Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Entrewoven Company, a Delaware corporation doing business as “Valles” (collectively, “Valles,” “we,” “us,” or “our”), collects, uses, shares, and protects “consumer health data” through our communication and coordination service for parents and families connected through school communities (the “Service”).

This Policy supplements — and does not replace — our Privacy Policy and our Terms of Use. In the event of a conflict between this Policy and our general Privacy Policy with respect to consumer health data, this Policy controls.

This Policy applies to every member of the Service in the United States, regardless of the state in which you live. Rather than providing different protections in different states, we apply a single national standard modeled on the most protective state consumer health data laws, including the Washington My Health My Data Act (RCW 19.373), Nevada Senate Bill 370 (NRS 603A as amended), the consumer health data provisions of the Connecticut Data Privacy Act (as amended by Public Act 23-56), and the sensitive-data provisions of state comprehensive privacy laws, including the Minnesota Consumer Data Privacy Act. Where the law of your state provides you rights beyond those described here, those rights also apply to you.

For purposes of this Policy, “consumer health data” means personal information that is linked or reasonably linkable to a consumer (or a member of the consumer’s household, including a minor child for whom the consumer is the parent or guardian) and that identifies the consumer’s past, present, or future physical or mental health status. In the context of the Service, consumer health data typically includes:

• Food allergies, intolerances, and sensitivities (including life-threatening allergies)
• Dietary restrictions (whether medical, religious, cultural, or ethical, including celiac disease, lactose intolerance, vegetarianism, veganism, halal, kosher, and similar)
• Other health conditions you choose to disclose in connection with a signup, RSVP, family profile, or related coordination feature

We do not knowingly collect: clinical diagnoses, prescription or medication records, biometric data, genetic data, precise geolocation data linked to health activities, mental health treatment records, or reproductive health information. If you provide any of those categories in free-text content (e.g., the body of a message), please contact us at the address below and we will delete it.

We collect only the categories of consumer health data that you (or, where applicable, a parent or guardian acting on behalf of a minor child) voluntarily choose to enter into the Service. These categories are:

• Allergy and intolerance information — including the substance(s) involved, severity, and any free-text notes you provide;
• Dietary restriction information — including the type of restriction and any free-text notes you provide;
• Other health-related notes — to the extent you choose to enter additional context (for example, “carries an epinephrine auto-injector at all times”).

We do not collect consumer health data automatically. We do not infer consumer health data from device, browsing, or location signals. We do not use geofencing of any kind in connection with consumer health data.

We collect and process consumer health data solely to:

• Display the data to the participants in the same signup, event, or group that you have chosen to share it with — for example, displaying a child’s peanut allergy on a classroom snack signup so that the parent bringing the snack can see it;
• Provide reminders, summaries, and notifications about that data to the participants you have chosen to share it with;
• Maintain and secure the Service (including troubleshooting, fraud prevention, and keeping backups);
• Respond to your support requests;
• Comply with our legal obligations.

We do not use consumer health data to serve advertising. We do not use it to train any machine-learning or artificial-intelligence model. We do not use it for profiling. We do not sell it.

Consumer health data on the Service comes from one of three sources:

• You, when you enter the information about yourself directly;
• A parent or guardian acting on your behalf, if you are a minor and a parent or guardian has entered information about you under their account;
• Another adult user with whom you have an explicit relationship, in the limited case where, for example, a spouse has added information about you to a shared household profile and you have agreed to that arrangement.

We do not receive consumer health data from data brokers, advertising networks, public records aggregators, or any other third-party source.

We share consumer health data only:

• With the participants you choose — for example, the other parents in a snack signup, the host of an event you RSVP to, or members of a group where you have posted the information. You control these audiences through the privacy and sharing controls within the Service, and we ask for your consent before your data becomes visible to any new audience (see Section 8.2).
• With our processors and service providers — including cloud hosting providers and security vendors who store or process the data on our behalf, subject to written contracts that prohibit them from using the data for any purpose other than providing services to us. A current list of these providers is available on request at the contact address below.

