Consumer Health Data Privacy Policy
Short version: your child's IEP can contain health information, like disability classifications and diagnoses. We use it only to generate the report and tools you ask for. We never store the IEP on our servers, never sell it, and never use it for advertising. The only company that receives it is our AI provider, which processes it on our behalf. Our AI provider reads the full IEP once; after that, our tools send it only a summary with your child's name, school, date of birth, and contact details removed.
This policy supplements our Privacy Policy and applies to "consumer health data" as defined by Washington's My Health My Data Act, Nevada law (NRS Chapter 603A), and Connecticut law. Although these laws are written for residents of those states, we apply the practices described here to every IEPvocate user.
1. Consumer health data we collect, and why
We collect consumer health data only to the extent necessary to provide the service you request: analyzing your child's IEP and generating the resource guide, meeting questions, letters, templates, chat answers, and other tools you choose to use. We do not use it for any other purpose. If we ever wanted to use it for a different purpose, we would ask for your consent first.
| Category | Examples | How we use it |
|---|---|---|
| Health conditions and diagnoses | Disability classifications, diagnoses, and related needs listed in the IEP | To tailor your report, resources, and tools to your child |
| Health-related services and supports | Therapies and services (e.g. speech or occupational therapy, with frequency), accommodations, modifications | Same as above |
| Educational and functional information linked to health | Goal areas, strengths, challenges, and other notes in the IEP | Same as above |
| Information you type into our tools | Chat questions, the goal you describe for an advocacy letter, details you add to a template | To answer your question or generate the document you asked for |
| Inferences derived from the above | The AI-generated summary of the IEP, and recommendations based on it | To display your results and power the premium tools you use |
| Information that could indicate a health condition | The fact that you use IEPvocate, together with your account email address | Account sign-in, billing, and service emails |
We do not collect precise location data, and we do not use geofencing. The US state or city you optionally enter is used only to suggest nearby resources.
2. Sources of consumer health data
- You — the IEP document you upload and anything you type into our tools.
- Our AI processing — the summary and recommendations generated from what you provide.
We do not buy or receive consumer health data about you from any other source.
3. How long we keep it
- IEP content and text you type into our tools are not stored on our servers. They are processed to generate your response and then discarded.
- Your results are held in your own browser's session storage and cleared when you close the tab. Journal, Checklist, and Goals notes are saved only in your browser's local storage on your device until you delete them.
- Our AI provider (Anthropic) deletes inputs and outputs within 30 days under its commercial data retention policy, except in limited cases such as legal requirements or safety review, and does not use them to train its models. See our Privacy Policy, §4.1.
- Account data (email and subscription status) is kept as described in our Privacy Policy, §6.
4. Consumer health data we share, and with whom
We do not sell consumer health data, and we do not share it with advertisers, data brokers, or any third party for their own purposes. We have no affiliates with whom we share it.
We disclose it only to the following processors, which handle it on our behalf, under contract, solely to provide IEPvocate to you:
| Processor | Category of data | Purpose |
|---|---|---|
| Anthropic, PBC (AI processing) | All categories in Section 1 except account email | Reading your IEP (the full document, once) and generating your report and tools (from a summary with your child's name, school, date of birth, ID numbers, and contact details removed) |
| Vercel Inc. (hosting) | All categories in Section 1, in transit only | Running the website and servers your data passes through |
| Supabase Inc. (database) | Account email and subscription status only | Storing your account |
| Stripe, Inc. (payments) | Account email and payment details only | Processing payments |
| Resend (email delivery) | Account email only | Sending sign-in links and service emails |
We may also disclose information if required by law, such as in response to a valid subpoena or court order.
We do not allow third parties to collect information about your activity on IEPvocate over time or across other websites. We use no advertising or analytics trackers.
5. Your rights
You have the right to:
- Confirm and access: confirm whether we collect, share, or sell your consumer health data, get a copy of it, and get a list of every third party and affiliate we have shared it with, with their contact information.
- Delete: have us delete your consumer health data. We will delete what we hold and notify our processors of your request.
- Withdraw consent: withdraw any consent you have given us to collect or share consumer health data.
- Not be discriminated against for exercising any of these rights.
How to make a request: email privacy@iepvocate.com with the subject line "Consumer Health Data Request". Subscribers can also delete their account instantly at /delete-account. We may need to verify your identity, for example by confirming that the request comes from the email address on your account. We respond within 45 days, and if we need more time (up to 45 more days) we will tell you why. Requests are free, up to twice in any 12-month period.
Because we do not store IEP content, an access request will usually show only your account information and the list of processors above.
6. Appeals
If we decline to act on your request, you can appeal by replying to our decision with the subject line "Appeal". We will respond in writing within 45 days, explaining what we did and why. If we deny your appeal, you can contact your state attorney general:
- Washington: atg.wa.gov/file-complaint
- Nevada: ag.nv.gov
- Connecticut: portal.ct.gov/ag
7. Changes to this policy
If we change this policy, we will update the "Last updated" date above. Before collecting or using consumer health data in a materially different way, we will post the change here and, where the law requires, ask for your consent first. Subscribers will be notified of material changes by email.
8. Contact
IEPvocate LLC
Email: privacy@iepvocate.com
Location: New Jersey, United States