Consumer Health Data Privacy Policy
Starry Night (sole proprietor: Nick), 201 N MacArthur Dr, West Lafayette, IN 47906 · nick@starrynightops.com. Effective October 24, 2026.
1. Consumer health data we collect, why, and how we use it
| Category | Purpose and use |
|---|---|
| Medical records the family or professional sends: visit notes, hospital and discharge papers, test results, diagnoses and treatments named in those records, and the providers and dates in them | To prepare the binder the person requested: put records in date order with page citations, list follow-ups the records mention, and flag pages that belong to someone else |
| Medication lists and prescription information in those records | To show medication lists side by side and quote where the hospital, primary-care, pharmacy or care-facility lists disagree, as questions for the prescriber |
| Medicare, insurance and billing documents: Medicare Summary Notices, plan notices, provider bills, claim numbers and amounts | To match bills to Medicare or plan statements, flag amounts above what the statement says may be billed, and calculate appeal deadlines |
| Identifiers linked to that data: the person's name, date of birth and address, and the fact that they are using our service | To match pages to the right person, deliver the binder and required notices, and keep the signed permission |
| Permission and authority records: signed permission forms, and copies of health care power of attorney, guardianship or similar documents | To confirm we may collect, use and share the data, and to show that later |
We use this data only to provide the binder service the person (or their legal representative) requested. We don't use it for advertising or marketing, and we don't sell it.
2. Where it comes from
- The person the records are about, or their legal representative.
- Family members the person has authorized, who send documents and the permission form.
- Professionals (such as care managers or billing advocates) who send a client's documents with the client's written authorization.
3. Consumer health data we share
The finished binder, medication comparison, deadline list and draft letter, containing the categories in section 1, and the underlying documents as needed to process them.
4. Who we share it with
- Recipients the person authorizes: the family members, or the professional, named on the signed permission form.
- Service providers that process it for us under contract: an AI model provider (Anthropic), secure file upload and storage (Dropbox), email (Google Workspace), payment processing (Stripe; order details only, not records) and website hosting (Cloudflare; no records).
- Government or courts, only when the law requires it.
- We have no affiliates.
5. How to exercise your rights
The person the data is about, or someone acting for them with legal authority, can:
- confirm whether we collect, share or sell their consumer health data, and get a copy of it;
- get a list of every third party we've shared it with, and an email address to reach each one;
- withdraw consent to our collection or sharing;
- have it deleted, including by the service providers that hold it for us.
How: email nick@starrynightops.com with the subject "Health data request" and say what you'd like. We confirm the request comes from the person or their authorized representative, usually by replying to the contact details on the permission form. We respond within 45 days; if we need longer, we'll tell you why within that time and finish within 45 more. Requests are free up to twice a year.
Appeals: if we decline a request, reply with "Appeal" within 45 days and we'll answer within 45 days, explaining what we did and why. If we deny the appeal, Washington residents may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.