Consumer Health Data Privacy Policy

Last Updated: July 27, 2026

This is a separate notice required by the Washington My Health My Data Act (RCW 19.373) and by Nevada SB 370 (2023), which added consumer health data provisions to NRS Chapter 603A. Those laws define "consumer health data" broadly, and precise location information can fall inside that definition — including when it is inferred from data that is not health data.

It supplements, and does not replace, our Privacy Policy. Where the two describe the same thing, they say the same thing.

Who this is for: consumers in Washington and Nevada. We apply the commitments below to everyone, because operating one standard is simpler and safer than operating two.

1. Homebound Is Not a Medical or Clinical App

We want to be direct about this before anything else.

Homebound is a personal safety planning app. You tell it where you are going and when you expect to be back, and if you do not check out in time it notifies the people you chose.

We collect no clinical or medical information. Specifically, we do not collect or ask for:

• health conditions, diagnoses, symptoms, or treatments
• medications, prescriptions, or medical test results
• biometric or genetic data
• reproductive or sexual health information
• gender-affirming care information
• vital signs, bodily-function measurements, sleep data, or diet information
• information about health care services you have sought, received, or paid for

We also do not attempt to infer any of the above. We run no health inference, health profiling, or health classification on your trips or locations, and we have no interest in doing so. (We do compute ordinary trip statistics for you — totals, durations, favourite activity — from your own completed trips. Those are shown to you, are not health analysis, and are described in Section 3.)

2. What We Do Collect That These Laws May Reach

Two things we hold could fall inside the broad statutory definitions, so we disclose both rather than argue about the edges.

Precise location. Under the Washington My Health My Data Act, "consumer health data" includes precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies. Homebound collects precise location for its safety features. A trip destination is almost always a trailhead, a peak, a crag, or a friend's house — but the definition is written broadly.

Activity and duration. When you create a trip you pick an activity type (for example Run, Hike, or Climb), and we record when it started and ended and, optionally, a difficulty grade you choose. Read broadly, that is exercise information. We collect it because it is what the safety features run on — the activity sets the default grace period and the safety guidance shown to you, and the times are what the overdue check compares against. We do not measure your body, your performance, or your fitness, and we do not derive any health conclusion from it.

So: to whatever extent either of these is treated as consumer health data, the rest of this notice tells you exactly what we do with it and what you can require of us.

3. Categories of Consumer Health Data We Collect, and Why

Precise location is the main category that could qualify. We collect it in four situations, each of which you control:

Activity and duration (Section 2) are collected when you create and finish a trip. They set the grace period and safety guidance, drive the overdue check, and feed the trip statistics we show you. They are never used for anything health-related.

We use these for those purposes and nothing else. We do not use them for advertising, for building a profile of you, or to draw conclusions about your health, your habits, or your associations.

3.1 Geofencing

Washington's Act prohibits implementing a geofence around an in-person health care facility to identify or track consumers seeking care, to collect their consumer health data, or to send them messages or advertising. Nevada's law contains a comparable prohibition with a set distance around health care facilities.

We maintain no list of health care facilities and we target no location we did not get from you. Homebound implements exactly one kind of boundary: a circle around the destination you entered in your own trip, evaluated on your own device, so the App can remind you to check out when you arrive. Your arrival is not reported to our servers.

If you happen to set a medical address as your destination, the boundary exists because you asked for a reminder there — not because we sought that place out. We do not detect what kind of place a destination is, we do not use it to send you anything, and we do not share the fact of your arrival with anyone.

3.2 Consent, and the Necessity Exception

These laws require your consent to collect consumer health data beyond what is necessary to provide a product or service you asked for, and separate consent to share it.

