Effective September 11, 2026 at 12:00 PM Mountain Time (18:00 UTC).

Consumer Health Data Privacy Policy

This policy explains how BxConnect, LLC handles consumer health data covered by Washington's My Health My Data Act, including applicable data from family and individual use. Some health or education records are subject to separate legal protections or statutory exemptions. This policy supplements our Privacy Policy and Privacy & Health Data Consent.

Data we collect and why

We collect the observations, behaviors, goals, session records, notes, charts, and other behavioral or health information you or an authorized collaborator enter about you or a child in your care. We use these records to provide the tracking, collaboration, reporting, and account features you request.

We collect account and contact information, including name and email; technical information such as IP address, device/browser information, and access logs; and notification preferences and delivery records. Where those records identify your use of a behavioral-health service, they may be consumer health data. We use them to operate and secure accounts, provide requested communications, resolve support requests, and document access and consent. Optional push uses a device identifier and delivery information; optional email uses your address and delivery information. Bounce/complaint records help avoid unwanted or undeliverable email.

We do not obtain health data from device sensors, other apps, or data brokers. We do not sell consumer health data or use identifiable health data for advertising or AI-model training.

Sources

Data comes from you; from parents, guardians, clinicians, or other collaborators authorized to contribute or share records; from your interaction with BxConnect; and from service providers returning sign-in, security, or message-delivery results. Information about a child is supplied by an adult with appropriate authority.

Categories shared and recipients

Our contracted infrastructure and identity providers process the account, technical, and health records needed to operate BxConnect. Amazon Web Services provides hosting and Amazon Cognito sign-in. Okta/Auth0 also processes account identity and sign-in information during the migration until it is retired.

When you enable an optional channel, Google Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service process push identifiers and delivery information. Amazon Simple Email Service and your email provider process email addresses and delivery information. External alerts use generic text rather than names or clinical records, but receiving one can reveal that you use BxConnect. Our providers process information to supply these services, not for advertising on our behalf.

Records you choose to share are available to the authorized people and organizations you select through BxConnect's access controls. We may disclose relevant information to legal authorities when required by law, or to a successor in a business transaction subject to applicable protections and legal requirements. We do not currently share consumer health data with corporate affiliates.

Your choices and rights

You may request confirmation of collection or sharing, access to your data, and the list and contact details of third parties and affiliates with whom it was shared or sold. You may withdraw consent to collection or sharing and request deletion, including required downstream handling. Access and deletion tools are available in the app. Optional push and email can be turned off in notification settings; email also offers unsubscribe. Withdrawing an optional channel does not close your account.

To exercise rights or appeal a decision, email support@bxconnect.net. Identify the account and the request; do not include clinical details in the email. We verify requests using reasonable account-ownership checks and respond within the applicable legal time limits. You do not need to create an account to make a request. If we deny a request, we explain the reason and how to appeal. You can also contact the Washington Attorney General through its complaint process.