Health Data Privacy Notice

Brand: Masch Media

Legal entity: Masch Media LLC

Effective date: October 21, 2026.

This Health Data Privacy Notice is effective October 21, 2026. It adds detail to the Privacy Policy (/bothknow/privacy) about health information. BothKnow is offered under the Masch Media brand. Masch Media LLC operates the service. Effective date: October 21, 2026. Privacy contact: support@masch.media.

Health information the current source can store

A profile can store medications (name, dosage, and notes), medication allergies, food allergies, a doctor, a doctor phone, insurance, and notes. A document can store a title, a category (Insurance, Vaccinations, Identity, or Other), and a file the person selects. A profile can include a JPEG photo. An event can store a title, time, location, and notes. A calendar the person chooses can be read for titles, dates, and locations. Those fields can reveal appointments or health status.

The file picker accepts a file the person chooses. That file can be a document, image, or audio file within the size limits in the source. Profile photos and image documents are re-encoded as JPEG without the source image’s EXIF metadata. The app does not request the microphone, the device address book, GPS location, or unrestricted access to the photo library. The app does not receive a face or fingerprint template. When biometric unlock is turned on, the phone performs the check and BothKnow receives only the result.

Sources are what the person enters, photos, files, and calendars they select, and people with approved access to a shared family. Personal records are not copied into a shared family automatically. A guardian confirmation does not by itself share records or grant family access. A family role or guardian approval is not automatic authority over another person’s health information.

BothKnow accounts are for people in the United States who are 16 or older. Ages 16–17 need a parent or legal guardian to confirm permission from their own BothKnow account. People under 16 cannot create an account. The signup code rejects under 16 and locations outside the United States. A guardian confirmation does not by itself share records or grant family access.

How health information is used

The source uses this information to show, encrypt, and save the records a person chooses to keep, restore a saved account, and show a shared family’s records to people with approved access. The source has no advertising or cross-app tracking feature. This policy does not decide whether health information is sold, or which health-privacy laws apply.

Records are encrypted on the phone before they are saved. With account saving on, the encrypted record and recovery material can be stored through Supabase. A verified sign-in can restore the last confirmed account save. This policy does not claim that only the person’s devices can decrypt records. Turning account saving off in Menu → Privacy choices pauses new uploads of the encrypted bundle. It does not delete existing records. Turning new sharing off pauses new shared-family uploads. Existing records, downloads, memberships, and copies someone already kept remain.

Who else can receive it

People with approved access to a shared family can see that family’s records, including health fields. Supabase provides authentication, database, and backend storage when account saving or family sharing is on. Resend sends family-invitation email only, from BothKnow (security@auth.masch.media). Do not use invitation email to send medical records or keys. Apple processes Sign in with Apple. The phone’s operating system handles Face ID or fingerprint checks and MapKit place search. Google processes Sign in with Google. Sharing a file uses the phone’s share sheet and sends a copy to the app you pick.

The deletion code does not notify those providers, revoke Apple or Google sign-in, or cancel an Apple subscription.

Access, correction, and deletion

To ask for access, correction, or a deletion review, open Menu → Privacy choices when that page is available, or email support@masch.media. Someone whose information appears in a family profile can write to that address without creating an account. Do not send medical records, identity documents, passwords, email codes, or recovery keys in the first message. Receiving a request is not the same as fulfilling it. The in-app request center records the request type. It does not complete access, correction, or deletion. Appeals, requests from people without an account, retention, provider deletion, and restore safeguards are not finished. This policy does not promise a response deadline or a complaint route.

The app can prepare a local copy of records already open on this device for an access request. That control is off unless a separate build flag is set to local-v1. The copy leaves out file bytes. It does not close the request, delete records, include another account’s data, or send the copy to Masch Media LLC, Supabase, or Resend.

To review account deletion, open Menu → Manage account. That screen is off unless the account-deletion release flag is turned on. The deletion code removes families that account owns and does not remove a family owned by someone else. It does not revoke Apple or Google sign-in, and it does not cancel an Apple subscription. While that screen is off, this policy does not offer deletion of health records to customers.