• Collection. Everything in the table above is collected to deliver the specific safety feature you turned on. We do not collect location for any purpose beyond that, so the necessity exception applies and no separate consent is required. If we ever wanted to collect it for another purpose, we would ask you first, separately, and you could say no.
• Sharing. The recipients in Section 5 are people you nominate — the safety contacts on a trip, the friends in a Circle you chose. You designate them in the App, and the act of designating them is your consent to share with them. You can withdraw it at any time by removing a contact, ending a share, or turning the feature off, and sharing stops going forward.
• Sale. We do not sell consumer health data, so the separate signed authorization those laws require for a sale is not something we ever seek. See Section 6.

4. Categories of Sources

• You, when you create a trip, choose a destination, check in, or turn on sharing.
• Your device, when you have granted location permission and a feature you enabled is running.

That is the complete list. We do not buy location data, obtain it from data brokers, receive it from advertising networks, or derive it from your IP address.

5. Categories of Consumer Health Data We Share

We share precise location only in the ways you have specifically asked us to:

Anyone who views your location in the app is recorded in an access log, which you can request a copy of (Section 7).

6. Third Parties and Affiliates

As of the date of this notice we have no affiliates. Homebound LLC is a single Utah limited liability company with no parent, subsidiaries, or related entities. If that changes we will update this section before sharing anything with a new affiliate.

We do not sell consumer health data. We have never sold it and we do not intend to. Both Washington and Nevada require a separate, signed authorization before any sale of consumer health data; we do not seek one, because there is nothing to authorize.

Third parties fall into two groups, and the difference matters.

Service providers who process your data on our behalf. These hold information that identifies you, under contract, and act only on our instructions:

Each of these handles your data under its data processing terms and is not permitted to use it for its own purposes.

Lookup services we query. These are asked a question about a place and answer it. They receive coordinates only — no name, no email, no account identifier, nothing that identifies you — and they get no ability to connect a location to a person:

Several of these are public or government services that we query without any commercial relationship. We send them nothing that identifies you, and we do not send them your trip, your account, or anything about who you are.

7. Your Rights

If you are in Washington or Nevada — and, as a matter of our own policy, wherever you live — you may:

• Confirm whether we collect, share, or sell your consumer health data, and access it. Settings > Privacy > Export Data returns your complete record — including your recent location history and the log of who has viewed your location — as a file you can save. It is generated when you ask for it, so you do not have to wait for us. You can also ask us by email. Section 6.1 of our Privacy Policy lists everything the file contains.
• Get the list of recipients. A list of all third parties and affiliates with whom we have shared your consumer health data, with an active email address or other online contact for each. Section 6 is that list; ask us and we will confirm it in writing for your account specifically.
• Withdraw consent to collection and sharing. You can do this yourself at any time: turn off Trip Live Location Sharing, end a Circle share, remove a safety contact, or revoke location permission in your device's Settings. Withdrawal is not retroactive, but it stops collection and sharing going forward.
• Delete your consumer health data. Settings > Account > Delete Account removes everything. You can also ask us to delete location data specifically, without closing your account. On a verified deletion request we delete the data from our live systems and direct our processors to do the same, and we will tell you when it is done.

How to ask: email privacy@homeboundapp.com, or write to the address in Section 9. Say what you want in your own words — there is no form.

How we respond: we acknowledge within 10 business days and answer within 45 days. Where the law allows and the request is genuinely complex we may take one further 45 days, and we will tell you why inside the first 45. It is free. If we refuse, we will tell you why and how to appeal — see Section 6.7 of our Privacy Policy — and you may complain to the Washington State Attorney General or the Nevada Attorney General.

Authorized agents may act for you. We will ask for proof of authority and may confirm the request with you directly.

8. Retention and Security

Location is kept only as long as the feature that collected it needs it:

Location is encrypted in transit, access requires authentication, every read by another user is logged, and access is restricted to what a feature needs to function. Section 4 of our Privacy Policy has the details, including what we do if there is a security incident.

9. Contact

Homebound LLC 1518 Lake Front Ct Park City, UT 84098 United States

Email: privacy@homeboundapp.com

For anything not specific to consumer health data, see our Privacy Policy and Terms of Service.

This Consumer Health Data Privacy Policy is effective as of July 27, 2026.