Privacy Policy

Introduction

Login.Health, Inc. ("Login.Health," "we," "us," or "our") operates the Login.Health Wallet mobile application and web platform (the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information and health data when you use our Services.

We are committed to protecting your privacy and maintaining the security of your health information. Our platform is designed with a zero-knowledge architecture, meaning your health data is encrypted on your device before being stored, and we cannot access or view your unencrypted health records.

Information We Collect

Information You Provide

Account Information

• Email address
• Password (stored only as a secure hash)
• Name (optional)
• Phone number (optional, for account recovery)

Identity Verification Data

When you verify your identity through ID.me:

• Verification status (verified/not verified)
• Identity Assurance Level (IAL) achieved
• We do NOT receive or store your government ID documents, Social Security number, or other sensitive identity documents - these are processed solely by ID.me

Health Records

• Medical records imported from healthcare providers
• Lab results, immunizations, medications, and other health data
• Health records you manually add or upload

Information Collected Automatically

Device Information

• Device type and operating system
• App version
• Device identifiers (for push notifications)

Usage Data

• App feature usage (anonymized)
• Crash reports and error logs
• Performance metrics

We do NOT collect:

• Location data
• Contact lists
• Photos (except QR codes you explicitly scan)
• Browsing history
• Data from other apps

How We Use Your Information

We use your information to:

1. Provide Services

• Create and manage your account
• Store your encrypted health records
• Enable health record sharing via SMART Health Links
• Process TEFCA queries to import health records

2. Security and Authentication

• Verify your identity
• Authenticate your access to the Services
• Detect and prevent fraud

3. Improve Our Services

• Analyze usage patterns (anonymized)
• Fix bugs and improve performance
• Develop new features

4. Communications

• Send important account notifications
• Respond to your inquiries
• Provide customer support

How We Share Your Information

We MAY share information:

With Your Consent

• When you create a SMART Health Link to share records
• When you add family members to a CareCircle
• When you explicitly authorize sharing with a healthcare provider

With Service Providers

• Cloud hosting providers (who store only encrypted data)
• ID.me (for identity verification only)
• Sentry (for crash reporting - no health data included)

For Legal Reasons

• To comply with legal obligations
• To protect our rights or safety
• To respond to valid legal requests

Data Security

We implement industry-standard security measures:

Encryption

• All health data is encrypted using AES-256 before leaving your device
• Encryption keys are stored in your device's secure enclave
• Data in transit is protected by TLS 1.3
• Zero-knowledge architecture means we cannot decrypt your data

Access Controls

• Multi-factor authentication available
• Biometric authentication (Face ID/Touch ID/fingerprint)
• Automatic session timeout
• Device-based encryption key management

Infrastructure Security

• SOC 2 Type II certified infrastructure
• Regular security audits
• Penetration testing
• 24/7 monitoring

Your Rights and Choices

You have the right to:

Access and Export

• View all data we have about you
• Export your health records in standard formats (FHIR, C-CDA)
• Download your account data

Correction and Deletion

• Update your account information
• Delete your account and all associated data
• Request removal of specific health records

Control Sharing

• Revoke SMART Health Links at any time
• Remove members from CareCircles
• Control what data is visible to caregivers

Communication Preferences

• Opt out of non-essential emails
• Manage push notification settings

To exercise these rights, contact us at [email protected] or use the settings within the app.

Data Retention

• Account Data: Retained while your account is active
• Health Records: Retained until you delete them
• Usage Logs: Retained for 90 days
• Crash Reports: Retained for 30 days

When you delete your account:

• Account information is deleted within 30 days
• Encrypted health data is permanently deleted
• Backup copies are purged within 90 days

Children's Privacy

Login.Health is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected information from a child under 13, please contact us at [email protected].

For children 13-17, a parent or guardian may create a CareCircle to manage their health records with appropriate consent.

HIPAA Compliance

Login.Health is designed to help you manage your own health information. When you use our Services:

• Your health data is your Personal Health Record (PHR)
• We act as a technology provider, not a healthcare provider
• Our zero-knowledge encryption means we cannot access your Protected Health Information (PHI)
• When you share data with healthcare providers, their HIPAA obligations apply

California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information we collect
• Right to delete personal information
• Right to opt-out of sale (we do not sell data)
• Right to non-discrimination

To exercise these rights, contact [email protected].

International Users

Login.Health is operated in the United States. If you access our Services from outside the US:

• Your data may be transferred to and stored in the US
• US data protection laws may differ from your country
• By using the Services, you consent to this transfer

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting the new policy on our website and in the app
• Sending you an email notification
• Displaying a prominent notice in the app

Your continued use after changes constitutes acceptance of the updated policy.

Contact Us

For privacy-related questions or concerns: