This policy is separate from our Privacy Policy and applies specifically to consumer health data. It is provided for residents of Washington State under the My Health My Data Act, for residents of Nevada under SB 370, and for residents of any other state with comparable consumer health data laws. If you live elsewhere, we apply these practices to you as well.

Famlo is operated by The Hive Network, LLC, Lee County, Florida, USA.

1. The short version

You enter your child’s health details from your own account. The organizations your family belongs to, and any organization you register that child with, can see them, so the people running the activity can keep your child safe. Other parents cannot. The free-text fields are encrypted, and they are erased when you remove the child or ask us to erase them.

The rest of this page is that paragraph in detail, including the parts that are less tidy than the paragraph.

2. Not HIPAA Data

Famlo is not a health care provider, health plan, or health care clearinghouse, and is not a business associate of one. The health information you give us is not protected health information under HIPAA. It is protected under this policy and applicable state consumer health data laws.

3. What We Collect, and Who Sees It

You enter all of it yourself, on your child’s page or at the attendee step of checkout. We do not infer health data from your browsing, we do not buy it, and we do not derive it from any other source. Every field is optional.

Medications and dietary restrictions are not shown to anyone but you. There is a field for each on your child’s page, and no organizer screen displays either one. If your child needs an organizer to know about a medication or a diet, put it in the medical notes or the allergy note, which they do see. We would rather tell you this than let you assume otherwise.

There is no allergy severity anywhere. A severity value can be stored alongside an allergy tag, and no screen in Famlo displays it — not to you, not to an organizer. So if how severe an allergy is matters, do not rely on a rating: write it into the allergy note.

Free-text answers are shown to organizers exactly as you typed them. Nothing is summarized, scored or interpreted.

4. Who Can See It

One rule governs the four safety fields — the allergy note, medical notes, the special-needs note described in §7, and the emergency contact. A person can see those only if one of these is true:

• They are the account holder on the child’s own family.
• They hold an organizer role in an organization your family currently belongs to.
• They hold an organizer role in an organization the child currently has an active registration with.

“Organizer role” means the owner of the organization, a co-leader, or an event manager. It does not mean every member. Other parents in your co-op cannot see those four fields, and neither can someone whose only role is billing manager or member manager.

Access follows current standing. Leave an organization and its organizers stop seeing your child. Cancel or refund a registration and the organizers of that activity stop seeing your child, unless your family is still a member of that organization.

A registration does not lapse on its own. It counts as active while it is confirmed, or once the child has been marked as attended, and nothing about the date of the activity narrows that. An organization you registered with for a single class keeps this access after the class is over, until the registration is cancelled or refunded, or you leave and ask us to remove it. That is what the software does; we would rather publish it than publish an expiry we have not built.

4.1 What is not covered by that rule

These parts of a child’s record are shown to anyone who can open the management console of an organization the child is currently registered with. That includes people whose only role is billing manager or member manager, who are refused the four fields above:

• The child’s name, age, grade level and your family name
• Your own name and phone number, as the guardian
• The list of people authorized to collect the child, and your pick-up note
• Your photo answer
• Which of that organization’s activities the child is enrolled in, and their attendance

We separate these out rather than folding them into the rule above, because the rule does not reach them. Saying “everything about your child is gated” would be the easier sentence and the false one.

4.2 Reveals are recorded

On the management console, the allergy, medical, emergency-contact and pick-up panels start hidden, and an organizer has to press a button to reveal them. Each reveal is recorded with the organizer’s name, the time, the child, and which panel — never the value itself, because an audit log holding “peanut” would be a second, longer-lived copy of the thing it exists to protect. Activity rosters and check-in sheets are not hidden this way; those show the allergy line directly to the organizers who open them.

4.3 Outside Famlo

One other party holds this data: Amazon Web Services, where our database, file storage and outbound email run. AWS processes it on our behalf under contract and may not use it for its own purposes. Our other vendors do not receive consumer health data at all — Stripe handles payments, Mapbox geocodes addresses, and our analytics and error-reporting paths are blocked in code from receiving health fields, as described below.

We have never sold consumer health data, and we will not. We do not share it with advertisers, data brokers, or analytics providers. Our analytics and error-reporting code refuses, by property name, to send anything named as a medical, allergy, special-need, accommodation, medication, dietary, birthdate, date-of-birth, diagnosis or emergency-contact value, or as a child’s name, age, date of birth or family member; outside production that refusal raises an error at the call site rather than dropping the value quietly. It is a guard on names, so it cannot catch a child’s name typed into some other free-text value, and we would rather say so than claim it is airtight.

Organizers are bound by Terms Section 39, which requires them to use what they see only to manage their group’s activities and ensure participant safety, not to share it with unauthorized third parties, to implement reasonable security, to notify us promptly of any incident, and to delete or return member data on request or when a member leaves the group. That is a contractual obligation on them; it is not something we can enforce technically once a person has read a screen.

5. How Long We Keep It

While the child is on your account, we keep whatever you have entered, so the next organizer sees it without you retyping it.

When you remove a child, or ask us to erase their health data, a job that runs daily erases it within 30 days: the allergy note and tags, the “no known allergies” answer, medical notes, the special-needs note and tags, medications, dietary restrictions, emergency contact name, phone and relationship, your pick-up note, and the list of people authorized to collect the child. There is one exception, and it is deliberate: if the child is still registered for an activity that has not happened yet, the erasure waits until after that activity, so an organizer is not left running a field trip without an allergy they were told about.

You can also clear a field yourself, at any time, from your child’s page: the allergy note and tags, medical notes, the special-needs tags, medications, dietary restrictions, the emergency contact, the pick-up list and note, and the photo answer.

6. How We Protect It

• All stored data is encrypted at rest by our database provider.
• These fields carry a second layer of encryption inside the application, so they are unreadable even to someone holding a database dump: the allergy note, medical notes, the special-needs note, medications, dietary restrictions, and the pick-up note.
• Emergency contact name, phone and relationship are not covered by that second layer — they rely on the storage-layer encryption alone. We would rather say so than imply a protection that is not there. Fixing it is tracked internally.
• Who may read the four safety fields is decided by the rule in Section 4, checked in one place that every screen showing them calls. What Section 4.1 lists is not checked that way.

7. Your Rights

You have the right to:

• Know what consumer health data we hold about your child, and who it has been shared with
• Correct it — the allergy note and tags, medical notes, the special-needs tags, medications, dietary restrictions, the emergency contact, the pick-up list and note, and the photo answer are all editable on the child’s page
• Delete it — we will erase it and direct our processors to do the same, within 30 days

One honest limitation, so you do not have to discover it. Besides the special-needs tags you tick, a child’s record carries a separate free-text special-needs note, and three organizer screens display it. Nothing in Famlo writes to that note and no screen shows it to you, so for a child added through this app it holds nothing — but we will not promise you that a record carried over from the previous version of Famlo is empty there. Email us and we will tell you exactly what it says, or clear it. It is the one place where an organizer could read something about your child that your own page does not show you, and we are building the missing field so this paragraph can be deleted.

Exercise any of these from your child’s page, or email support@famlo.co with the subject line "Health Data Request." We will respond within 45 days. If we deny a request you may appeal it at no cost by replying with the subject line "Health Data Appeal"; if we deny the appeal, we will tell you how to complain to your state Attorney General.

Washington residents may contact the Washington Attorney General at atg.wa.gov/file-complaint.

8. Contact

The Hive Network, LLC
Email: support@famlo.co
Jurisdiction: Lee County, Florida, USA