Consumer Health Data Privacy Policy

Postward is in private testing. This policy will be reviewed by counsel before Postward opens to the public.

This policy covers consumer health data: information linked, or reasonably linkable, to you that identifies your past, present or future physical or mental health. Washington’s My Health My Data Act requires it. It also covers Nevada’s consumer health data law (SB 370) and Connecticut’s consumer health data protections.

We apply this policy to everyone who uses Postward, wherever they live. It sits alongside our Privacy policy, which covers everything else.

Who we are

Postward is run by SBROS Holdings LLC, a New York company (“Postward”, “we”, “us”). Contact us at hello@sbros.com.

Consumer health data we collect

• The recovery: the patient’s name, the type of procedure, and the surgery and discharge dates.
• Care team details: the surgeon’s name and office phone number.
• The recovery plan: tasks, warning signs to watch for, who a task is assigned to, and who completed it.
• Medications: name, strength, instructions and times, plus a log of who marked each dose given or skipped, and when.
• Daily check-ins: pain score, temperature, incision status, swelling, bowel movements, notes, and who logged them.
• Questions for the visit: questions written down to ask the care team.
• Being in a recovery circle: Postward is for recovery after surgery, so your account and your place in a circle could suggest that you, or someone close to you, had surgery. We treat that as consumer health data too.
• Usage events: a fixed list of event names, such as “task completed”, with a time and the account and recovery they relate to. They never include the content of a task, medication or check-in. Because they are linked to a recovery, we treat them as consumer health data.
• Payment status: whether a Recovery Pass was bought for a recovery, and when.

We do not collect precise location, and we do not use geofencing.

Where it comes from

• You, when you start a recovery, enter information, or log a dose or check-in.
• People in your recovery circle, who can enter information about the patient’s recovery, such as marking a dose given.

We do not collect consumer health data from any other source. We do not buy it, and we do not get it from data brokers.

Why we collect it

• To show the recovery plan, medication log and check-ins to you and the people in your circle.
• To keep a record of who did what and when, so the circle can coordinate, such as who gave which dose.
• To help you keep questions ready for your care team.
• To turn on Recovery Pass features for a recovery that has one.
• To keep Postward secure and working, and to see which features get used, from usage events only.
• To respond to your requests and meet our legal obligations.

Your consent

We collect consumer health data only with your separate, opt-in consent, which we ask for before any is entered.

We share it only with your separate consent. Inside a recovery circle, sharing happens only when you invite someone and they accept the invite link. That invite is your consent to share the recovery with that person. To revoke it, remove them from the circle.

You can withdraw consent at any time: email hello@sbros.com, or delete your account in the app under Account. When you withdraw consent, we stop collecting your consumer health data.

Who we share it with

People you invite into your recovery circle

They can see the recovery, the plan, the medication log, check-ins and questions for the visit. They join only by accepting an invite link themselves, and the person who started the recovery, or the patient, can remove them.

Service providers that run Postward for us

• Vercel hosts the Postward website and app in the United States. The categories above pass through its servers when you use the app.
• Supabase stores our database and handles sign-in, in a United States region. It stores all of the categories above.
• Stripe processes Recovery Pass payments. It receives what you enter at checkout and the fact of the purchase, not your recovery information.

These providers process consumer health data only to provide their service to us.

We do not share consumer health data with anyone else, including affiliates, advertisers or data brokers, unless the law requires it, such as under a valid court order.

Planned, not active

Text message and email reminders are planned but not turned on. Before we turn them on, we will update this policy and name the provider.

We may later offer to read photos of discharge papers using Anthropic’s API. This is not active today, and it would run only with your separate consent.

We do not sell it

We do not sell consumer health data. We do not use it for advertising, and we do not share it with data brokers.

Your rights

Whatever state you live in, you can:

• Confirm whether we collect or share your consumer health data.
• Access it, including a list of every third party we have shared it with and how to contact them.
• Correct it.
• Delete it, including copies held by our service providers.
• Get a copy of it to take elsewhere.
• Withdraw your consent to collecting or sharing it.
• Appeal if we turn down any of these requests.

How to use them

1. Email hello@sbros.com from the address on your account and say what you want. To delete everything, you can also delete your account in the app under Account.
2. We may ask you to confirm the request from that address.
3. We respond within 45 days.
4. To appeal, email hello@sbros.com with “Appeal” in the subject line. If we deny your appeal, you can contact the attorney general in your state, such as Washington’s, Nevada’s or Connecticut’s.

When deleted data is gone

We delete recovery data within 30 days of a deletion request, and backups roll off within 30 days after that.

A recovery is deleted when its last member leaves or when the person who started it deletes it. If other people are still in a circle when you delete your account, that recovery stays for them. If you want information deleted that you cannot delete yourself in the app, email hello@sbros.com.

Security

Our providers encrypt consumer health data in transit and at rest, and access to it is limited to the people who need it to run Postward. If a breach affects your data, we will notify you, and regulators where required, as the FTC Health Breach Notification Rule and state law require, and within 60 days of discovering it.

More information

Our Privacy policy covers account information, the waitlist, cookies and the rest of how Postward handles information. For anything else, email hello@sbros.com.