Consumer Health Data Privacy Policy

Effective October 21, 2026.

This policy explains how Wovi LLC (“Wovi,” “we,” “us”) handles consumer health data: information that is about someone’s physical or mental health, or that shows they are seeking health care. It is our consumer health data privacy policy under Washington’s My Health My Data Act, Nevada’s consumer health data law (SB 370), and Connecticut’s consumer health data law, and we follow it for every Wovi user and every person cared for in Wovi, wherever they live in the United States.

It adds to our Privacy Policy, which covers everything else. Wovi works for families, not for doctors or health plans, so HIPAA doesn’t apply to Wovi; this policy and our Privacy Policy are our promises about health information.

In this policy, “you” means a Wovi account holder (an Organizer, Helper, or Viewer) and also the person a family cares for in Wovi. Both can use the rights in Section 8.

1. Consumer health data we collect, and why

• Medications: names, doses, pharmacies, and refill details, so we can keep your family’s list current and check on refills.
• Health conditions and symptoms mentioned in requests: for example, the reason for a visit or a question you ask Ask Wovi, so we can do what you ask. This includes anything our AI works out from what you share (for example, that a medicine is usually for blood pressure) while answering you.
• Appointments and providers: doctors, offices, visit types, dates and times, and the results of booking calls, so we can book and track visits and keep your family calendar.
• Insurance: plan names, member and group numbers, and card photos, so we can share them with offices and insurers when a task needs them.
• Bills and explanations of benefits: amounts, services, dates, claim numbers, and insurer letters, so we can explain bills, point out possible errors, and draft insurance appeal letters that you review and send.
• Call recordings and transcripts: our phone assistant’s calls with offices, pharmacies, and insurers, and calls to Wovi’s number, so we can complete the task, show you what happened, and check that calls go well.
• Photos and documents: pill bottle labels, insurance cards, medical bills, and other files you upload or that arrive at your Wovi email address, so we can read them for you.
• Related details that, together with the above, identify the person: name, date of birth, and address or ZIP code.

We use this information only to provide Wovi to your family, to give support, to keep Wovi secure and prevent fraud, to keep records of consents and authorizations, and to meet legal obligations. We don’t use it for advertising.

2. Where it comes from

• You and the other people in your family on Wovi, when you type, upload, or ask.
• Doctors’ offices, pharmacies, and insurers, on calls our phone assistant makes or answers, and in mail and replies they send to Wovi.
• People who call or text Wovi’s number.
• Outside AI apps you choose to connect to your account.
• Public directories, such as the U.S. NPI Registry, for a provider’s details.

3. Who we share it with, and why

We share consumer health data only to provide the Service you asked for, or when you direct us to. For each, we share only what the task needs.

• Offices you ask us to contact (doctors’ offices, pharmacies, insurers, and billing offices): the patient details, insurance, and request details a booking, refill, bill question, or appeal needs.
• People in your family on Wovi: everyone who shares a family member’s profile (Organizer, Helpers, and Viewers) can see the information in it.
• Outside AI apps and calendar apps you connect: the family members, requests, and appointments those connections show (see our Privacy Policy, Sections 8 and 9).
• Our processors, companies that handle data for Wovi to run the Service:
  • Lovable (hosting, AI gateway, and email sending): all of the categories above, to run Wovi.
  • Supabase (database, file storage, and sign-in): all of the categories above, to store them.
  • Google (Gemini AI models, reached through Lovable): messages, photos, documents, bills, and call transcripts, to answer questions, read documents, and draft appeal letters.
  • ElevenLabs (voice AI): the request and patient details a call needs, and the call’s recording and transcript, to place and answer calls.
  • Twilio (phone and text): call audio as it happens, and texts that may mention an appointment, refill, or request, to carry calls and texts.
  • Expo and Apple (phone notifications): short updates about a request, such as an offered appointment time, to show them on your iPhone if you allow notifications.
  • Postmark and Mailgun (email): emails and attachments sent to and from Wovi, such as bills, insurer mail, and appeal letters, to deliver them.
  • Browserbase (cloud web browser): office names and locations for web lookups; and, when Wovi staff book on an office’s online portal for your family, the details that booking needs (such as the patient’s name, date of birth, and insurance).
  • Stripe (payments): no health details, only billing information.
  • Google Places, the NPI Registry, and Zippopotam.us (finding offices and ZIP codes): office names, places, and ZIP codes only, never the patient’s health details.
• Legal and safety: when the law requires it, such as a valid court order, or to protect someone’s safety.

