Quito Health: Privacy notice

Version 2026-10-09-draft. Quito Health (a DBA of 3Ps Lab LLC).

1. Who is responsible

Quito Health (a DBA of 3Ps Lab LLC) operates this service and is responsible for the information described here. Privacy contact: support@quitohealth.com [privacy contact and postal address - LAWYER].

2. What we read from the health system

Only after the patient (or someone they allowed) signs in on the health system's own page and allows it, and only reading, never writing:

• basic record details, to confirm it is the right person;
• medication orders and medication details;
• clinical notes, to find what they say about the medicines on the list;
• visits, to date those notes.

We keep the health system's access credentials encrypted. The patient can end our access at any time on the health system's own page (its list of connected apps); the family's admin can also disconnect it here.

3. What the family creates here

• The admin's reviews and the published lists (with who published them and when).
• Photos the admin uploads for the wall screen. Location, camera details and other hidden data are removed before they are stored.
• The ticks made on the wall screen ("taken").
• A name the admin chooses for the person (for example "Grandma"), shown only on this family's admin pages.
• Each member's Google email address (for sign-in and alert emails) and their agreements to these documents (the date and the version, nothing else).

4. Who sees what

• Members of the family: everything on the family's admin pages. Only the admin can change anything.
• The wall screen: only the list the admin published, the photos and the ticks.
• Quito Health staff: no family's health information, except when the family's admin turns on support access in Family settings. Support access is read-only, lasts at most 24 hours, can be ended by the admin at any time, and every page support opens is recorded in the family's activity log.
• Nobody else. We do not sell information, show advertising, or use it to train AI models.

5. Service providers

• Netlify: hosts the service and stores the family's information. [Netlify's storage is not part of a HIPAA offering; describe the legal basis - LAWYER]
• Google: sign-in only. Google tells us your email address and that you signed in.
• Resend: sends the alert emails. An email carries counts and a link only, never a medicine name, a note or a person's name.
• Anthropic: only if the family's admin turns on AI reading of visit notes (it is off unless they do). Then the passages of new visit notes that mention a medicine on the family's list (not whole notes) are sent to Anthropic's Claude to help summarize what they say about that medicine, for the admin to read. Anthropic does not use this data to train its models. The admin can turn it off at any time; nothing more is sent after that.
• The patient's health system (through Epic): the source of the records in section 2.

6. How long we keep it

• A family's information is kept while the family uses the service, until the admin deletes it or closes the family.
• Records of agreements to these documents and the family's activity log (which hold ids and dates, no health details) are kept after a deletion [retention period - LAWYER].
• [Backups: whether they exist and how long they are kept - LAWYER and operations]

7. Deleting

• The family's admin can delete all of the family's information at any time (Sources & sync, "Delete all of this family's data"), or close the family (Family settings). Both cannot be undone.
• Any member can leave a family at any time.
• To delete your account, write to support@quitohealth.com [timeline - LAWYER].

8. Security incidents

If we learn that a family's information was accessed or disclosed without permission, we will tell the affected families [notice timeline and content under the FTC Health Breach Notification Rule and state law - LAWYER]. Report a suspected problem to support@quitohealth.com.

9. Your rights

[State privacy rights, including California (CMIA) and Washington (My Health My Data Act), and how to use them - LAWYER]

Questions: support@quitohealth.com. Quito Health (a DBA of 3Ps Lab LLC).