We do not share consumer health data with advertisers, advertising networks, data brokers, or any party for cross-context behavioral advertising. We do not sell consumer health data. We do not share consumer health data with affiliates for marketing purposes.

We may disclose consumer health data if we believe in good faith that disclosure is required to comply with a legal obligation, respond to a lawful subpoena or court order, or protect the rights or safety of Valles, our users, or the public. We will notify you of any such disclosure unless prohibited by law.

Every member of the Service in the United States has the following rights with respect to their consumer health data, regardless of state of residence:

• Right to confirm and access. You may confirm whether we are collecting, sharing, or selling your consumer health data, request a list of the third parties and affiliates (if any) with whom we have shared it, and request access to a copy of the data we hold about you. We will respond within 45 days of a verified request (extendable once by 45 days where reasonably necessary, with notice to you).
• Right to withdraw consent. You may withdraw consent for our collection and sharing of your consumer health data — entirely, or for a specific data element, or for a specific audience — at any time. Withdrawal does not require a reason, must be at least as easy as the way you gave consent, and may not be conditioned on any other action. We will give effect to your withdrawal as soon as practicable and in no event later than 15 days after receiving it.
• Right to delete. You may request that we delete consumer health data we have collected about you. We will delete it from our active systems, and from archives and backups on their next scheduled cycle, within 30 days of a verified request, and we will instruct our processors and any third party with whom the data was shared to do the same, except where retention is required by law (in which case we will isolate the data and not use it for any other purpose).
• Right against discrimination. We will not deny you Service, charge you a different price, or provide a different quality of Service because you exercised any of the rights described in this Policy or because you declined to provide consumer health data at all.
• Right to appeal. If we decline a request, you may appeal by replying to our response or contacting us at the address below. We will provide a written explanation of our final decision within 45 days. If your appeal is denied, we will provide you a way to contact your state attorney general.

How to Exercise These Rights

You may exercise these rights directly in the app (Settings → Privacy → Health & Dietary Information) or by contacting us at privacy@valles.app with “Consumer Health Data Request” in the subject line. We may ask for additional information to verify your identity before processing your request, but we will limit that information to what is reasonably necessary.

Authorized agents may submit requests on your behalf with appropriate authorization documentation.

We obtain your specific, informed, voluntary, and unambiguous opt-in consent before we collect or share any consumer health data. Consent requests are presented separately from the Terms of Use and from any other transaction; they clearly describe the categories of data involved, the purpose, and the specific people or audience who will be able to see the data; and they never use pre-checked boxes, obscured language, or interface designs intended to steer your choice (“dark patterns”). Consent to collect is obtained separately from consent to share. Providing consumer health data is always optional. We will never condition your access to the Service, or to any core feature, on your consent to provide, collect, or share consumer health data.

8.1 Consent at Collection

Before you first enter consumer health data into any feature (for example, a family profile allergy field, or an RSVP that requests dietary information), we present a contextual consent prompt specific to the data being entered. Where the law of your state requires it, that prompt is a separate screen shown before anything is saved; everywhere, the control that saves food needs carries a line stating that saving them is your agreement to this Policy. This consent may be granted or refused independently of any prior consent, and refusing it does not affect your use of the rest of the Service.

8.2 Consent to Each Sharing Audience

Consumer health data is shared only with audiences you approve. When you take an action that would make your consumer health data visible to a new recipient or audience — for example, joining a new signup, RSVPing to an event hosted by someone who has not previously had access, or posting to a new group — we present a consent prompt identifying that audience before the data is shared. Consent to one audience is never treated as consent to another.

8.3 New Consent for Expanded Sharing

If a proposed use or share of your consumer health data would exceed the scope of a consent you previously gave — for example, sharing with a broader audience, a new category of recipient, or for a new purpose not disclosed at the time of your original consent — we obtain a new, separate consent before that use or share occurs. We do not apply material changes to this Policy retroactively to previously collected consumer health data without obtaining new consent.

