WeCureUs Participant Informed Consent

Document version: 1.2

Effective date: July 28, 2026

---

Before You Begin

This document describes what WeCureUs collects, how it is stored and protected, how it is used, and what rights you have over your own data. Please read it carefully before creating an account.

Participating in WeCureUs is entirely voluntary. You may stop at any time, delete your account and all associated data at any time, and adjust your level of participation at any time without conditions.

By completing enrollment and accessing the WeCureUs participant portal, you accept the terms of this consent. A copy of this document will remain accessible at all times at wecureus.com/consent.

---

Who We Are

WeCureUs, Inc. is an Oregon benefit company founded by people living with multiple sclerosis and their partners, built around a single conviction: the lived experience of people with chronic neurological conditions is the most valuable and least collected data in disease research. The platform collects that experience directly, protects it with the strongest available technical safeguards, and makes it available to the research community in aggregate form only.

WeCureUs is not a healthcare provider, health plan, or insurance company. We are not legally classified as a covered entity under the Health Insurance Portability and Accountability Act. However, we have voluntarily adopted HIPAA-equivalent technical, administrative, and physical safeguards because the people who share health information with us deserve the same level of protection that federal law requires in clinical settings. This commitment is written into our Articles of Incorporation as a binding public benefit purpose.

All technology partners who handle participant health data have signed Business Associate Agreements with WeCureUs, including Google Cloud Platform, Amazon Web Services, and Paubox. Processors that handle only non-health information, such as our text message delivery provider, are listed with their covering agreements in the Third-Party Data Processing section below.

---

What We Collect and Why

Account and Identity Information

To create an account we collect your email address, which is used to send you a sign-in link. No password is ever created or stored. During enrollment we also collect your first and last name.

We also collect and verify a mobile phone number. A verified phone number is required to protect your account. WeCureUs uses two-factor authentication: during enrollment, and when you sign in from a new device, we send a one-time verification code by text message that you enter to confirm the number. These verification codes are a required security step for the account you are creating, they contain no health information, and they are separate from the optional text message reminders described in the SMS Notifications section below.

This identity information is stored in a database that is completely separate from your health data. The two are linked only by an anonymous internal identifier that is never exposed to researchers or to any external party.

Module Questionnaire Responses

WeCureUs collects health experience data through structured modules covering topics such as your MS diagnosis history, cognitive symptoms, fatigue, pain and sensory changes, mobility, mental health, treatment experience, and your diagnosis journey. The set of available modules grows over time, and you choose which modules to complete and at what pace.

Your responses are stored in a database keyed only by your anonymous identifier, never by your name or email address. This database is completely separate from the database that holds your identity information, and the system that researchers use to query the community data is structurally prevented from accessing the identity database at all.

Specific data points collected through modules include:

• MS diagnosis subtype, diagnosis date, and date of first symptoms
• Date of birth, which you may enter in full or as a year only. If you enter a full date of birth, the complete date is stored in the response database. Only your birth year is used in aggregate statistics presented to researchers.
• Postal or ZIP code, stored in full. Aggregate statistics presented to researchers use a geographic prefix rather than your exact code.
• Biological sex and gender identity, as separate questions, each optional
• Treatment history and current disease-modifying therapy status
• Free-text responses to open-ended questions, stored verbatim
• Your responses to any other questions across all modules you complete

All free-text responses, including open-ended answers and follow-up text, are stored and retained. An automated keyword detection system runs on all free-text input at the time of submission to identify language that may indicate a participant is in distress. This system logs detection events including the type of match, confidence level, and a cryptographic hash of the message, but never stores the triggering text separately from your response record. See the Crisis Detection section below for more detail.

If you re-answer a question your previous answer is retained alongside the new answer. The most recent answer is used in community statistics, but your full answer history is preserved.

Document Contributions (Optional)

You may optionally contribute text records from your clinical history, including radiology reports from MRI examinations, laboratory results, and ancestry or genealogical data from consumer genetic services. Each of these contribution types is optional and completely separate from your module participation.

When you contribute a document, you paste its text directly into the platform. That pasted text is sent to an AI service for processing and is not stored anywhere by WeCureUs after processing is complete. The AI extracts structured information from the text, such as lesion locations from a radiology report or test values from a lab result, and returns only that structured extraction to WeCureUs for storage. The original text is discarded.

The structured data extracted from your documents is stored in the same anonymous, pseudonymous database as your module responses. It is keyed only by your anonymous identifier.

