Consumer Health Data Privacy Policy

This policy explains how Class Action Buddy handles consumer health data, as defined by Washington’s My Health My Data Act (RCW 19.373) and similar laws in other states. It adds to our main Privacy Policy. Where the two differ, this policy governs consumer health data.

When this policy applies

Only when you file a claim whose official claim form asks health-related questions. Right now that is one settlement: In re Laboratory Services Cooperative Data Breach Litigation, No. 2:25-cv-00685-BJR (W.D. Wash.), shown in the app as “LSC Lab Data Breach Settlement”. Its claim form asks whether you received lab testing at a Planned Parenthood health center. If you never file such a claim, we do not collect consumer health data about you.

Consumer health data we collect

• Your answers to the claim form’s class questions: whether you visited a Planned Parenthood health center and received lab testing, and whether you paid for lab testing for a patient who did.
• Patient details, if you answer yes to either: the patient’s first and last name and date of birth, and the city and state of the health center visited. The patient may be you or someone else.
• The fact that you filed this claim. Because the class is mostly people who were tested at these centers, a claim record connected to your name could itself suggest that you received health care. We treat it with the same care.

Where it comes from

From you, in the claim screen in the app. To save typing, some answers start from your profile once you answer yes: the patient’s name and date of birth, and a health center in your home state and city. You can change any of them, and none is used until you file. We do not buy this data, receive it from anyone else, or infer it from anything else you do in the app. We do not use location data or geofencing.

How we use it

For one purpose only: to complete the official claim form you asked us to prepare, print it, and mail it to the settlement administrator. We do not use it for marketing, advertising, profiling or analytics, or to decide what we show you in the app.

Who we share it with

What we share: your answers to the class questions and the patient details, as printed on your signed claim form. We share them with:

• The settlement administrator (LSC Data Incident Settlement Administrator, 1650 Arch Street, Suite 2210, Philadelphia, PA 19103), only with your separate consent to share, by mailing your signed claim form. The administrator is appointed by the court and uses claim forms to process claims under the settlement.

We also rely on:

• Supabase, Inc., our database host (a “processor”), which stores the data encrypted, only on our instructions, and may not use it for its own purposes.
• The United States Postal Service, which carries your sealed claim envelope to the administrator.

We have no affiliates that receive this data. We do not sell consumer health data. We will disclose it to anyone else only if the law requires it (for example, a valid court order), and we will tell you if the law allows.

How long we keep it

• We delete your answers to the class questions and the patient details automatically 14 days after your claim is mailed. The 14 days let us re-print your form if an envelope is returned.
• If a claim is never mailed, those details are deleted no later than December 24, 2026, one month after the filing deadline.
• Deleted data drops out of our database backups as they roll over, within 30 days.
• The rest of your claim record (your name, contact details, signature, payment choice, the date you consented, and the fact that you filed this claim) is kept as described in our main Privacy Policy. We keep it so we can answer questions about your claim and show that we filed it only on your instructions and with your consent.

Consent, and withdrawing it

Before the app shows any health question, you give two separate consents: one to collect your answers, and one to share them with the settlement administrator by mail. You can decline and file on the official settlement website instead.

You can withdraw either consent at any time. Before you submit, tap “Withdraw my consents and clear my health answers” on the claim screen. After you submit, email us (below). We will delete your answers and, if your claim has not been mailed yet, we will not mail it. If it has already been mailed, we cannot recall it, but we will delete our copy and can pass on a request for the administrator to delete theirs.

Your rights

Whatever state you live in, you can:

• Confirm whether we hold consumer health data about you, and get a copy of it
• Get a list of every third party and affiliate we have shared it with, with contact details
• Delete it. We will also tell our processors and anyone we shared it with about your request.
• Withdraw your consent to collection or to sharing

We will not treat you differently for using these rights.

How to make a request: email support@classactionbuddy.com with the subject line “Health Data Request”, ideally from the email address on your Class Action Buddy account. We may ask you to confirm your identity first, and we use what you send only for that. We reply within 45 days. If we need more time, we will tell you within those 45 days and take no more than 45 days more.

Appeals: if we turn down all or part of your request, you can appeal by replying to our answer with “Appeal” in the subject line. We will reply in writing within 45 days and explain our decision. If your appeal is denied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or the attorney general of your own state.

If you file for someone else

If you enter a patient’s details other than your own (for example, as a parent who paid for a child’s testing), please make sure you are allowed to share them. The patient, or their parent or guardian, can use every right on this page.

How we protect it

The data is encrypted in transit and at rest. Access is limited to the Class Action Buddy staff who prepare and mail claims, and they use it only for that. The app does not keep it on your phone: it is never saved in drafts, and your claim history on the device does not include it once you submit. Our internal alerts about new claims leave out your email address for this settlement.

Changes to this policy

If we change this policy, we will update the date below. We will not use consumer health data in a new way, or share it with someone new, without asking for your consent again.

Contact us

Class Action Buddy
Operated by Kaptivate Labs LLC
2709 Northview Ct, Flower Mound, TX 75022
Email: support@classactionbuddy.com

Effective date: September 29, 2026. Last updated: September 29, 2026.