Consumer Health Data Privacy Policy

Categories of consumer health data we collect, why, and how it is used

We collect the following categories of consumer health data: multiple sclerosis diagnosis, subtype, and diagnostic history; symptoms, their severity, timing, and change over time, across cognition, fatigue, pain, sensation, mobility, vision, sleep, bladder and bowel function, sexual health, and mental health; treatments, including disease-modifying therapies, symptom medications, supplements, procedures, dietary approaches, and assistive devices, together with your assessment of how each one worked; findings from radiology reports and laboratory results that you choose to paste in, including lesion locations and counts and laboratory values; genetic and ancestry information that you choose to paste in, including ancestry composition percentages and haplogroups; suicidal ideation and other mental health indicators; and health-related aspects of daily life, including employment, relationships, financial impact, residence history, and exposure history.

We collect it for one purpose: to build a research dataset about lived experience with multiple sclerosis, and to return value to you from your own data while doing so.

It is used in four ways. It is shown back to you in your own account. It is used to generate aggregate community statistics that suppress any group smaller than five participants. It is processed by artificial intelligence to convert pasted clinical documents into structured data, to answer your questions about your own data and community aggregates, and to group community suggestions by theme. It is used to send you the participation reminders you asked for.

We do not use consumer health data for advertising, for profiling, or to make any automated decision about you. We do not sell it.

Categories of sources

All consumer health data comes from you. Specifically: answers you enter in questionnaire modules and single questions; clinical document text you choose to paste in, including radiology reports, laboratory results, and ancestry service results; entries you create describing treatments you have tried; free text you write; and data derived or inferred from any of the above by artificial intelligence processing, including structured fields extracted from a pasted document.

We do not buy consumer health data. We do not obtain it from data brokers, from health care providers, from insurers, or from any third party.

Categories of consumer health data that is shared

We do not share individual-level consumer health data with anyone. No researcher, no partner, and no third party receives your individual record.

Registered researchers receive only aggregate statistics computed across many participants, in which any group smaller than five participants is suppressed before the result is produced.

The categories above are processed on our behalf by the service providers listed in the next section, which act only on our instructions and only for the purposes stated in this policy.

Third parties and affiliates

WeCureUs, Inc. has no affiliates. No consumer health data is shared with any affiliate, because none exists.

The categories of third parties that process consumer health data on our behalf are: cloud infrastructure and database providers; artificial intelligence processing providers; transactional email providers; and text message delivery providers. Each is contractually limited to processing on our instructions for the purposes stated in this policy.

The category of third party that receives output derived from consumer health data is registered researchers, who receive aggregate statistics only, never individual-level data.

For a current list of the specific providers in each category, together with contact information for them, write to hello@wecureus.com, addressed to the Privacy Officer, and we will provide it.

How to exercise your rights

You have the right to confirm whether we are collecting, sharing, or selling your consumer health data and to access that data, together with a list of every third party and affiliate we have shared or sold it to and a way to contact them. You have the right to withdraw your consent to our collection and to our sharing of it. You have the right to have it deleted.

Deletion and editing are available directly in your account without contacting anyone. Deleting your account removes every response, every contributed record, every consent record, and your sign-in credentials, and we notify every service provider that processes your data of the deletion. Where data exists on backup systems, deletion there follows within six months at the outside.

To confirm, access, or withdraw consent, or to make a deletion request in writing, write to hello@wecureus.com, addressed to the Privacy Officer. We will respond within thirty calendar days. If we need longer we will tell you inside those thirty days and explain why, and in no case will we take more than ninety days in total. You do not need to create an account to exercise any of these rights, and there is no charge.

If we deny your request you may appeal it by replying to our decision and asking for an appeal. We will decide the appeal in writing, with reasons, within thirty calendar days. If we deny your appeal, you may submit a complaint to the Washington State Attorney General at www.atg.wa.gov/file-complaint.

We will never treat you differently for exercising any of these rights.