Ancestry and genealogical data may include information derived from genetic testing services. WeCureUs collects ancestry composition percentages and haplogroup labels as reported by those services, not raw genomic sequences or DNA data.

An AI-generated plain-language interpretation of your contributed document is available on request as a separate optional step. This interpretation is generated from the already-extracted structured data, not from the original pasted text.

By submitting a document, you acknowledge that its text will be processed by an AI service and that only the structured extraction will be retained. A brief acknowledgment appears at the point of each submission.

---

SMS Notifications

WeCureUs offers optional text message (SMS) reminders to help you keep up with your participation. These reminders are separate from the one-time verification codes used to secure your account, and they are entirely optional.

Opting in. During enrollment, and at any time afterward in your profile settings, you can turn on text messages for the notification types you choose. Turning on a text message option is your express consent to receive recurring automated text messages from WeCureUs at your verified number. If you do not turn on any text message option, WeCureUs does not send you reminder or notification text messages.

Message types. Messages you may receive include participation reminders (prompts to return and continue a module), longitudinal check-in reminders, and occasional announcements that a new module or feature is available. These messages contain no health information. They are notification prompts only, directing you to sign in at wecureus.com.

Message frequency. Message frequency varies and depends on the reminder cadence you choose in your account settings.

Cost. Message and data rates may apply, according to the terms of your mobile carrier plan.

Opting out. You may opt out at any time by replying STOP to any WeCureUs text message, which stops all WeCureUs reminder texts, or by turning off text message reminders, or changing your reminder method to email, in your account notification settings. You may reply HELP for assistance. Opting out of SMS reminders does not affect your ability to use the platform, and does not stop the one-time security verification codes, which are a required part of signing in.

SMS delivery is handled by Twilio, our messaging provider. See the Third-Party Data Processing section below for details.

---

How We Use Your Data

Community Aggregate Statistics

The primary use of your data is to produce community aggregate statistics accessible to participants and researchers. These statistics describe the collective experience of the WeCureUs community, not any individual. Every result is protected by a minimum cohort threshold: no query ever returns a result for a group smaller than five participants. Any data point that would require identifying a group of fewer than five people is suppressed or reported at a coarser level.

Researchers access these statistics through a query interface that enforces this threshold at the database layer. No researcher ever receives individual-level data under any circumstances. The participant portal includes community query tools that let you explore this same aggregate data yourself; they show only aggregate statistics, protected by the same minimum group of five described above, and never reveal any individual's answers.

The Learn Panel

The WeCureUs portal includes a conversational AI assistant in the Learn panel. When you interact with the Learn panel, your message is processed first by a crisis detection system, then, where appropriate, by an AI model. The AI may retrieve your own module responses to answer questions about your data. It may also query community aggregate statistics on your behalf, subject to the same minimum cohort protections that apply to all researcher queries.

The AI model used by the Learn panel runs on Amazon Web Services Bedrock under the AWS Business Associate Agreement. AWS does not retain your data for training or any other purpose.

What We Never Do

WeCureUs does not and will never:

• Sell individual-level participant data to any party under any circumstances
• License, monetize, or otherwise make individual data available commercially
• Allow any advertiser, sponsor, grantor, or commercial partner to influence what questions are asked, how results are presented, or how data is used
• Return individual records through any query or interface
• Allow pharmaceutical companies, insurance companies, or any commercial entity to access anything beyond the same aggregate query interface available to all registered researchers

---

AI and Automated Processing

AI Processing of Document Contributions

When you contribute a radiology report, lab result, or ancestry record, an AI model classifies the document type and extracts structured information. This processing is performed by Amazon Web Services Bedrock under the AWS BAA. The original text is never stored by WeCureUs.

AI-generated summaries of your contributed documents are generated from structured extraction data only, never from the original text. These summaries carry explicit caveats. For radiology reports, the summary notes that stable imaging findings do not indicate stable function, addressing the clinical phenomenon of progression independent of relapse activity. For lab results, the summary notes that normal values do not mean your symptoms are not real. For ancestry data, the summary frames findings as research context only, without asserting causal relationships.

Crisis Detection

An automated keyword and pattern detection system runs on all free-text input you submit. This system identifies language that may indicate distress and responds with appropriate resources. Detection events are logged with a classification level, confidence score, detector version, and a cryptographic hash of the message content. The text that triggered the detection is not stored separately; it remains only as part of your response record.

This system operates entirely on WeCureUs infrastructure and does not involve any external AI service for the detection step itself.

---

Third-Party Data Processing

No participant data is shared with any third party not listed above without explicit separate consent. No third party listed above uses participant data for their own training, analytics, or commercial purposes.

---

Data Separation and Security

Your identity information (email address, name, phone number) and your health data (module responses, document contributions) are stored in completely separate databases. They are linked only by an anonymous internal identifier.

The system that researchers use to query community data is architecturally prevented from accessing the identity database. This is enforced at the database connection layer, not only at the application layer, meaning that even a software error in the researcher query system could not expose identity information.

All data is encrypted at rest and in transit. Access to databases is restricted to specific platform services with documented minimum-necessary permissions. All database access is logged and auditable. These controls are consistent with the technical safeguard requirements of the HIPAA Security Rule.

---

Where Your Data Is Stored and Processed

All of your data is stored and processed in the United States. WeCureUs is a United States company, incorporated in Oregon, and it operates no infrastructure outside the United States.

Specifically:

• Your identity information, your module responses, and your contributed records are stored in databases hosted by Google Cloud Platform in the us-central1 region, located in Council Bluffs, Iowa, United States.
• The AI processing described in the AI and Automated Processing section above runs on Amazon Web Services Bedrock in the us-east-1 region, located in Northern Virginia, United States.
• Transactional email is delivered by Paubox, a United States company. Text messages, where you have opted in to them, are delivered by Twilio, a United States company.

What this means if you do not live in the United States. If you are in Canada, your personal information is transferred to, stored in, and processed in the United States. Once your information is in the United States it is subject to United States law, and that law differs from Canadian law in ways you should understand before you decide to participate:

• United States government authorities may be able to compel access to your information. This includes access under lawful process such as a subpoena, a court order, or a search warrant, and access under United States national security and surveillance laws, including the Foreign Intelligence Surveillance Act and related authorities. Some of these processes can be carried out without notice to you and without notice to us.
• A contract cannot override foreign law. We hold Business Associate Agreements with Google Cloud Platform, Amazon Web Services, and Paubox, and those agreements bind them to protect your information. No contract, however, can prevent a lawful government demand in the country where the data is held. We want you to know that plainly rather than to imply that our agreements make your information immune from legal process.
• You may have fewer practical remedies. Enforcing a privacy right against a United States company from outside the United States can be slower and more difficult than enforcing it domestically. The complaint pathways available to you, including the Office of the Privacy Commissioner of Canada and your provincial regulator, are set out in our Privacy Policy.

What we do to reduce that risk. We cannot change United States law, but we have deliberately built the platform so that the amount of information exposed by any single demand is as small as we can make it:

• Your identity information and your health data live in separate databases and are linked only by an anonymous internal identifier, so a demand directed at one does not straightforwardly yield the other.
• The research query system is architecturally prevented from reaching identity information at all.
• Researchers never receive individual-level data. They receive only aggregate statistics that suppress any group smaller than five participants.
• We retain the minimum information necessary to operate the platform, and you may delete all of it at any time, immediately and without conditions.

Your choice. By accepting this consent you are agreeing to this transfer to and processing in the United States. If you are not comfortable with your health information being subject to United States law, please do not enroll, and if you have already enrolled you may delete your account at any time with immediate effect.

---

How Long We Keep Your Data

While your account is active. We keep your module responses and your contributed records for as long as your account remains open. We do this because the scientific value of this platform is longitudinal: a symptom answer given once is a data point, and the same question answered over several years is evidence of how a disease actually progresses. Deleting your earlier answers would destroy exactly the value your participation creates.

We want to be straightforward about two things.

First, we do not currently set a fixed maximum retention period, and we do not automatically delete or anonymise the accounts of participants who stop using the platform. We are telling you this rather than implying an automatic expiry that does not exist. We consider this an open item, we intend to define maximum retention periods and an inactivity policy, and we will disclose them in an updated version of this consent before we adopt them.

Second, the control that matters most is in your hands and it works today. You can delete everything at any time, immediately, with no conditions and no waiting period, and you do not have to give a reason.

What happens when you delete your account. Deletion is immediate and complete. It removes your identity record, the link between your identity and your health data, every module response, every contributed record, every consent record, and your authentication credentials, across all three databases.

