Why this policy exists
The Washington My Health My Data Act (RCW 19.373) requires regulated entities that collect "consumer health data" of Washington consumers to publish a dedicated privacy policy describing their consumer health data practices. This is that policy.
Our general Privacy Policy is available at https://caredraft.app/privacy. This document supplements that policy with specific information required by Washington law. If anything in this document conflicts with the general Privacy Policy, this document governs with respect to Washington consumer health data.
How CareDraft works (important context)
CareDraft is a clinical productivity application that stores clinical work and runs note-generation AI on the clinician's device. The App is intended for clinician-dictated, post-encounter, de-identified note drafting. It is not intended to record patient interactions or capture patient identifiers. CareDraft LLC does not receive or store clinical content, audio, transcripts, summaries, notes, or patient information. On Android, however, live dictation uses the speech recognition service selected on the device. It can work offline when offline recognition is available, or the selected service may use provider network processing under its own terms. CareDraft LLC does not receive that audio or transcript.
Optional Visit Router address suggestions send actively typed address or city/ZIP searches and a rounded search center directly to Photon (Komoot) only after the clinician taps Enable online suggestions. These queries may contain a visit address. The provider receives the query and ordinary network metadata; CareDraft LLC does not receive them or control provider retention. Foreground device location is optional, and there is no background tracking. Manual address entry remains available. See the general Privacy Policy for details.
Local storage does not by itself determine how privacy law applies. Optional address search, Android speech processing, and user-directed exports can send information to other recipients. A clinician's choice to enable a feature does not establish consent from a patient or replace any authorization required for that disclosure.
1. Categories of consumer health data we collect
CareDraft LLC operates no clinical-content backend. The app processes clinical content locally. Connected features and recipients are described below and in the general Privacy Policy.
When you use the App, the following types of information are created and stored exclusively on your device, encrypted at rest:
- Legacy saved audio recordings, if present
- Text transcriptions
- AI-generated summaries and templates
- Notes, including any patient information you input
- Diagnoses, treatment plans, medication information, or other clinical content you enter
While this information may meet MHMDA's definition of "consumer health data" with respect to patients whose information a clinician dictates, CareDraft LLC does not receive it through a clinical-content backend; the app processes it on-device. Android users should understand that their selected speech recognition provider may separately process live dictation as described above.
2. Categories of sources from which consumer health data is collected
The clinician supplies dictated, typed, imported, or photographed content. Device location can supply a search center after online-search opt-in and platform permission. Address results come from Photon / Komoot. CareDraft LLC has no clinical-content backend; information emailed directly to us comes from the sender.
3. Categories of consumer health data shared
Connected features can transmit live speech containing clinical information to the selected Android speech provider, address queries and a rounded search center to Photon / Komoot after opt-in, and user-selected clinical content to export recipients. A visit address or speech content can reveal health-related information depending on what the clinician enters. CareDraft LLC does not receive a copy through a clinical-content backend.
We do not sell consumer health data, and we will not sell consumer health data in the future without first obtaining a separate, written, signed Valid Authorization from the consumer as required by RCW 19.373.090.
4. Categories of third parties and affiliates with whom consumer health data is shared
The selected Android speech provider may receive live dictation, and apps or services chosen for exports receive the content the user sends. Photon (Komoot) receives address-search queries, a rounded search center, and network metadata only after Visit Router online suggestions are enabled. CareDraft LLC does not receive those requests. The provider controls its own handling and retention.
5. How a consumer can exercise their MHMDA rights
Use the following process for questions or requests about consumer health data:
5.1 Rights
Washington consumers have the right to:
- Confirm whether CareDraft LLC is collecting, sharing, or selling consumer health data about them, and to access that data.
- Withdraw consent from CareDraft LLC's collection and sharing of consumer health data.
- Delete consumer health data CareDraft LLC has collected.
5.2 How to exercise these rights
Email [email protected] with the subject line "Washington MHMDA Request" and include:
- Your name (and, if you are a patient submitting a request about your own data, the name of the clinician who may have used the App with respect to your care, if known);
- The specific right you wish to exercise (confirm/access, withdraw consent, or delete);
- A description sufficient for us to verify your identity (we will request additional verification information if needed);
- Your preferred contact method for our response.
5.3 Our response
We will respond within 45 days of receiving a verifiable request, as required by RCW 19.373.040. We may extend that period by an additional 45 days if reasonably necessary, in which case we will notify you of the extension and the reason for it.
We will investigate the request and explain which information is available to us and which is held on a clinician's device or by an independent provider. Contact the clinician or practice to request changes to local clinical records. Contact us for help identifying the relevant recipient; do not email unnecessary patient information. We cannot promise remote erasure of device content or provider records we do not control.
5.4 Appeals
If we deny your request and you wish to appeal, reply to our denial within 30 days. We will respond to your appeal within 60 days. If we deny your appeal, you may submit a complaint to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
6. Processors
The app has no CareDraft-hosted clinical processing service. Photon / Komoot receives optional address queries; the selected Android speech service may receive dictation; export recipients receive what the user sends. Android Google ML Kit receives technical SDK information, not the medication images or recognized text. These flows are described in the general Privacy Policy. This notice does not represent that every recipient acts as our contracted processor.
7. Consent and authorization
Visit Router starts with online suggestions off and displays a notice before enabling them. Turn off suggestions or leave Visit Router to stop further searches. You can enter addresses manually. Withdrawing consent cannot recall requests already sent. Device location requires a separate platform permission when it has not already been granted.
The app's acknowledgement and clinician opt-in do not replace any patient consent required by law. CareDraft is intended for de-identified note drafting. Do not send identifiable clinical content to a speech service, address provider, or export recipient without the necessary authority. If our practices change, we will update this policy and obtain any legally required consent before the changed processing begins.
8. Geofencing
CareDraft LLC does not operate a geofence around any in-person healthcare facility, as those terms are defined in RCW 19.373.005, and does not use any geofencing technology to identify, track, or collect information from Washington consumers near healthcare facilities.
9. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last Updated" date at the top of the policy. If we make material changes that expand the scope of consumer health data we collect, share, or sell, we will obtain any consents required by MHMDA before those changes apply to existing users.
10. Contact us
CareDraft LLC 95 Christmas Lane, Bunker Hill, WV 25413 Email: [email protected]
This policy is provided for transparency and is not a substitute for individualized legal advice.