Consumer Health Data Privacy Policy

1. What Counts as Consumer Health Data Here

Several state laws (Washington's My Health My Data Act, and similar laws in other states) define "consumer health data" broadly, covering not just medical records but any data that identifies a consumer's physical or mental health status, or their attempt to obtain health care. Four things on Forzara fall under that definition:

• Wellness check-ins — an optional, one-tap status log on the Recovery Finder tool.
• Recovery Finder search input — what you type into the search form when looking for treatment or recovery support.
• Healthcare Access milestone status — if you track it as part of your program, whether you've completed steps toward healthcare access (for example, Medicaid reactivation).
• CSBG/grant-reporting worksheet fields — if your organization uses our CSBG worksheets, certain federally required intake fields: health insurance status and source, disability-linked income (for example SSDI or VA disability compensation), and veteran/military status. See Section 2 below.

We do not collect diagnoses, prescriptions, insurance ID numbers, treatment records from a provider, or any other detailed medical record. The CSBG worksheet fields above are status/category checkboxes (for example, "has Medicaid" or "receives VA disability compensation"), not medical records, diagnoses, or ID numbers.

2. What We Collect, and Why

Wellness check-ins

The Recovery Finder tool lets you log one of three fixed statuses, "Attended a session," "Just checking in," or "Having a hard week," with the date. There is no free text field. This is entirely optional: nothing on Forzara schedules, reminds, or requires a check-in, and using every other part of the platform never depends on whether you use this feature. We keep it so you have a private record of your own for yourself, and so your support coach, if you're enrolled through a partner organization, has some visibility into how you're doing without you having to write anything down.

Recovery Finder search input

The zip code, what you're looking for, and any additional details you type are used to run a live, real-time search for treatment and recovery options near you. See Section 5 for how that search is processed.

Healthcare Access milestone status

If you're enrolled through a partner organization and choose to track the Healthcare Access milestone, we store its status (not started, pending review, or approved) and any short optional note you attach, the same way every other milestone on Forzara works. This is governed by, and already described in, our general Privacy Policy's Sections 2 and 5, it is not a separate system.

CSBG/grant-reporting worksheet fields

If you're enrolled through a partner organization that receives Community Services Block Grant (CSBG) funding and uses our on-screen worksheets, a staff member at that organization records certain federally required intake fields about you as part of the worksheet: health insurance status and source, disability-linked income sources, veteran/military status, and household income level. This is data the organization is separately required to collect and report to its state and federal grant administrators regardless of whether it uses Forzara to do so — our worksheets are a tool for recording it, not a new reason it's collected. It is encrypted and stored in a database physically separate from the rest of Forzara, with its own restricted credentials that can add or read a record but never alter or delete one. See our general Privacy Policy's Section 5 for how this differs from an ordinary funder report.

3. Your Consent

Most state consumer health data laws require your affirmative, opt-in consent before we collect sensitive data like this, not just a disclosure you could easily miss. Nothing described in this policy is collected by default or in the background: a wellness check-in is only ever recorded because you tapped a specific button after reading, right there on the page, that your support coach can see it. A Recovery Finder search only runs because you typed something into the form and submitted it. A Healthcare Access milestone status only exists because you chose to track that milestone. There is no setting to turn off here because none of this is ever on until you take a specific, deliberate action to create it.

The CSBG worksheet fields work a little differently, since a staff member records them on your behalf rather than you entering them yourself: our worksheet requires that staff member to affirmatively confirm, at the moment they save it, that you were informed this information is being collected for grant reporting and that you consented to it — the same consent-to-collect step most CSBG intake already involves on paper. That confirmation is saved alongside the worksheet as a permanent part of the record.

4. Where This Data Comes From

Directly from you. We do not buy, license, or otherwise obtain health data about you from any data broker, health information exchange, or other third party.

5. Who We Share It With

We do not sell consumer health data, under any definition, for any price. We do not share it with advertisers, data brokers, or anyone for marketing purposes. The narrow cases where it is shared at all:

• Your support coach, if you're enrolled through a partner organization: your last several wellness check-ins (status and date), and your Healthcare Access milestone status and any note you attach, when they view your profile. Nobody is alerted the moment you log a check-in, a coach only sees it if and when they open your profile. This log is never monitored in real time, if you need help right now, message your coach directly or use the crisis resources on the Support page.
• Google Gemini (paid API tier), only for the Recovery Finder search: your search input is transmitted to generate that search's results, the same way it is for every other AI-assisted tool on Forzara. Under Google's paid API terms, this input is not used to train or improve their models, and we do not store your search input or its results ourselves once your browser session ends. See our general Privacy Policy's Section 3 for the full terms.
• Your organization's own authorized staff, for CSBG worksheet fields: the same staff who already have access to your milestone and program data can view a worksheet's answers, since they're the ones recording and using it for the organization's own required reporting. Only aggregate, organization-wide totals, never your individual answers, ever leave your organization's own staff, and only when your organization's own admin chooses to certify and send a report; we do not transmit these totals to any funder, grantor, or third party ourselves. See our general Privacy Policy's Section 5.
• When required by law, the same limited circumstances described in our general Privacy Policy's Section 5.

6. Geofencing

We do not use geofencing, or any other location-based targeting, around healthcare facilities, in-patient or out-patient care facilities, or reproductive or sexual health facilities, or anywhere else. Forzara does not serve advertising of any kind, to anyone, so there is nothing to target in the first place.

7. How Long We Keep It

• Wellness check-ins: retained while your account is active, permanently deleted if you delete your account.
• Recovery Finder search input and results: never stored. Processed in the moment to generate your search results and discarded once your browser session ends.
• Healthcare Access milestone status and notes: same retention as every other milestone, see our general Privacy Policy's Section 6.
• CSBG worksheet fields: kept as a permanent, dated record once submitted, consistent with the recordkeeping requirements CSBG grantees are already subject to for audit purposes. By design, our own systems can add or read this record but not alter or silently delete it. Because of that recordkeeping requirement, we generally cannot fulfill an individual deletion request for this specific data the same way we can for a wellness check-in; contact us using Section 10 below and we'll tell you what's possible for your situation.

8. Your Rights

You have the right to:

• Confirm whether we are collecting, sharing, or have sold your consumer health data. (We have never sold it, to anyone, for any reason.)
• Access a list of the consumer health data we hold about you, and any third parties it has been shared with.
• Delete your consumer health data, including directing us to have any affiliate, processor, or contractor delete it too, subject to the CSBG recordkeeping limit described in Section 7.
• Revoke your consent to any collection or sharing of it going forward.
• Not be discriminated against for exercising any of these rights, or for choosing not to use the wellness check-in feature at all.

To exercise any of these rights, visit your Support page and select "Privacy Question," or email us directly at the address below. To request deletion of your account and all associated data, including the data described in this policy, use Delete Account in your Account Settings. We will respond within the time required by applicable law.

9. Changes to This Policy

If we change what health data we collect, why, or who we share it with, we will update this page and its "Last Updated" date, and for a material change, provide notice the same way described in our general Privacy Policy's own Section 13.

10. Contact Us

Questions about this policy, or to exercise any of the rights in Section 8, contact us at: