Consumer Health Data Privacy Policy

Last Updated: October 9, 2026

This is a separate notice required by the Washington My Health My Data Act (RCW 19.373) and by Nevada SB 370 (2023), which added consumer health data provisions to NRS Chapter 603A. Those laws define "consumer health data" broadly, and precise location information can fall inside that definition — including when it is inferred from data that is not health data.

It supplements, and does not replace, our Privacy Policy. Where the two describe the same thing, they say the same thing.

Who this is for: consumers in Washington and Nevada. We apply the commitments below to everyone, because operating one standard is simpler and safer than operating two.

1. Homebound Is Not a Medical or Clinical App

We want to be direct about this before anything else.

Homebound is a personal safety planning app. You tell it where you are going and when you expect to be back, and if you do not check out in time it notifies the people you chose.

We collect no clinical or medical information. Specifically, we do not collect or ask for:

• health conditions, diagnoses, symptoms, or treatments
• medications, prescriptions, or medical test results
• biometric or genetic data
• reproductive or sexual health information
• gender-affirming care information
• vital signs, bodily-function measurements, sleep data, or diet information
• information about health care services you have sought, received, or paid for

We also do not attempt to infer any of the above. We run no health inference, health profiling, or health classification on your trips or locations, and we have no interest in doing so. (We do compute ordinary trip statistics for you — totals, durations, favourite activity — from your own completed trips. Those are shown to you, are not health analysis, and are described in Section 3.)

2. What We Do Collect That These Laws May Reach

Two things we hold could fall inside the broad statutory definitions, so we disclose both rather than argue about the edges.

Precise location. Under the Washington My Health My Data Act, "consumer health data" includes precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies. Homebound collects precise location for its safety features. A trip destination is almost always a trailhead, a peak, a crag, or a friend's house — but the definition is written broadly.

Activity and duration. When you create a trip you pick an activity type (for example Run, Hike, or Climb), and we record when it started and ended and, optionally, a difficulty grade you choose. Read broadly, that is exercise information. We collect it because it is what the safety features run on — the activity sets the default grace period and the safety guidance shown to you, and the times are what the overdue check compares against. We do not measure your body, your performance, or your fitness, and we do not derive any health conclusion from it. While live location is on, we also total the elevation gained from the altitude in your location fixes, so the people who can see your live location can see it; it describes the route, not your body or fitness.

So: to whatever extent either of these is treated as consumer health data, the rest of this notice tells you exactly what we do with it and what you can require of us.

3. Categories of Consumer Health Data We Collect, and Why

Precise location is the main category that could qualify. We collect it in the situations below, each of which you control:

Activity and duration (Section 2) are collected when you create and finish a trip. They set the grace period and safety guidance, drive the overdue check, and feed the trip statistics we show you. They are never used for anything health-related.

We use these for those purposes and nothing else. We do not use them for advertising, for building a profile of you, or to draw conclusions about your health, your habits, or your associations.

3.1 Geofencing

Washington's Act prohibits implementing a geofence around an in-person health care facility to identify or track consumers seeking care, to collect their consumer health data, or to send them messages or advertising. Nevada's law contains a comparable prohibition with a set distance around health care facilities.

We maintain no list of health care facilities and we target no location we did not get from a user. Every boundary around a place that Homebound uses is evaluated on your own device, and each is drawn around a place a user chose or around your own position:

• a circle around the destination of the trip you're on, so the App can remind you to check out when you arrive. Your arrival is not reported to our servers.
• on a group trip, a circle of about 15 meters (up to 40 meters when your phone's location is less precise) around a meetup pin a member dropped, so that while you are heading there in Find, the App can mark you "Here". That reply is shared with the trip's members.
• while Trip Live Location Sharing is on, a circle of about 200 meters around your own current position, so iOS wakes the App to send an update once you move away. It moves with you and is removed when sharing stops.

Separately, during a Find session on a group trip, our servers compare the two people's locations to tell them when they are close to each other. That is a distance between two people who agreed to find each other, not a boundary around a place.

If you happen to set a medical address as your destination, the boundary exists because you asked for a reminder there — not because we sought that place out. We do not detect what kind of place a destination is, we do not use it to send you anything, and we do not share the fact of your arrival with anyone.

3.2 Consent, and the Necessity Exception

These laws require your consent to collect consumer health data beyond what is necessary to provide a product or service you asked for, and separate consent to share it.

• Collection. Everything in the table above is collected to deliver the specific feature you turned on or used. We do not collect location for any purpose beyond that, so the necessity exception applies and no separate consent is required. If we ever wanted to collect it for another purpose, we would ask you first, separately, and you could say no.
• Sharing. The people who can view your location in Section 5 are people you designate — the safety contacts on a trip, the friends in a Circle you chose, the members of a group trip you joined, and the audience chosen for a trip you or another member publishes. You designate them in the App, and the act of designating them is your consent to share with them. You can withdraw it at any time by removing a contact, ending a share, or turning the feature off, and sharing stops going forward.
• Sale. We do not sell consumer health data, so the separate signed authorization those laws require for a sale is not something we ever seek. See Section 6.

4. Categories of Sources

• You, when you create a trip, choose a destination, check in or extend a trip, trigger an SOS, use Find, drop a meetup pin, use Discover, or turn on sharing.
• Your device, when you have granted location permission and a feature you enabled is running.

That is the complete list. We do not buy location data, obtain it from data brokers, receive it from advertising networks, or derive it from your IP address.

5. Categories of Consumer Health Data We Share

The people you designate can view your precise location as follows, each because of something you set up or used:

When a friend views your live location on a trip (including on the trip cards on their Friends tab), a member of a group trip you are on views your location, or a friend in a Circle you share with views your location, we record it in an access log, and we record each Find session when it starts. The trip's tracking page, a group member seeing your check-in points in the trip's member list or timeline, and Activity Feed posts are not logged. You can get a copy of the log (Section 7).

6. Third Parties and Affiliates

As of the date of this notice we have no affiliates. Homebound LLC is a single Utah limited liability company with no parent, subsidiaries, or related entities. If that changes we will update this section before sharing anything with a new affiliate.

We do not sell consumer health data. We have never sold it and we do not intend to. Both Washington and Nevada require a separate, signed authorization before any sale of consumer health data; we do not seek one, because there is nothing to authorize.

Third parties fall into three groups, and the difference matters.

Service providers who process your data on our behalf. These hold information that identifies you, under contract, and act only on our instructions:

Each of these handles your data under its data processing terms and is not permitted to use it for its own purposes. Render and Cloudflare keep request logs for a short time for security and reliability, and requests that carry your location can appear in them. We don't keep application access logs of those requests ourselves, and we don't write your coordinates to our own application logs.

Lookup services we query. These are asked a question about a place and answer it. They receive coordinates only — no name, no email, no account identifier, nothing that identifies you — and they get no ability to connect a location to a person:

Several of these are public or government services that we query without any commercial relationship. We send them nothing that identifies you, and we do not send them your trip, your account, or anything about who you are.

Services a viewer's browser contacts directly. We send these nothing ourselves. When someone opens a trip's tracking page or an invite page, or a map link in one of our emails, their browser or device contacts these services directly, which reveals that person's IP address:

The tracking page and invite pages also load images directly from our own storage: the trip's latest photo from Cloudflare R2 (photos.homeboundapp.com) and the inviter's profile photo from Supabase Storage, so those providers see the viewer's IP address too.

7. Your Rights

If you are in Washington or Nevada — and, as a matter of our own policy, wherever you live — you may:

• Confirm whether we collect, share, or sell your consumer health data, and access it. Settings > Privacy > Export My Data returns your complete record — including your recent location history and the log of who has viewed your location — as a file you can save. It is generated when you ask for it, so you do not have to wait for us. You can also ask us by email. Section 6.1 of our Privacy Policy lists everything the file contains. An entry stays in your log if the trip is later deleted, and if someone who viewed your location later deletes their account, the entry stays and shows a deleted account.
• Get the list of recipients. A list of all third parties and affiliates with whom we have shared your consumer health data, with an active email address or other online contact for each. Section 6 is that list; ask us and we will confirm it in writing for your account specifically.
• Withdraw consent to collection and sharing. You can do this yourself at any time: turn off Trip Live Location Sharing, end a Circle share, remove a safety contact, end a Find session, turn off "Let the group find me", cancel a meetup pin you dropped, or revoke location permission in your device's Settings. Withdrawal is not retroactive, but it stops collection and sharing going forward.
• Delete your consumer health data. Settings > your name > Delete Account deletes your account and its data immediately, and Settings > Privacy > Data Requests > Delete My Account does the same after a 30-day grace period in which you can cancel. A few records held by other people are not deleted with your account, as Section 5 of our Privacy Policy explains: an SOS you triggered on someone else's trip stays with that trip, no longer linked to you; other people's location-access logs keep their records of your views for up to 90 days; and our notification log keeps notifications to other people that name you or contain your messages for up to 30 days (a record of an overdue or SOS alert that could not be delivered, for up to 90 days). You can also ask us to delete location data specifically, without closing your account. On a verified deletion request we delete the data from our live systems and direct our processors to do the same, and we will tell you when it is done.

How to ask: email privacy@homeboundapp.com, or write to the address in Section 9. Say what you want in your own words — there is no form.

How we respond: we acknowledge within 10 business days and answer within 45 days. Where the law allows and the request is genuinely complex we may take one further 45 days, and we will tell you why inside the first 45. It is free. If we refuse, we will tell you why and how to appeal — see Section 6.7 of our Privacy Policy — and you may complain to the Washington State Attorney General or the Nevada Attorney General.

Authorized agents may act for you. We will ask for proof of authority and may confirm the request with you directly.

8. Retention and Security

Location is kept only as long as the feature that collected it needs it:

Location is encrypted in transit, our servers check who you are before returning it through our API, the views by other users described in Section 5 are logged, and we limit each feature to the data it needs. Some real-time updates the App receives are not yet limited to each user's own data; we are rolling out per-user checks for them. Section 4 of our Privacy Policy has the details, including what we do if there is a security incident.

9. Contact

Homebound LLC 1518 Lake Front Ct Park City, UT 84098 United States

Email: privacy@homeboundapp.com

For anything not specific to consumer health data, see our Privacy Policy and Terms of Service.

This Consumer Health Data Privacy Policy is effective as of October 9, 2026.