8.4 Sale of Consumer Health Data

We do not sell consumer health data, and we have no plans to do so. If that were ever to change, no sale would occur without a separate, signed, valid authorization from you that identifies the specific data sold, the purchaser, and the purpose of sale; any such authorization would expire one year after signature and would be revocable at any time. We note that the sale of this category of data is prohibited outright in some states (for example, Maryland), and we would honor those prohibitions.

8.5 Effect of Withdrawal

If you withdraw consent (in whole or in part), we: (a) stop collecting the covered consumer health data from you; (b) stop sharing the covered data with other users, including users who previously had access through a signup, event, or group — their access ends; (c) notify any host or organizer whose event includes data you had shared that access has been withdrawn (without disclosing the underlying data); (d) make clear to that host that they may re-request access from you; and (e) delete the previously collected data within 30 days unless retention is required by law. Withdrawal takes effect as soon as practicable and no later than 15 days after we receive it.

8.6 Records of Consent

We keep a record of each consent and each withdrawal — including the text presented, the scope, the date, and the version of this Policy in effect — for at least six years, so that we can demonstrate and honor the exact scope of what you agreed to. A guest who confirms a phone number or email address to respond to an invitation, without creating an account, may give consent the same way; we keep that record with the details the host saved for them, and it becomes part of their account if they later create one.

The Service is designed for parents and guardians. Parents and guardians may, in their discretion, enter consumer health data about their minor children for the purpose of coordinating with the family’s school community.

A parent or guardian providing consumer health data about a minor child represents that they have the legal authority to do so. The parent or guardian may, at any time, review, modify, or delete the data they have entered, and may withdraw consent on behalf of the child. We treat data about a minor as part of the parent’s or guardian’s account for purposes of access and deletion rights, and we apply every protection in this Policy — including the consent requirements of Section 8 — to children’s data with at least the same rigor as adults’ data.

We do not knowingly collect consumer health data directly from a child under 13. If we learn that we have done so, we will delete it promptly. See our general Privacy Policy Section 10 for additional COPPA-related disclosures.

We protect consumer health data with the technical and organizational safeguards described in our general Privacy Policy, including encryption in transit and at rest, access controls limiting employee access on a need-to-know basis, and regular security review. Access by employees to consumer health data is logged and subject to additional internal authorization requirements.

No method of transmission or storage is perfectly secure. We will notify you and any relevant authority of any breach involving your consumer health data as required by applicable law.

We retain consumer health data only as long as it remains relevant to an active signup, event, group, or family profile in which you have chosen to share it, and for a short additional period to allow for restoration in case of accidental deletion. Specifically:

• Active data: retained while the signup, event, group, or profile is active;
• Inactive data: deleted within 90 days after the related signup, event, group, or profile is closed, deleted, or has been inactive for 12 months, whichever is sooner;
• Withdrawn-consent data: deleted within 30 days of consent withdrawal, except where retention is required by law.

We do not retain consumer health data after account deletion except as required by law.

This Policy applies to all members of the Service in the United States, in every state, from the date you create your account. Every member is asked to review and acknowledge this Policy at signup. Acknowledging this Policy is not the same as consenting to the collection or sharing of your consumer health data — that consent is requested separately, as described in Section 8, only if and when you choose to use features that involve consumer health data, and it is never a condition of using the Service.

We may update this Policy from time to time. When we make material changes, we will notify you by email or through a prominent in-app notice at least 30 days before the changes take effect. The “Last Updated” date at the top of this Policy reflects the most recent revision. We will not apply changes retroactively to data collected under a prior version of this Policy without obtaining new consent.

To exercise any right described in this Policy, ask a question, file a complaint, or report a concern about our handling of consumer health data, contact:

Entrewoven Company (d/b/a Valles) privacy@valles.app Subject line: “Consumer Health Data Request”

You may also contact your state attorney general, including:

• Office of the Washington State Attorney General — https://www.atg.wa.gov/file-complaint
• Office of the Nevada Attorney General — https://ag.nv.gov/Complaints
• Office of the Connecticut Attorney General — https://portal.ct.gov/AG
• Office of the Minnesota Attorney General — https://www.ag.state.mn.us