Consumer Health Data Privacy Policy

Consumer Health Data Privacy Policy

Last updated: October 26, 2026

This Consumer Health Data Privacy Policy explains how Room for Tomorrow, Inc. (“we”, “us”) handles “consumer health data” in its product by the name and style of FamilyBeats. It is written to meet laws such as Washington’s My Health My Data Act, Nevada's consumer health data law, and Connecticut's consumer health data provisions. We apply it to every FamilyBeats participant, wherever they live in the United States. It supplements our main Privacy Policy. If the two conflict on consumer health data, this policy applies. The current pilot is an invitation-only web application accessed through personalized links, with instructions for adding it to a device’s home screen. Adding it to the home screen does not install a native App Store or Google Play application. No native iOS or Android application is currently offered; native-app provisions apply only if one is introduced.

1.What consumer health data we collect

We treat the following as consumer health data, because it may reveal information about a person's physical, mental or emotional health:

We do not collect precise location, biometric data, medical records, diagnoses or treatment information. Written notes, AI-assisted features and product analytics are currently off. We will not enable any of these features for a teen unless the parent or legal guardian and the teen each receive the required disclosures and separately opt in. We do not currently use any AI service to analyze your data. If we introduce AI features, we will send consumer health data to an AI provider only after obtaining your separate, opt-in consent, which will name the provider and describe the purpose. We will use an AI provider only under a written agreement that bars the provider from using consumer health data to train any model and limits retention to the period necessary to provide the feature.

2.Sources

We collect this information directly from you when you use FamilyBeats. For a teen aged 13 to 17, we collect it from the teen after their parent or legal guardian has authorized them and consented, and after the teen has agreed.

3.Why we collect and use it

We do not use consumer health data for advertising, profiling, sale, or any purpose not listed here.

4.Your consent

We collect consumer health data only with your consent. That consent is separate from your agreement to our Terms of Use and Privacy Policy. Adults give it for themselves. For a teen, the parent or legal guardian gives it, and the teen also agrees.

You can withdraw consent at any time by emailing privacy@roomfortomorrow.com from your account email address. We verify the request using a one-time code under section 7. If you withdraw, we stop collecting Tap Ins from you and delete your consumer health data as described in section 7.

If a parent or legal guardian withdraws authorization for a teen, we pause the teen's account within 1 business day after verification and delete the teen's live account and consumer health data when the 30-day re-authorization window ends unless another eligible parent or legal guardian re-authorizes the teen, subject to the separate record-retention periods in section 7.

If the authorizing adult leaves the Circle or their account is deleted, we also pause the teen’s account, sign out active sessions and prevent sign-in. We notify the other Circle adults. The same 30-day re-authorization period runs from that pause. These deadlines concern live systems; existing backup copies expire under the separate backup lifecycle in the Privacy Policy.

Withdrawal of Tap In health-data consent stops further collection and sharing of the affected information. After verification, we initiate deletion of existing identifiable Tap In moods and topics, related shared health items and identifiable derivatives under the disclosed deletion schedule; no second deletion request is required. This does not itself delete your whole account.

The 30-day guardian re-authorization window applies to withdrawal of authorization to use FamilyBeats, not to withdrawal of Tap In health-data consent. To restart Tap In collection after withdrawal, a teen and an eligible parent or legal guardian must each give fresh, separate affirmative consent to the current disclosures.

Neither person’s renewed consent overrides the other’s refusal. New consent records include the actor, scope, date, time and wording version and are appended without erasing withdrawal history. Collection resumes only after all required consents are valid. Renewed consent does not restore deleted Tap Ins from backups or automatically republish hidden shares; sharing requires a fresh choice. During the pilot, re-authorization may be completed through privacy@roomfortomorrow.com with supervised verification and recorded affirmative agreements. The teen remains signed out and unable to sign in until current guardian authority and all required guardian and teen agreements are valid. Re-authorization must be completed within the 30-day window; merely sending an inquiry does not extend it. If it is not completed in time, live account data is deleted at the end of the window under the disclosed policy, with backups and limited records following their separate schedules. A teen’s refusal cannot be overridden by a guardian’s request to resume participation.

5.Who we share it with

We do not sell consumer health data, and we do not share it with third parties except service providers (processors) listed in this policy. Railway hosts FamilyBeats and stores consumer health data on our behalf. Browser push delivery is described in the main Privacy Policy, including Apple, Google and Mozilla services depending on the participant’s browser and platform. Browser permission is separate from health-data consent. A delivery service does not receive access to the underlying Tap In database merely because it routes a notification. Our production web service and SQLite persistent storage volume are in EU West (Amsterdam, Netherlands). If we add another processor that will receive consumer health data, we will update this policy to name that processor before using it and will require a written agreement limiting its use to providing services to us. If we add a payment processor, we will not share consumer health data with it.

