Consumer Health Data Privacy Policy

This policy is for residents of Washington and Nevada. It describes how ArrivalList Inc. ("ArrivalList," "we," "us") handles "consumer health data," as Washington's My Health My Data Act and Nevada's consumer health data law define that term. It adds to our Privacy Policy, which covers everything else.

Is ArrivalList a health app?

No. ArrivalList is a reminder app. It doesn't ask about your health, and it doesn't try to tell whether a place is a health care provider. But what you choose to type can reveal something about your health. For example:

• a reminder that says "pick up my prescription";
• a saved place named after a pharmacy or clinic;
• a reminder set for arriving at that place.

When that happens, we treat that information as consumer health data.

What we collect, and where it comes from

We may receive consumer health data only from what you, or a group member who sends you a request, type into ArrivalList:

• reminder and request text that mentions health, care, or medication;
• saved places (name, address, and coordinates) that could show you're seeking health care or supplies, plus the reminders tied to them;
• group messages that mention health.

We don't collect your current location, where you've been, or when you arrived anywhere. That check happens only on your phone, and it never reaches us.

How we use it

Only to provide the service you asked for: storing and syncing your reminders and places, showing your group the requests and messages you send, and reviewing content someone has reported. We never use it for advertising, profiling, or AI training, and we never sell it.

We don't set up geofences around health care providers. Your phone watches only the places you choose to save, and it watches them only to show you your own reminders.

Who we share it with

Other people:

• Your group: members of your groups see the requests and messages you send to that group.

Service providers, which process it only for us:

• Supabase: hosting and database.
• Anthropic: only if someone reports a message or request; Anthropic reviews it with no names attached.
• Apple or Google: only what you type into address search.

We don't share it with affiliates or any other third parties, except where the law requires or to protect someone's safety, as our Privacy Policy describes.

Your rights

You have the right to:

• confirm whether we collect, share, or sell your consumer health data;
• access it, including a list of every third party we've shared it with and how to contact them;
• delete it, including from our backups and our providers' copies;
• withdraw your consent.

You can delete reminders, places, and messages in the app at any time, or delete your account under Account → Delete account.

How to make a request

• Where to send it: email support@arrivallistapp.com from the address on your account. We'll confirm it's you before we act.
• How long it takes: we'll answer within 45 days. If we need more time, we'll tell you why, and we may take up to 45 more days.
• Cost: requests are free, up to twice a year.
• Appeals: if we decline your request, you can appeal by replying to our answer. We'll respond within 45 days. If we deny the appeal, you can contact the Washington Attorney General at atg.wa.gov or the Nevada Attorney General at ag.nv.gov.

Contact

ArrivalList Inc., 5152 Poplar Grove Rd, Cookeville, TN, support@arrivallistapp.com