Consumer Health Data Policy

This policy explains how Embodied Era LLC handles consumer health data — information that identifies or relates to someone's past, present or future physical or mental health — in Remember. It supplements our Privacy Policy, and it applies to health information about you and about anyone else you save information about.

Remember isn't a healthcare provider, so HIPAA doesn't apply to it. We follow state consumer health data laws instead, including Washington's My Health My Data Act, Nevada's consumer health data law, Connecticut's Data Privacy Act and Virginia's Consumer Protection Act.

New accounts are not currently offered to residents of Washington or Nevada.

We don't ask for health information. We hold it only when you choose to save it. That can include:

• health conditions, diagnoses, symptoms and disabilities;
• medications, doses, treatments, procedures and allergies;
• vital signs and measurements, such as blood pressure, weight or blood sugar;
• appointments, healthcare providers and care plans;
• mental and behavioral health information;
• sexual and reproductive health information, including pregnancy and fertility;
• vaccination and test records, and photos or documents of prescriptions, bills or medical records;
• information derived from what you save — AI-generated tags, categories and check-in suggestions that may relate to someone's health.

• directly from you — what you type, record, photograph or upload;
• from accounts you connect, such as calendar events you choose to import;
• generated by the Service from your own content, as described above.

We don't buy health data or collect it from data brokers, advertisers or other third parties.

Only to provide the Service you asked for: to store it, show it back to you and the people you share with, search it, answer your questions about it, organize it, and send the reminders and suggestions you've turned on.

We never sell health data, never use it for advertising, never use it to build a profile of you for any other purpose, and never use it to train AI models. We don't geofence health facilities and we don't collect precise location. The only location we use is the approximate country and state your IP address comes from when you sign up, to confirm the Service is offered there, and we don't store it.

We ask for your consent before you start using the Service, separately from our Terms, for the collection and use of health information described here. We only share it as described in section 6 — with the service providers that run Remember, and with people you choose to share it with. If we ever wanted to share it for any other reason, we'd ask for separate consent first; we would never sell it.

You can withdraw consent at any time by emailing privacy@embodied-era.com. Because the Service can't hold health information without your consent, withdrawing it means we'll delete the health information you've saved — the specific items you identify, or your whole account if you prefer. You can also delete any of it yourself at any time.

If you save health information about someone else, you're responsible for having a legitimate reason to keep it and the right to share it.

We don't have affiliates, and we don't sell or share health data with third parties for their own use. It's disclosed only:

• to the service providers that process it on our behalf to run the Service, under contracts limiting them to that purpose — hosting, database and file storage, sign-in, AI processing, email delivery and reminder scheduling (listed below);
• to the people you choose to share a person, life area, note or reminder with (if they don't have an account yet, we email them an invitation to create one);
• at your direction, to the legacy contact you name in Settings, after you die and after the claim process in our Terms. They can read your account, including health information, except anything you marked "Don't pass this on";
• where the law requires it, such as a valid court order, and we'll notify you unless we're prohibited from doing so.

Service providers that may process health data you save:

• Vercel — hosting the app, and counting visits to our public pages
• Vercel Blob — storing photos and files
• Neon — database
• Clerk — sign-in and account security
• Anthropic — organizing captures, reading photos and documents, answering questions
• OpenAI — search indexing, understanding searches and questions, and voice transcription
• Resend — sending email
• Upstash (QStash) — delivering reminders on time
• Google (Gmail) — our support inbox: receiving and answering email and feedback you send us
• Google — only if you connect it: importing contacts and calendar events

You can:

• confirm whether we hold health data about you, and access it;
• get a list of the third parties and service providers it has been shared with;
• delete it, including from our service providers' systems and from backups within 35 days;
• withdraw your consent to its collection and use;
• appeal if we decline a request.

Email privacy@embodied-era.com from the address on your account. We'll verify it's you and respond within 45 days, extended once by another 45 days only where reasonably necessary, in which case we'll tell you why. We won't charge you or treat you differently for exercising these rights. If we decline, reply with “Appeal” in the subject and we'll respond within 45 days; if we deny your appeal, you can contact your state Attorney General.

If someone has saved health information about you in their Remember account, contact us and we'll forward your request to them where we can identify the account, and act ourselves where the law requires.

Health data is protected like everything else you save: encrypted in transit and at rest, with access to production systems limited to the people who need it to run and support the Service, each bound by confidentiality. See the Privacy Policy for details.

If we materially change this policy, we'll email you before the change takes effect, and we won't collect or use health data in a new way without asking for your consent. Questions: privacy@embodied-era.com.