Affiliates. Wovi has no affiliates (no parent, subsidiary, or sister companies), so we don’t share consumer health data with any.

Wovi staff. Only Wovi team members who need it to complete requests, give support, or keep the Service safe can see consumer health data. They must keep it confidential, and staff accounts require two-step sign-in.

4. We don’t sell it

• We do not sell consumer health data, and we never have.
• We don’t use it for targeted advertising, and we don’t let third parties collect information about your activity across other websites through Wovi.
• We don’t use geofencing: we never set up a virtual boundary around a health care location to identify, track, collect data from, or send messages or ads to people there.

5. How we ask for your consent

Before Wovi helps with someone, the person adding them checks two separate boxes, apart from our Terms of Service:

• Collect their health information: that Wovi may collect and keep the categories in Section 1, to do what the family asks.
• Share it to get things done: that Wovi may share only what’s needed with the offices the family asks it to contact and with the processors in Section 3.

Helpers and Viewers agree to the same two when they join a family. We keep a record of each agreement: who agreed, which version, and when. If we ever want to collect or share consumer health data for a new purpose, we’ll ask for your consent first. We would never sell it, and selling would require your signed authorization under Washington law.

You can withdraw either consent at any time (Section 8). Wovi then stops collecting and sharing that person’s information, which usually means we can no longer help with them.

6. How long we keep it

We keep consumer health data while the account is open. When an account is deleted, we delete it as described in our Privacy Policy (Section 15): the family profiles and records, uploaded files, and Wovi’s call recordings and transcripts at ElevenLabs. Backups are overwritten within 30 days. We keep records of consents and authorizations, and security logs, only as long as needed for those purposes.

7. Security

Consumer health data is encrypted in transit and at rest, limited to each family by database rules, and kept in private storage. If it’s ever accessed or shared without permission, we’ll tell you without unreasonable delay, and within 60 days after we discover it.

8. Your rights, and how to use them

You can ask us to:

• Confirm whether we collect, share, or sell your consumer health data (we don’t sell it).
• Give you a copy of your consumer health data.
• List every third party and processor we’ve shared it with, with a way to contact each one.
• Correct it. You can also fix most details yourself in Wovi.
• Delete it. We delete it from Wovi, tell the processors and other companies we shared it with to delete it too, and our backups are overwritten within 30 days. Doctors’ offices, pharmacies, and insurers keep their own records under their own legal duties, and may not be able to delete what they already have.
• Withdraw your consent to our collecting or sharing it.

How: email hello@mywovi.com (or call (844) 415-4055), and tell us what you’d like. To delete everything at once, you can also delete your account in Account on the website or in the app. If you’re the person someone cares for in Wovi, or someone legally authorized to act for you, you can make these requests too.

To protect you, we’ll confirm your identity before acting, usually by replying to the email address on the account, or by asking for details only you would know. We’ll respond within 45 days. If we need more time, we may extend that once by up to 45 more days, and we’ll tell you why. Requests are free. We won’t treat you differently for using your rights.

9. If we say no: appeals

If we turn down any part of your request, we’ll explain why. You can appeal by replying to our answer, or emailing hello@mywovi.com with “Appeal” in the subject, within 90 days. Someone who wasn’t part of the first decision will review it, and we’ll tell you the result in writing within 45 days, with our reasons. If we still deny your appeal, you can contact your state’s attorney general:

• Washington State Attorney General’s Office: atg.wa.gov/file-complaint
• Nevada Attorney General: ag.nv.gov
• Connecticut Attorney General: portal.ct.gov/ag

10. Changes to this policy

If we make a material change, we’ll tell you by email or in Wovi before it takes effect. If a change means collecting or sharing consumer health data in a new way, we’ll ask for your consent first. The date above always shows the current version.

11. Contact us

Wovi LLC, Provo, Utah. Email hello@mywovi.com or call (844) 415-4055.