Consumer Health Data Privacy Policy

Last updated 5 October 2026. This is a separate policy, required to be separate by law in some states. It covers only health-related information. Everything else is in our Privacy Policy.

The short version. To plan a trip that actually works for your family, the app needs to know things like "strictly no nuts" or "cannot manage stairs". Some US state laws treat that as health data, and they are right to. So we ask for it as a requirement rather than a condition, we ask your permission before collecting it and again before sharing it, we never sell it, and you can take it back at any time.

1. Why this document is separate

Washington's My Health My Data Act, Nevada's SB 370 and similar laws define "consumer health data" broadly — broadly enough to cover a tick-box saying someone needs a gluten-free meal or step-free access. Those laws require a policy of its own, not a paragraph buried in a general privacy policy. This is that policy.

We apply it to everyone, not only to residents of states that require it.

2. What we treat as consumer health data

Only this:

• Dietary requirements you tick for a traveller — for example strict nut avoidance, gluten-free, dairy-free, vegetarian, halal, kosher.
• Accessibility and mobility requirements you tick — for example step-free access, wheelchair use, limited walking distance, a quiet or low-sensory environment, assistance animal, or needing to keep medication refrigerated.
• The short optional note beside those tick-boxes, if you choose to write anything in it.
• Questions you ask the app that are inherently health-related — asking where a pharmacy is, or whether a dish contains nuts.

Everything else in the app — nicknames, ages, destinations, bookings — is not health data and is covered by the Privacy Policy.

2.1 How the questions are deliberately framed

The app asks what someone needs, never what they have. The tick-box says "strictly no nuts", not "peanut allergy". It says "step-free access", not a diagnosis. The optional note is labelled with a request not to write a diagnosis in it.

This is not word-play. A requirement is what the planner actually needs in order to choose a restaurant or a route, and a diagnosis is a medical record we have no business holding. We only ask for the first.

If the app reads a photo you upload, it may suggest text for that note — but it will never tick a requirement box for you. Inferring a strict allergy from an image is exactly the kind of silent assumption that gets someone hurt. You tick it or it is not ticked.

3. What we do with it

One purpose, and only one: to shape the plan around your family. Specifically, to order a day so it is physically manageable — pacing, distances, terrain, how much walking, how much rest — to tell you what you need to confirm with a venue or airline, and to help you ask the right question in its own language.

It is not used to judge whether a place can meet the requirement, and the app will never tell you that one does. We cannot inspect a kitchen, verify an access ramp or audit an airline's allergy procedure, so we do not make that claim about any restaurant, hotel, venue, carrier or activity. Where a requirement matters, the plan says so and tells you what to ask. The answer has to come from the people who run the place.

We do not use it for advertising, to build a profile of you, to train any AI model, to score or rank you, or for research. We do not sell it, and we would need your separate written authorisation to do so even if we wanted to — which we do not.

4. Who sees it

To generate a plan, the requirements you enter are included in the request we send to our AI providers — Anthropic and Google. They process it to produce your itinerary or answer. It is also stored in our database, run by Supabase, and passes through Cloudflare, which serves the app.

Those requests carry the requirement and the traveller's nickname and age — not a real name, not a date of birth, not a document number, because the app does not hold them.

No one else receives it. Not advertisers, not travel providers, not affiliate partners. When you follow a booking link, none of this information goes with it.

5. Consent

We ask before we collect it, and we ask again, separately, before we share it with the AI providers that generate your plan. Those are two different permissions and the app treats them that way — there is deliberately no single "accept all" button.

We record what you were asked, which version of this policy you were shown, when, and what you answered. We record refusals too, because that is the evidence we asked and respected the answer. Those records are kept for three years.

You can say no, and the app still works. Decline, and we simply plan without that information — you get a general itinerary rather than one shaped around the requirement. You are never locked out of a feature you have paid for because you declined to share health information.

6. Taking it back

You can withdraw consent at any time, in the app or by emailing info@familyglobe.com. Withdrawal is as easy as giving it was.

When you withdraw, we stop using the information for planning immediately, and we delete it unless we are legally required to keep a record that you gave and withdrew consent. Plans already generated are not retrospectively changed — we cannot un-write an itinerary you already have — but nothing new will use it.

7. Your rights

You may ask us to:

• Confirm whether we hold health data about you or your family, and give you a copy;
• Tell you who we have shared it with — we will list every recipient, not just the categories;
• Delete it, which we will do including asking our providers to delete their copies;
• Withdraw consent, as above.

Email info@familyglobe.com. We respond within 30 days and will tell you if we need longer and why. If we refuse a request we explain why, and you can appeal by replying; we will answer the appeal within a further 45 days with reasons. There is no charge, and we will not degrade your service for asking.

8. Children

Most of the requirements entered in this app will be a child's. They get the same protection as everyone else's and no less care.

A child's profile needs a nickname, a birth month and year, and the requirement itself. It does not need, and the app does not ask for, their real name, date of birth or any document. Children have no accounts of their own, cannot sign in, and are never contacted by us.

9. How long we keep it

While your account is open and the requirement still applies — because the point of the app is that it remembers so you do not have to re-enter it every year. Remove the tick and it is gone from the profile. Close the account and it is deleted within 30 days, with backups overwritten on their own cycle within 90 days.

10. We do not geofence

We operate no geofence around any health care facility — no hospital, clinic, pharmacy, counselling service, reproductive health or gender-affirming care provider. We do not track your presence near one, do not infer anything from it, and do not send you anything because of it.

Location in this app is rounded to roughly 110 metres at the moment of capture, which is too coarse to tell which building you are in, and it is used only when you ask for something nearby.

11. We are not a medical service

Family Globe gives no medical advice of any kind. It does not diagnose, treat, assess or advise on any condition, allergy or disability. It is a travel planner that takes your requirements into account.

It is also not always right. Always confirm allergy, dietary and accessibility information directly with the restaurant, venue, airline or operator before you rely on it. The app can tell you what to ask and how to ask it in the local language; it cannot answer for the venue, and a reassuring answer from the app is not a safe substitute for a clear answer from the kitchen.

In an emergency, contact the local emergency services. Do not use this app.

12. Voice

If you mention a health requirement while speaking to the trip-feedback feature or the live translator, it is treated under this policy. We do not keep audio recordings once the feature has finished with them, and we do not use voice to identify anyone.

13. Security

This information is encrypted in transit and at rest, access to it is restricted, and the rules about who may see it are enforced on our servers rather than in your browser. The strongest protection remains the design itself: these requirements are not attached to a real name, a date of birth or a document number, because we never collected those.

14. Changes

If we change this policy materially we will tell you at least 30 days beforehand, and where the change affects how we use information you have already given, we will ask for your consent again rather than assume it.

15. Contact

Any question, request, appeal or complaint about health information: info@familyglobe.com. Postal: [LLC LEGAL NAME], [REGISTERED ADDRESS].

You may also complain to your state Attorney General. In Washington, the My Health My Data Act gives consumers a private right of action.