Consumer Health Data Privacy Policy

1. What counts as consumer health data

Information linked to you or your child that describes physical or mental health. In Slingshot, that includes:

• A disability classification or eligibility category, under IDEA or Section 504
• Evaluation and assessment results, and any diagnosis in them
• Services such as occupational, physical or speech-language therapy, and how much of each
• Behavioral, developmental or mental health goals and supports
• Medication or health conditions you mention
• Meeting recordings and transcripts, notes and observations that discuss any of the above
• The fact that your child has an IEP, IFSP or 504 plan, which reminder emails and texts can reveal

We treat all of it as sensitive, whether or not a particular law requires it.

2. How we collect it, and your consent

We collect it only from what you, or a firm you work with, add: documents, photos of pages, notes, concerns, observations and meeting recordings. We do not infer health information from your browsing, buy it, or collect it from other sources.

Before you add anything about your child, we ask for your consent to collect and use this information, separately from our Terms and Privacy Policy. We keep a record of which version you agreed to and when. If we change what we collect, why, or who receives it, we ask again.

Sharing with an advocate or firm needs a separate consent: it happens only when you accept that firm's invitation. When a firm uses Slingshot for a family without an account, the firm gets the family's consent under its own agreement with them, and we act only on the firm's instructions.

3. How we use it

• To read and organize your child’s documents and show what they say, with the page
• To help you prepare for meetings, and to keep your record across visits
• To send reminders you opted into
• To get better at reading school forms, learning only from how a form is laid out (headings, positions on the page, counts), never from what it says about your child

We never train AI models, ours or anyone else's, on it. We never use it for advertising, marketing profiles or research sold to others. Section 4 of our Privacy Policy explains how Slingshot learns from form layouts.

4. Who we share it with

We never sell consumer health data. We share it only with:

• Advocates and firms you approve, by accepting their invitation. You can end their access at any time in Settings.
• Rob Martin, if you book an optional advocacy session: he reviews your documents only to prepare for and hold that session. Sessions are not offered to families who come to Slingshot through a firm.
• Anyone a valid legal demand requires, after telling you first unless the law forbids it.
• These service providers, which process it only on our instructions:

5. Your rights

Wherever you live, you can ask us to:

• Confirm whether we hold consumer health data about you or your child
• Give you a copy of it
• Correct it
• Delete it, including from our service providers. You can also delete a child’s profile or your account yourself in Settings. Deleted data can remain in encrypted backups for up to 35 days.
• Tell you which third parties and service providers have received it, with how to contact them
• Withdraw your consent. Since we cannot provide the service without this information, withdrawing means deleting it.

Email hello@slingshotiep.com. We respond within 45 days of a request we can verify. If we decline, you can ask us to reconsider by replying to our answer, and then contact your state Attorney General. For records a firm holds for a family without an account, ask the firm; we will help it answer.

6. Maryland residents

Under the Maryland Online Data Privacy Act, disability, health and service information is sensitive data. We collect and use it only as strictly necessary to provide the service you asked for, never sell it, and never use it for targeted advertising. Maryland residents may appeal a denied request to the Maryland Attorney General's Consumer Protection Division at marylandattorneygeneral.gov.

7. Washington, Nevada and Connecticut residents

Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's data privacy act give you the rights in section 5. We collect consumer health data only with your consent, share it beyond our service providers only with your separate consent, and never sell it. We do not use geofencing around health care locations. To exercise your rights or file a complaint, email hello@slingshotiep.com or contact your state Attorney General.

8. Virginia and District of Columbia residents

Under Virginia's Consumer Data Protection Act, a health diagnosis is sensitive data, and we treat everything in section 1 the same way. We follow that law for every Virginia family, whether or not it applies to us by its size thresholds: we collect and use this information only with your consent, never sell it, and never use it for targeted advertising. Virginia residents may appeal a denied request to the Virginia Attorney General at oag.state.va.us.

The District of Columbia has no consumer health data law in force today. District families have every right in section 5, and if a breach affects their information, we tell them and the District's Attorney General as District law requires.