Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements our Privacy Policy and applies only to "consumer health data" as that term is defined by Washington's My Health My Data Act (chapter 19.373 RCW) and similar state laws, including Nevada's SB 370. LastFlare is operated by Nimbus Foundry, LLC. LastFlare is not a health-care provider and does not ask you for diagnoses, treatment records, or other medical information; this policy exists because some content you choose to store or send through an end-of-life and incapacity planning service may fall within these laws' broad definitions.

1. Categories of consumer health data we process

• Message content you provide. The title, body, and media of the messages you create and choose to have delivered. We do not require health information; any health-related content is what you voluntarily include.
• Life Story chapters you write. The biography text, chapter content, dates, locations, and responses to writing prompts you compose for delivery to the recipients you designate. As with messages, we do not require health information; any health-related content is what you voluntarily include.
• Guardian wellbeing responses. A guardian you designate may record a response about an account holder's wellbeing (for example, that they are safe, could not be reached, or have passed) as part of the check-in verification that determines whether your messages are delivered.

2. Why we process it

We process this data only as necessary to provide the service you have requested: to store your messages and Life Story chapters, operate the check-in schedule you set, run the verification cascade, deliver them to the recipients you designate, and — where you choose to make your Life Story profile public — publish the chapters you mark public to a memorial page. We do not use it for any secondary purpose, and we do not use it for advertising, profiling, or measuring the effectiveness of advertising.

3. Sources

We collect this data directly from you (the account holder) and, for wellbeing responses, from the guardians you designate. We do not purchase or acquire consumer health data from data brokers or other third parties.

4. Who we share it with

The categories described in Section 1 above — principally your message content and Life Story chapters, and, where relevant, a guardian's wellbeing response — are the consumer health data that may be disclosed. We do not sell your consumer health data, and we do not share it with any third party for that party's own purposes. We disclose it only:

• To the recipients you designate, at your direction, when a message or a recipient-selected Life Story chapter is delivered.
• To the public, if you publish a memorial page at your direction. Your Life Story profile is private by default; if you make it public, the chapters you mark public are viewable at your memorial page's public URL by anyone who has it, including anonymous visitors. You control this through per-chapter visibility (public, recipients-only, or private).
• To the service providers (processors) that host, encrypt, transmit, and deliver the data on our behalf — listed by category in Section 5 of our Privacy Policy — under contract and only to provide the service to you.
• Where required or specifically authorized by applicable law, including to comply with legal process or to protect against fraud or a threat to someone's safety.

No third party collects your consumer health data over time or across different Internet websites or online services through your use of LastFlare. We do not use advertising or cross-site tracking technologies, and we do not permit any third party to collect your consumer health data across other websites or services when you use ours.

5. Consent and the necessity basis

Collection and use. We collect and use consumer health data only as necessary to provide the product or service you have requested, or with your affirmative, separate consent for an additional purpose.

Sharing and disclosure. We share or disclose consumer health data only as you direct or as necessary to provide the service, and otherwise only with your affirmative, separate consent — except where a disclosure is independently required or specifically authorized by applicable law (including the limited legal-process and safety disclosures described in Section 4 above).

6. Your rights

Subject to applicable law, you may:

• Confirm whether we are collecting, sharing, or selling your consumer health data (we do not sell it), and access it — including a list of any third parties and affiliates with whom we have shared or sold it and an active email address or other online means to contact them;
• Withdraw consent to our collection or sharing of it; and
• Delete it.

Because we process this data only as necessary to provide the service, withdrawing consent or deleting it may require closing your account or deleting the relevant messages, after which we can no longer provide the affected part of the service. To exercise these rights, use our Data Deletion page or contact [email protected]. We will respond as required by applicable law. If we deny a request, you may appeal by replying to our response, and you may contact the Washington State Attorney General.

Nevada residents. If you are a Nevada consumer, then in addition to the rights above you may request a list of the third parties (if any) with which we have shared your consumer health data, and direct us to cease collecting, sharing, or selling it (we do not sell it). We will notify you of any material change to this policy. If we deny a request and you remain unsatisfied after appealing, you may contact the Nevada Attorney General.

7. Contact

Nimbus Foundry, LLC — [email protected]. For general privacy practices, see our Privacy Policy.