Legal

Privacy Policy

Last updated: June 27, 2026

This is our current policy in plain language. It is being finalized with legal counsel; if anything changes materially we'll note it here.

Plan B for PANS(“Plan B,” “we,” “us,” “our”) — a non-profit organization.

This Privacy Policy explains what information Plan B collects, how we use it, who we share it with, and your choices. It applies to the Plan B website, applications, and services (the “Service”). Because the Service involves sensitive health information about children, please read this carefully.

1 · A note about the sensitive nature of this data

Plan B is built for families of children with PANS/PANDAS. The information you provide includes sensitive health information about a child— uploaded medical records and labs, symptoms, medications, behaviors, and your conversations with Minta about your child's health. We treat this information with care. You are the parent or guardian and the account holder; you decide what to provide.

2 · Information we collect

We collect information you provide and information generated through your use of the Service:

Account information — your name, email address, login credentials, and basic account settings.
Uploaded health records and labs — documents, lab results, and other medical records you upload about your child.
Symptom-tracking entries — daily Tracker data about your child's symptoms, medications, supplements, and behavior, and related context (for example, ZIP code used to provide environment/pollen context).
Minta conversations — the messages you exchange with the Minta AI assistant.
Synthesis and Direction inputs and outputs — the records you provide for, and the documents produced by, these features.
Payment information — handled by Stripe. We receive limited transaction details (such as that a payment succeeded and the last four digits/brand); we do not store full payment-card numbers.
Usage and device information — basic logs, device/browser information, and analytics used to operate and secure the Service. [Analytics/cookies actually used to be confirmed; cookie disclosure added if applicable.]

3 · How we use information

We use information to:

operate and provide the Service — store and display your records, run the Tracker, power Minta, and generate the Synthesis and Direction;
process information through AI — send your relevant content to our AI subprocessor to generate Minta responses and the Synthesis (see Section 4);
process payments through Stripe;
maintain security, prevent abuse, debug, and comply with law;
communicate with you about your account, purchases, and the Service; and
conduct optional, consent-based de-identified aggregate research (see Section 5).

We do not use your child's identifiable health information for advertising.

4 · AI processing and subprocessors

To provide Minta, the Synthesis, and related features, we use third-party service providers (“subprocessors”). They process data only to provide their services to us.

Anthropic (Claude API) — AI processing. To generate Minta responses and the Synthesis, relevant content you provide is sent to Anthropic's API. Per Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models. [Current Anthropic API terms and retention to be confirmed with counsel before finalizing.]
Supabase — database and storage hosting (your account data, records, Tracker entries, and conversations are stored here).
Vercel — application hosting and delivery.
Stripe — payment processing.

Each subprocessor is bound by its own terms and security commitments. [Whether data-processing addenda / BAAs are needed with any subprocessor to be confirmed with counsel.]

5 · Optional de-identified aggregate research

With your consent, Plan B may use de-identified information for aggregate cross-family research — for example, to understand which approaches families report as helpful across many children. De-identified data does not identify your child and we do not attempt to re-identify it. This is optional; you can decline or withdraw consent without losing access to the core Service. [Consent mechanism, de-identification standard, and disclosures to be confirmed with counsel.]

6 · What we do NOT do

We do not sell your personal information.
We do not share your personal information with advertisers, data brokers, insurers, or schools without your explicit consent.
We do not use your child's identifiable health data for marketing or advertising.

We share information only with the subprocessors listed above (to operate the Service), with your consent, or as required by law (for example, to comply with a valid legal request, or to protect rights, safety, or the integrity of the Service).

7 · Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest and access controls. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you and authorities as required by law.

8 · Data retention and one-click deletion

We retain your information for as long as your account is active or as needed to provide the Service, unless a longer period is required by law.

You can delete all of your data with one click from your account. When you delete, we remove your account data and User Content from our active systems and instruct our subprocessors to do the same; limited copies may persist in routine backups for a limited period before being overwritten, and we may retain minimal records where required by law. You may also email rachel@planbforpans.com to request deletion.

9 · HIPAA note

Plan B believes it is a direct-to-consumer service and likely not a HIPAA “covered entity” or “business associate”, because it does not provide health care or bill insurance and instead helps families organize their own records. As a result, HIPAA may not apply to Plan B. Regardless, Plan B treats health information carefully as described in this Policy. [HIPAA applicability — and whether any subprocessor relationship or future feature changes this analysis — to be confirmed with counsel.]

10 · Your privacy rights

Depending on where you live, you may have rights under laws such as:

Washington My Health My Data Act (MHMDA) — which broadly regulates “consumer health data” and may require a separate Consumer Health Data Privacy Policy, specific consent for collection/sharing, and a right to withdraw consent and to have data deleted.
California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — rights to know, access, correct, delete, and limit use of sensitive personal information, and to opt out of “sale”/“sharing” (we do not sell or share for cross-context advertising).
Other state privacy laws (e.g., Virginia, Colorado, and others) that may grant similar rights.

To exercise any available right, contact rachel@planbforpans.com. We will respond as required by applicable law and will not discriminate against you for exercising your rights. [Which laws apply and the required disclosures, notices, and consent mechanics to be confirmed with counsel.]

11 · Children's data

The Service is used by a parent or legal guardian (the account holder), who provides information about their minor child. Children do not use the Service directly and do not create accounts. The data about a child is provided by, and under the control of, the responsible adult.

Because the Service is directed to adult parents/guardians and not to children, we believe the Children's Online Privacy Protection Act (COPPA) — which governs collecting personal information directly from children under 13 — is unlikely to apply in the usual way. [COPPA consideration, including how the rule treats a parent entering a child's health data, to be confirmed with counsel.]

12 · International users

The Service is operated in the United States, and your information is processed in the United States. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S. [Whether the Service is offered outside the U.S. and any resulting obligations to be confirmed with counsel.]

13 · Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will provide reasonable notice (for example, by posting the updated Policy with a new effective date or by emailing you). The “Last updated” date at the top shows when this Policy was last updated.

14 · Contact

Questions about this Policy or your data: rachel@planbforpans.com.