The one thing that survives, and why. A single audit row survives, containing a cryptographic hash of your user identifier and a hash of the network address the request came from. It exists so that we can prove a deletion happened, which is a protection for you as much as a record for us. It contains no name, no email address, no phone number, and no health information. Because the original identifier is destroyed in the same operation, the hash cannot be reversed or matched back to you. Canadian privacy law separately requires us to keep records of privacy incidents for a period of years, so a record of this kind is not merely permitted but expected.

Other records with defined limits. Records of privacy or security incidents are kept for at least twenty four months under Canadian federal law and at least five years where Quebec law applies. Query logs for the researcher system record which queries were run and by which registered researcher; they contain no participant identity and no individual-level data.

If you withdraw a specific consent rather than deleting your account. Where you have given a separate consent for a particular contribution type, such as a contributed radiology report, withdrawing that consent stops any further use of that contribution and you may delete the underlying records individually at any time.

---

Your Rights

Delete your account. You may request deletion of your entire account at any time, with immediate effect and no conditions. Deletion removes all of the following: your identity record, the link between your identity and your health data, all module responses, all document contributions, all consent records, and your authentication credentials. The only record that survives is a cryptographic hash of your user identifier stored in an audit log to prove the deletion occurred. This hash cannot be used to recover any of your data.

Re-answer questions. You may return to any completed module and re-answer any question at any time. Your previous answer is retained in the history but the new answer is used in community statistics.

Review your data. You can review your module responses through the dashboards in the portal and your document contribution history in the Your Records section.

Correct your data. Corrections are made by re-answering the relevant question through the module.

Export your data. You can export a full copy of your data at any time from within the portal.

Revoke document contribution consent. If you contributed a document and wish to have the structured extraction removed from your record, you may request removal by deleting your account, which removes all your data, or by contacting us at hello@wecureus.com to request removal of a specific record.

Opt out of public features. Any feature that involves public disclosure of your data carries a separate, explicit opt-in consent. You may revoke that consent and remove your public content at any time.

Withdraw consent without deleting everything. You may withdraw your consent to collection or your consent to inclusion in aggregate statistics separately, by writing to hello@wecureus.com addressed to the Privacy Officer, rather than deleting your account.

If you ask us in writing

Most of the rights above work immediately in the portal and need no request. Where you do write to us, here is what we commit to. We will answer within thirty calendar days. If we ever need longer we will tell you inside those thirty days, explain why, and give you a person to escalate to, and in no case will we take more than ninety days in total. You never need to create a new account, or any account, to exercise a right, and there is no charge.

If we refuse any part of a request we will tell you why in writing and tell you how to appeal it. If we then refuse the appeal, we will tell you how to complain to the regulator that covers you. Those regulators, and the deadlines that apply to them, are listed on our public privacy page. One of them is worth repeating here because participants routinely get it wrong: the United States Office for Civil Rights normally requires a complaint within 180 days of when you knew about the problem, not 180 days from the problem itself.

---

Consent to Longitudinal Participation

Some questions in WeCureUs modules are designated as longitudinal. These questions are presented again at intervals of three months, six months, or twelve months depending on the question type, to track how your experience changes over time. You will be notified before a longitudinal question is re-presented, and you may skip it at any time.

You can set your preferred reminder method, by email or text message, and your reminder cadence from within your account settings.

---

Consent Versioning and Material Changes

This consent is version 1.2. The version number and effective date appear at the top of this document and are stored with your acceptance record.

Version 1.2 added a full disclosure of where your data is stored and processed, including the specific United States regions and the possibility of lawful access by United States government authorities; added a statement of how long data is kept and the conditions under which it is deleted; and separated the age eligibility affirmation from the consent to data processing. Because the cross-border disclosure is material to a reasonable person's decision to participate, every participant is being asked to review and accept version 1.2 rather than having it applied silently.

If WeCureUs makes material changes to how participant data is collected, used, or shared, you will be notified and asked to review and accept the updated consent before continuing to use the platform. Changes that are purely additive (new features, new module types, new optional contribution types) that do not change the fundamental data practices described here will be disclosed in an updated consent but may not require re-acceptance at each change.

---

Contact

If you have questions about this consent, your data, or your rights, please contact us at hello@wecureus.com.

---

Age Eligibility

This section is a separate affirmation. It is deliberately kept distinct from your consent to data processing below, so that agreeing to one is not treated as agreeing to the other.

WeCureUs is for adults only. You must be 18 years of age or older to enroll or to use the platform.