Your Tap In moods, topics, history and My Pulse reflections are private. Parent or guardian authorization does not give the adult access to them. Each time you choose to share an eligible Family Signal, moment or mood word, you first see exactly what the Circle will see. Family-level counts include private Tap Ins but do not name anyone or reveal an individual’s mood, topic or history; they remain hidden until at least three Circle members are active.

If we ever wanted to share consumer health data with anyone else, we would first ask for your separate consent, describing who would receive it and why. After withdrawal or deletion, existing historical participation totals may remain only where they cannot reasonably be linked to an individual or reveal their participation or health information.

We do not retain individual contribution links for such totals. We suppress or recompute small-group counts where context or comparison could identify an individual. A three-active-member threshold alone is not a guarantee of anonymity; withdrawn data is not used to produce new identifiable insights.

We may disclose information if required by law (for example, a valid subpoena or court order). Where the law allows, we will tell the affected person first.

6.Your rights

Whatever state you live in, you can exercise the following rights. A teen may exercise their own rights, and their parent or legal guardian may submit a request on their behalf, subject to verification. Authorization alone does not give the adult access to the teen’s private Tap Ins or My Pulse. You can:

7.How to make a request, and our timelines

Email privacy@roomfortomorrow.com. We verify requests through secure account or email verification, including a one-time code where needed, and request information reasonably necessary to confirm identity and any representative’s legal authority.

A teen may request deletion without guardian permission. Requests on a teen’s behalf require verification of the requester’s identity and legal authority, not solely the original authorizer’s email address. We aim to acknowledge the request within 2 business days and delete live account data within 7 days after verification.

Existing backup copies expire under the lifecycle described in the Privacy Policy, rather than being individually edited.

Backup retention is measured from backup creation, not from verification of a deletion request. Legacy monthly backups expire on their existing schedule. These backup periods are separate from live-system deletion and the retention of logs and consent/request records; they are not an overall deadline for erasing every retained record. Infrastructure logs and narrowly retained consent/request records follow their separate schedules.

We will explain the action taken and any remaining backup retention when responding to the request. Daily volume backups are retained for 6 days and weekly volume backups for 27 days from creation. New monthly backups are disabled. Previously created monthly backups may remain until their scheduled expiration. Information deleted from live systems may remain in existing backups until those backups expire. Backups are retained for reliability and disaster recovery, not ordinary account use. If a backup is restored, we will reapply applicable deletions before resuming ordinary processing.

Railway infrastructure logs have a 30-day history and support reliability, security and troubleshooting, not advertising or behavioral profiling. Application records have separate retention schedules. See the Privacy Policy for the log categories and backup lifecycle. You may use authenticated account controls made available in FamilyBeats or email privacy@roomfortomorrow.com. We verify identity and, for a representative, legal authority using information reasonably necessary for the request.

An authenticated in-app action may provide verification; an additional code is used where needed for security. A teen may act for themselves without guardian approval. A parent or legal guardian with verified legal authority may act on the teen’s behalf even if not the original authorizer. Circle-admin or grandparent status alone is insufficient; relevant custody restrictions are respected. Authorization does not itself give access to private Tap Ins. During the private pilot, authorized Room for Tomorrow personnel handle privacy requests, appeals, guardian verification and re-authorization through a documented email-based process. You do not need an automated in-app workflow to submit a request. The product enforces the applicable access restrictions while personnel record and carry out the verified decision. General support may direct a privacy request to privacy@roomfortomorrow.com without requiring you to submit it again. We record receipt, verification, the decision, action and response, and explain any refusal and the available appeal process. A completion response identifies what was deleted and explains any narrowly retained records or backup copies; it does not state that every retained copy has been erased if permitted copies remain. An eligible authorizing adult must be at least 18 and be the teen’s parent or legal guardian with current legal authority to authorize participation. We consider relevant custody or guardianship restrictions; Circle-admin or grandparent status alone is insufficient. We ordinarily use the recorded relationship and authority attestation with secure account or email verification, and request additional evidence reasonably necessary where authority is unclear or disputed. Possession of an email account or a prior consent record alone does not resolve a genuine dispute over current legal authority. We record the verification method, outcome and authority basis alongside the consent. We do not routinely retain full identity documents or court records; where supporting evidence is needed, we seek relevant redacted information and retain it only as long as reasonably necessary. Consent and authorization evidence follows the consent-record schedule, while request-handling logs follow the separate 24-month schedule; neither is used to retain Tap In content.

