDUCTED SOLELY FOR THE PURPOSES OUTLINED IN THIS PRIVACY NOTICE AND WITH YOUR EXPLICIT CONSENT OR AS OTHERWISE PERMITTED BY APPLICABLE LAW.

3. Limiting Use, Disclosure & Processing (Your Options)

We believe in giving you control. Here are the options and means you have:

• Granular consent: You can choose which health data to enter, share, or sync. You decide who sees what (e.g. certain organizations or people).
• Third-party access revocation: You can revoke a given third party's access at any time.
• Account cancellation / data deletion: You may cancel your account and request deletion of data.
• Opt-out of secondary uses: You may decline or withdraw consent for secondary uses (e.g. marketing, research) without affecting core services.
• Preference settings: Via settings in your account (or preferences page), you can limit communications (e.g. marketing emails).
• Minimization: We collect only what is necessary for the functions you enable or features you opt into.

4. Children's Data

We do not knowingly collect personal data directly from children under 16 in the EU (or 13 in the U.S.) without verified parental consent.

Where an organization using ShareMy.Health facilitates data collection from minors, that organization is responsible for obtaining verifiable consent from the parent or guardian.

5. Withdrawing Consent

If you've consented to processing (especially for sensitive health data or secondary uses), you can withdraw your consent at any time:

• Via the user interface (settings)
• By contacting us at privacy@sharemy.health
• Upon withdrawal, we will cease processing to the extent possible (unless we have a legal basis to continue)
• Withdrawing consent will not affect the lawfulness of processing conducted prior to the withdrawal (we may retain records as required by law or for legitimate purposes)

6. Your Rights & How to Exercise Them

Because ShareMy.Health acts only as a processor, individuals should first contact the organization that provided them access to the platform (the data controller) to exercise their rights. We will assist the controller as required under applicable law.

You have rights under applicable privacy laws (GDPR, HIPAA contexts, CCPA, etc.). Here is how we support them:

7. Data Transfers & Third-Party Recipients

Because we operate globally and integrate with third parties, there are transfers and disclosures to consider:

• Third-party integrations / institutions: If you authorize a connection to your healthcare institution / EHR / lab / clinic, your data may be transferred from and/or to those parties.
• Cross-border transfers: For users outside the U.S., we may transfer data across jurisdictions (e.g. U.S. to and from your country). We will rely on legal mechanisms (e.g. explicit consent where required by applicable law, standard contractual clauses, adequacy decisions, binding corporate rules) to ensure protection.
• Purposes of transfers: to support backups, global availability, cross-region redundancy, analytics, interoperability, and service delivery.
• Aggregated / anonymized transfer: We may transfer de-identified or aggregated datasets for research or partnerships.
• Service providers (processors): We use third-party service providers (e.g. hosting, cloud, analytics, encryption, storage) under strict contracts to process data on our behalf.
• Third parties who are not just processors but independent entities: any clinic, health system, or organization you explicitly share your data with.

All international transfers from the EEA, UK, or Switzerland to the United States are protected by Standard Contractual Clauses approved by the European Commission, with additional technical and organizational measures where required.

We will always notify you when a proposed recipient is not just a "processor" and require your consent before such transfers.

8. Automated Decision-Making & Profiling

ShareMy.Health may use limited forms of automated decision-making and data analysis to provide personalized insights, health reminders, or recommendations within the Platform. These processes may involve analyzing your health data, activity patterns, or other information you voluntarily provide to generate suggestions or highlight potential risks.

Such automated decisions do not produce legal or similarly significant effects and are intended only to support wellness, care coordination, and self-management.

Where automated processing could materially affect you, we will provide clear notice at that point and give you the option to request human review or to object to the automated processing altogether.

9. Security Measures

We protect your data vigorously:

• Encryption in transit (TLS / HTTPS) and at rest
• Secure network and access controls, role-based access, audit logging
• Regular security assessments, penetration testing, vulnerability scanning
• Data backups, disaster recovery, incident detection / response
• Strict policies and contractual obligations for all third-party processors
• Least privilege / minimum access principle for internal systems

10. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this Notice, comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, it is securely deleted or anonymized.

• Account data: retained while your account remains active.
• Audit and transaction logs: typically retained for 7 years.
• Primary data: deleted from the primary system with 30 days
• Backup data: deleted within 3 months after removal from the primary system.

11. Legal Basis & Jurisdictional Notes

• For users in the EU / EEA: processing is based on your consent and/or legitimate interests for specific features (e.g. analytics).
• For U.S. users, we comply with HIPAA (where applicable) and treat your platform data as health information with heightened protections.
• For California / CCPA / CPRA: you have additional rights (right to opt out of sale, right to know, etc.).
• In countries with data localization or special rules (e.g. in emerging markets), we will comply with local law and may adapt this Notice accordingly.

Under GDPR, we rely on the following legal bases for processing:

• Consent (Article 6(1)(a)): For processing sensitive data and where you actively provide consent, such as sharing your health information or connecting your account to an organization.
• Performance of a contract (Article 6(1)(b)): To provide the services you request, including account management and platform functionality.
• Compliance with legal obligations (Article 6(1)(c)): To meet regulatory requirements or respond to lawful requests.
• Legitimate interests (Article 6(1)(f)): For limited administrative purposes, security monitoring, and platform improvement, provided your interests and fundamental rights do not override ours.

12. Processor–Subprocessor Transparency (GDPR Article 28)

We engage carefully selected subprocessors that provide hosting, storage, communications, and support services. Each subprocessor is bound by a written data processing agreement and required to implement equivalent safeguards. A current list of subprocessors is available on request at privacy@sharemy.health

13. Contact & Dispute Rights

Because ShareMy.Health acts only as a processor, individuals should first contact the organization that provided them access to the platform (the data controller) to exercise their rights. We will assist the controller as required under applicable law.

• You can always contact us at privacy@sharemy.health with privacy questions, complaints, or to exercise your rights.
• If you reside in a jurisdiction with privacy oversight (e.g. a data protection authority in the EU), you can lodge complaints with that authority.
• We'll work with you to resolve any concerns in good faith.

EU residents have the right to lodge a complaint with their local supervisory authority. A list of data protection authorities is available here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

14. Identity and Contact Information of the Data Processor

Share My Health, Inc. dba ShareMy.Health
A Delaware corporation
4038 Parkview Drive
Salt Lake City, UT 84124
United States of America

Data Protection Officer (DPO): Our DPO oversees compliance for both U.S. and international users. Reachable at dpo@sharemy.health.

Contact Information:

• privacy@sharemy.health
• www.sharemy.health

‍