Updated agreement effective September 11, 2026 at 12:00 PM Mountain Time (18:00 UTC). Current and previously accepted versions remain available in BxConnect’s legal settings.

Privacy & Health Data Consent (Family / Individual Use)

This consent is between you and BxConnect, LLC ("BxConnect," "we," "us"). By checking the consent box and accepting, you give your affirmative, informed consent for BxConnect to collect and process the behavioral and health-related information described below, for the purposes described below. This consent works together with the BxConnect Privacy Policy (available in the app's legal settings and at www.bxconnect.net), which describes our practices in more detail.

What this means (plain-language summary)

  • What we collect: the behavioral and health information you choose to enter about yourself or your child — plus your account details and basic technical data.
  • What we use it for: showing your own data back to you — charts, reports, goals, and progress. Nothing else without asking you first.
  • What we never do: we never sell your health data. We never use it for advertising. We never share it except with the service providers that run our platform, people you choose to share with, or when the law requires.
  • You're in control: you can export your data, delete your account and data, or withdraw this consent at any time, in the app or by emailing support@bxconnect.net.

The summary above is part of this consent; the sections below add detail and control if anything differs.

1. What We Collect

With your consent, we collect:

  1. Health and behavioral information you enter — observations, behaviors, goals, session records, notes, charts, and similar information about you or a child in your care. This is "consumer health data" under laws like Washington's My Health My Data Act.
  2. Account information — your name, email address, and authentication credentials (your password is held by our identity provider — Amazon Cognito, an Amazon Web Services service, or Okta/Auth0 until our sign-in migration completes — and BxConnect does not store it).
  3. Technical and usage data — IP address, device and browser information, and logs of app activity, used for security and to operate the service.
  4. Notification settings and delivery records — your notification preferences and the notification records shown in your in-app inbox; and, only if you turn on push or email notifications, your device's push-registration token and whether a message was delivered, bounced, or reported as spam. For bounce and spam-report records we keep a keyed cryptographic hash of the address rather than the address itself (Section 7).

We collect only what is reasonably necessary to provide the service. We do not collect health data from your device's sensors, from other apps, or from data brokers.

2. How We Use It

We use the information above only to:

  1. provide the service to you — recording, displaying, charting, and reporting your own data back to you and to anyone you explicitly invite to it, and delivering the optional notifications you choose to turn on (Section 4);
  2. operate, secure, and troubleshoot the service (including fraud and abuse prevention);
  3. respond to your support requests; and
  4. comply with legal obligations.

We do not use your identifiable health data for advertising, for marketing segmentation, or to train artificial-intelligence models. We may use de-identified or aggregated data that can no longer reasonably identify you or your child to analyze and improve the service; we will not attempt to re-identify it.

3. Consent for a Child's Data

If you record information about a child:

  1. You represent that you are the child's parent or legal guardian, or otherwise have legal authority to consent to the collection of the child's information, and you provide that consent on the child's behalf.
  2. BxConnect accounts are held by adults. We do not knowingly permit children under 13 to create accounts or collect information directly from them; information about a child is entered and controlled by you. Where the Children's Online Privacy Protection Act applies, your consent under this section is the verifiable parental consent for that collection.
  3. When a child becomes old enough to manage their own information under applicable law, they (or you) may contact us to transfer or delete it.

4. Sharing

We share your information only:

  1. with our service provider that hosts and operates the platform — currently Amazon Web Services (cloud hosting, sign-in through Amazon Cognito, and account and notification email delivery through Amazon Simple Email Service) — under a contract limiting it to processing data for us. We are moving sign-in from Okta/Auth0 to Amazon Cognito; during the transition both process your account identity and sign-in information, and Auth0 is removed from this list when it is retired; and, only if you turn on push or email notifications (a separate choice you make in notification settings, and can withdraw there without deleting your account), with the delivery providers for that channel: Apple's and Google's push services, which process your device's push identifier and delivery information, or your email provider via ordinary internet email. We omit your and your child's names and all health content from those messages — they carry only a fixed generic text or a count of new updates — but those providers, and anyone who can see your lock screen or inbox, can see that you use BxConnect and when you receive alerts;
  2. with people you choose — sharing in the app happens only through invitations and access you control;
  3. when required by law — e.g., a valid subpoena or court order, in which case we will notify you unless legally prohibited; or
  4. in a business transfer (merger or acquisition), in which case this consent and the Privacy Policy continue to protect your data and we will notify you of any change in control.

We never sell your health data, and we never share it for advertising. A sale of consumer health data would require your separate, explicit authorization under laws like the My Health My Data Act — and we do not ask for one because we do not sell data.

5. Your Rights & Choices

You may, at any time and without penalty:

  1. Access and export your data using the app's export features or by emailing us;
  2. Correct information by editing it in the app;
  3. Delete your data by deleting individual records or your entire account in the app's account-deletion flow (or by emailing us) — deletion removes your data from active systems, with backups expiring in the ordinary course and limited legal-compliance records (like this consent's acceptance evidence, and the email-deliverability record described in Section 7) retained as required;
  4. Withdraw this consent by deleting your account or emailing support@bxconnect.net — withdrawal stops all further collection and processing; because the service cannot operate without processing the data you enter, withdrawal ends your use of the service. Withdrawal does not affect processing that happened before it. Turning off an optional notification channel (Section 4.1) is separate: it withdraws only that sharing choice and your account remains usable.
  5. Exercise any additional rights your state's law provides (e.g., under Washington's My Health My Data Act or the California Consumer Privacy Act), including the right not to be discriminated against for exercising them. We will respond to rights requests within the time your state's law requires (and in any case within 45 days). If we deny a request, we will explain why and how to appeal by replying to our response.

6. Security

We protect your data with safeguards including encryption in transit and at rest, column-level encryption of sensitive fields, strict per-family data isolation enforced at the database layer, authenticated access, and audit logging. No system is perfectly secure; if a breach affecting your unsecured health data occurs, we will notify you as required by law, including the FTC's Health Breach Notification Rule.

7. Data Retention

We keep your data while your account is active. When you delete data or your account, we delete it from active systems as described in Section 5.3. We retain the record of this consent (the text you accepted, when, and by whom) for at least six (6) years, as evidence of authorization, even after account deletion. If email to your address bounced or you reported one of our messages as spam, we also keep a keyed hash of that address after deletion — pseudonymous, not anonymous: we can match it using a separately protected key — for the period in our retention schedule, used only so that we do not email that address again and, while your account exists, to show you its delivery status, subject to any deletion right your state's law gives you. Amazon SES keeps suppressed addresses on its own account-level list; push identifiers held by Apple/Google are removed on their schedules after we request deletion.

8. Changes

New versions of this consent are published with a new version number through the in-app agreement system. A material change is presented to you for fresh acceptance before continued use — your prior consent stays in force until you accept the new version, and we never expand how we use your data without asking first.

9. Contact

BxConnect, LLC — support@bxconnect.net