Consumer Health Data Privacy Policy

Wayluma helps the adult children of aging parents understand Medicare and Medicaid paperwork. Because the documents you share can reveal health information, we treat your data with more care than an ordinary app — this policy is written to meet the FTC Health Breach Notification Rule and the Washington My Health My Data Act (and comparable state consumer-health-privacy laws), in addition to the CCPA/CPRA and similar rights.

Wayluma is a consumer-controlled tool. We are not a HIPAA covered entity, we are not your healthcare provider or insurer, and we do not give medical, legal, or benefits-eligibility advice.

What we collect

• Account data: your email address and authentication records (we use passwordless magic-link sign-in).
• Documents you add: when you upload or paste a document, we read it to produce a plain-language explanation and structured entries (medications, appointments, coverage facts). We store the derived structure, not the raw document text, and we keep only the last four digits of a Medicare ID — never the full number.
• Care-circle data: the care-circle name, members you invite, roles, notes, and the shared timeline.
• Limited technical data: IP address and basic request metadata used for security and rate limiting, plus privacy-friendly, cookieless web analytics (Vercel Web Analytics) that counts aggregate page visits without cookies, cross-site tracking, or personal profiles. We do not run third-party advertising or behavioral ad trackers inside the app.

“Consumer health data” and your consent

Medication lists, coverage documents, and appointment records can identify your (or your parent’s) health status, so they qualify as “consumer health data” under Washington’s My Health My Data Act and similar laws. We ask for your affirmative consent before collecting this data, and you may withdraw consent at any time by deleting your care circle (see “Your rights” below).

How we use your data

• To produce plain-language explanations and the coordinated view your family shares.
• To operate, secure, and support the service (authentication, abuse prevention, troubleshooting).
• We do not sell your data, and we do not use it for advertising or share it with data brokers.

AI processing

To read a document, Wayluma sends its contents to our AI processor, Anthropic, solely to generate your explanation. We send real document content to the model only after a no-training / no-retention configuration is confirmed, so your content is not used to train models. Wayluma’s anti-fabrication “grounding” safeguard removes any figure, date, or program claim that does not actually appear in your document — we never invent a number, and we never tell you that you qualify for a program; we point you to the office that decides.

How your data is protected and shared

• Each family’s data is isolated at the database level (row-level security), so one family can never see another’s.
• Only the members you invite to a care circle can see that circle’s data.
• We share data only with the service providers needed to run Wayluma — hosting and database, our AI processor, transactional email delivery (to send invitations and waitlist confirmations), and cookieless analytics — under contractual data-protection obligations, and never with advertisers or data brokers. These emails carry no health details, only the recipient’s address and an invitation or confirmation.
• We may disclose data if required by law, or to protect safety, but we will resist overbroad requests.

Data retention

We keep your data while your account is active. When you delete a care circle, we delete its associated data. We retain minimal records as required for security and legal compliance.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to withdraw consent. You can delete your care circle and its data from your account settings, or contact us at privacy@wayluma.care and we will honor verified requests within the timelines the law requires.

Data-breach commitment

If a breach of unsecured health information occurs, we will notify affected individuals and the FTC within the timelines required by the FTC Health Breach Notification Rule (generally within 60 days of discovery), and we will provide notice of what happened and the steps you can take.

Children

Wayluma is intended for adults coordinating an adult relative’s care and is not directed to children.

Changes and contact

We will post any changes to this policy here and update the date above. Questions: privacy@wayluma.care.