Deletion of Tap In health data also removes replies linked to deleted health items where needed to remove their context, and deletes or regenerates identifiable insights derived from that information. Unrelated content belonging to other members is not automatically deleted. AI-derived insights are addressed only if an AI feature is subsequently introduced under the required separate consents. Whole-account deletion removes the departing member’s own replies, including replies they left on another member’s shares, as described in the account-deletion provisions. Withdrawal or deletion of Tap In health data alone removes replies that contain or are linked to the affected health information where needed to remove that context; it does not automatically delete the member’s unrelated replies or other members’ independent content. Identifiable Circle text or other derivatives based on deleted health information are deleted or regenerated without the withdrawn information. AI-generated Circle text is a prospective case only: AI remains off and this language does not authorize enabling it without the required separate disclosures and consents.

Appeals. If we decline your request, we will explain why. You can appeal by replying with “Appeal” in the subject line. We will respond within 45 days. If you are not satisfied, you may contact your state Attorney General (for example, the Washington State Attorney General at www.atg.wa.gov/file-complaint).

How long we keep the data. We keep consumer health data while your account is active. Each family’s free pilot evaluation lasts 14 days. We send a reminder at least 7 days before day 14. Continuing requires an adult’s affirmative confirmation; for a teen, the parent or legal guardian confirms and the teen agrees. If the family continues, its history is retained; if it declines, its data is deleted from live systems within 30 days, with existing backups expiring under the separately disclosed backup schedule. If a family does not respond at the end of its 14-day evaluation, we retain its data unused for a 90-day recovery period and then delete it from live systems within 30 days, with existing backups expiring separately. A paused teen's live account and data are deleted when the 30-day re-authorization window ends unless another eligible parent or legal guardian re-authorizes the teen, subject to the separate record-retention periods below. Inactive accounts are deleted after 24 months of inactivity and at least 30 days' notice. During the pilot, reminders and continuation choices may be communicated and recorded by email through a supervised process. If an adult wants to continue but the teen declines, the teen does not continue: access and further collection are stopped, and the teen’s live data is deleted within the disclosed 30-day pilot-decline period unless the teen requests earlier deletion under the 7-day verified-request target. Eligible adults and other participating members may continue their own use; the teen’s refusal does not require deleting unrelated family information or closing the entire Circle. For nonresponding families, access is suspended during the 90-day recovery period except as needed to exercise privacy rights or request recovery. Information is retained unused, with no new Tap Ins, sharing or ordinary processing. Recovery requires a documented affirmative continuation decision and, for a teen, both current guardian authorization and the teen’s agreement; silence or the adult’s decision alone is insufficient.

Records we keep after deletion. We keep a request log (dates received, verified and completed) for 24 months, and authorization and consent records solely as proof of authorization and consent while the relevant account exists plus 3 years. For teen authorization and consent records, this period runs while the teen’s account exists plus 3 years. If the authorizing adult leaves or deletes their account, the link to that adult’s account is cleared; their stated relationship, wording version, authorization date and former account identifier, without name or email, are retained under that schedule. Re-authorization adds a new record without overwriting prior history. Neither contains Tap In content.

8.Security

We protect consumer health data with access limited to authorized Room for Tomorrow personnel under written confidentiality obligations, with Railway workspace audit logs for administrative activity, encrypted connections (HTTPS), salted password hashing, separation between Circles, and persistent volumes and volume backups that Railway states use AES-256 encryption at rest, with Railway-managed keys. No system is completely secure. If an incident affects your data, we will notify you as the law requires.

9.Changes

We will notify you before making any material change to this policy. If the change affects a teen, we will notify both the teen and the parent or legal guardian and obtain any required renewed agreements or consents. We will ask for your consent again before collecting or using consumer health data in a materially different way.

10.Contact

Room for Tomorrow, Inc.

Email: privacy@roomfortomorrow.com.

General app support: support@roomfortomorrow.com.

Health Data Consent and Sharing

Room for Tomorrow, Inc. collects and stores Tap In moods and topics and derives My Pulse reflections and the disclosed counts to provide these features and keep them secure. Railway hosts and stores this information on our behalf. The health-data selection is separate from Terms acceptance and does not authorize Circle sharing or future AI features. You may withdraw using available account controls or by emailing privacy@roomfortomorrow.com. Each eligible share requires a separate affirmative choice identifying the item and Circle recipients. Where additional guardian sharing permission is required, we obtain it separately from collection/storage consent before sharing is enabled.