First affirmation, age. By enrolling you affirm that you are 18 years of age or older.

Why we do not ask you to prove your age

We ask you to affirm your age. We do not ask for identity documents, and we do not require you to submit a date of birth in order to enroll. That is a deliberate decision, and because it is the kind of decision people reasonably question, here is our reasoning in full.

Asking for proof would mean collecting more sensitive information about every single participant in order to address a rare situation. Data minimisation is a legal obligation and a core commitment of this platform, and demanding identity documents from thousands of adults with a chronic illness in order to detect a small number of minors would violate it.

Privacy regulators actively discourage it. The Office of the Privacy Commissioner of Canada has stated that age assurance "should not be the default condition for accessing the Internet," and has warned that age assurance risks requiring organisations to collect more information about all users even where potential harms are low. The State of Colorado has legislated that a controller is not required to implement age verification or age gating or to affirmatively collect the age of consumers.

United States law is built around what an operator actually knows. The Children's Online Privacy Protection Act protects children under 13 and applies where a service is directed to children or where the operator has actual knowledge it is collecting a child's information. WeCureUs is not directed to children. Multiple sclerosis is overwhelmingly an adult-onset condition, our content and design address adults, and we state an adult-only requirement. The Federal Trade Commission's own published guidance states that the rule "does not require operators to ask the age of visitors," and that an operator screening for age in a neutral fashion "may rely on the age information its users enter, even if that age information is not accurate."

We want to be honest about the trade-off rather than present this as costless. An affirmation can be answered untruthfully. We accept that, because the alternative is to collect identity documents from every participant, which we judge to be the greater harm to the greater number of people. If you believe a minor is using this platform, please tell us at hello@wecureus.com and we will act on it.

One clarification about a question we do ask. If you choose to complete the Getting Started module, it asks your date of birth, because age is a genuine research variable in multiple sclerosis. That question is a screen, not a gate: it will not accept a date of birth that puts you under 18, and you may decline to answer it and continue. It is not the mechanism by which we establish eligibility. This affirmation is.

---

Acceptance

Enrollment asks you for three separate confirmations rather than one. Reading this document is a precondition, not the consent itself, and scrolling to the end of it does not consent to anything. Each confirmation is a distinct choice that you make yourself, and each one starts unchecked.

First affirmation, age. That you are 18 years of age or older. This is set out in the Age Eligibility section above.

Second affirmation, collection. That you consent to WeCureUs collecting the health information described in this document. That means your diagnosis and diagnostic history, your symptoms and how they change, the treatments and supplements and devices and dietary approaches you have tried and how well each one worked, and the text of any radiology report, laboratory result, or ancestry service result you choose to paste in. It is collected for one purpose: to build a research dataset about lived experience with multiple sclerosis, and to show your own data back to you. It is stored and processed in the United States, as described above. Only the service providers listed in the Third-Party Data Processing section process it on our behalf.

Third affirmation, sharing. Separately from the second, that you consent to your information being included in the aggregate community statistics described above, which are made available to registered researchers. No individual record is ever released. No result is ever shown for a group smaller than five participants. We keep these two confirmations separate on purpose, because consenting to give us your information is not the same decision as consenting to let it contribute to research, and you are entitled to make them separately.

You may withdraw either consent at any time by deleting your account, which takes effect immediately and requires no reason and no conditions. Withdrawing is not the only control you have: you can also review, edit, or delete any individual answer at any time, without deleting anything else.

We will never treat you differently for declining a confirmation, for withdrawing one later, or for exercising any right described in this document.

If a new category or a new purpose is ever added

If we ever want to collect a category of health information that is not described in this document, or to use what we already hold for a purpose that is not described here, we will disclose it here first and then ask you for fresh consent before collecting or using it. We will not add a category quietly and rely on the consent you gave today to cover it.

Our commitment not to re-identify you

We commit publicly that we will process the aggregate community statistics only in a de-identified form, that we will not attempt to re-identify any participant from them, that we will not attempt to link them back to any individual, and that we will not permit anyone else to do so. Every registered researcher accepts the same obligations as a condition of access, and must impose them on anyone they pass results to. We publish this commitment on our public privacy page as well as here, so that it is a promise you can hold us to rather than an internal policy you have to take on trust.

---

WeCureUs, Inc. | 1401 Oak Ridge Drive, Hood River, Oregon 97031 | wecureus.com