Consumer health data privacy policy

Last updated: 13 October 2026

Some Keepy agents, such as Medical ID, can keep health information about you or someone you look after. We know how personal this is, so this policy explains exactly what we collect, why, who sees it and how you stay in control. It is written for the Washington My Health My Data Act, Nevada’s consumer health data law, Connecticut’s consumer health data rules and similar laws, and it applies to everyone who uses Keepy. It adds to our Privacy Policy.

Keepy is not a healthcare provider, a medical device or an emergency service. We don’t give medical advice, we don’t check health information, and we don’t contact emergency services for anyone. These agents simply keep what you choose to save, so that someone who finds the person can reach their family and pass on what you chose to share.

1. The health information we collect

Only if you choose to give it to one of these agents, we may collect, about you or someone you look after:

• health conditions or symptoms you describe;
• allergies and medications;
• blood type;
• hearing, sight, mobility or communication needs, and the language the person understands;
• notes on how they may behave and what to do;
• a doctor’s name and contact details;
• what a person who finds them writes about how they seem; and
• the fact that someone uses such an agent, and when and where its QR code was scanned. Together with the information above, this could suggest a health condition.

We don’t ask for, and please don’t save, government ID numbers, insurance numbers, a home address, or genetic or biometric data.

2. Where it comes from

• From you, in the agent’s chat.
• From a person who scans the QR code and writes to the agent.
• From the scanning device: an approximate location, and a precise location only if that person’s browser already allows it.

3. Why we collect it and how we use it

• To keep it in your account, so you can see, change and delete it.
• To show the details you chose to share to someone who scans the QR code, and help them reach the person’s family or emergency services.
• To notify you, and anyone you share the agent with, when the QR code is scanned or someone writes.
• To keep Keepy secure, prevent abuse and comply with the law.

We never use health information for advertising or marketing, never use it to train or improve AI models, and never sell it. No analytics or advertising tags run on these agents’ pages. We don’t use geofencing around healthcare facilities.

4. Your consent

We collect health information only after you agree, at the start of the agent’s setup. You can withdraw your consent at any time by deleting the agent in the app, or by emailing us. We then stop collecting it and delete what we hold within 30 days, and from backups as our Privacy Policy describes. If you set up such an agent for someone else, you confirm that you have their consent or are legally allowed to act for them.

5. Who we share it with

• People who scan the QR code: only the details you chose to make visible.
• People you invite to share the agent.
• Service providers who process it for us under contract and only on our instructions. Today they are:
  • DigitalOcean, for hosting, storage and AI inference (understanding what you ask the agent);
  • Google, for the Gemini AI model that writes the agent’s replies. Google does not use it to train its models;
  • Amazon Web Services, for sending notification emails; and
  • Cloudflare, for delivering the Services securely.
  If we add or change a provider that handles health information, we will update this list.
• Authorities or others, when the law requires it, or when it is needed to protect someone’s life or safety.
• A company that takes over Keepy, under the same protections.

We have no affiliates that receive health information. We don’t share it with advertising or analytics providers, or with brands we partner with.

6. Your rights

You have the right to:

• know whether we collect, share or sell your health information;
• see it, including a list of every third party and affiliate we shared it with and how to contact them;
• withdraw your consent;
• have it deleted. We will also ask our service providers and anyone we shared it with to delete it; and
• exercise these rights without being treated differently.

To make a request, email [email protected] with the subject “Health data request”. We confirm the request using the email on your account, and reply within 45 days. If we need more time, we tell you and may take up to 45 more days. If we decline, you can appeal by replying to our answer, and we will respond within 45 days. If you are still not satisfied, you can contact your state’s Attorney General (in Washington: atg.wa.gov/file-complaint).

7. Contact us

Human Interaction, Inc., 7272 Wisconsin Ave, 9th Floor, Bethesda, MD 20814, United States. [email protected]. We’re happy to help.