Consumer Health Data Privacy Notice

Effective and last updated: July 16, 2026 Contact: zach@protocolmediallc.com

This Notice applies to consumer health data processed through Mommy's Little Party Planner. It supplements our Privacy Policy and is intended to address consumer health privacy laws, including the Washington My Health My Data Act and Nevada's consumer health data law.

1. Consumer health data we collect

We collect only allergy and dietary information that a host, co-host, or guest voluntarily enters for a party. This may reveal or suggest a food allergy, intolerance, dietary restriction, or related health condition.

We do not intentionally collect diagnoses, treatment records, prescriptions, reproductive or sexual health information, biometric identifiers, genetic data, precise location, or medical-provider records.

2. Sources

We collect allergy and dietary information directly from:

a guest or the guest's parent or guardian submitting an RSVP;
a host or co-host entering or updating a guest record; and
a person contacting support about a party record.

We do not purchase consumer health data or obtain it from data brokers.

3. Purposes and uses

We use this information only to:

show allergy or dietary information to the party host and authorized co-hosts;
help the host plan food, activities, and accommodations;
synchronize the party record across authorized devices;
respond to a support, access, correction, or deletion request;
secure the Service and investigate misuse; and
comply with law.

We do not use consumer health data for advertising, profiling, AI Theme Maker requests, sale, data brokerage, or unrelated product development.

4. Consent

Before a guest can submit allergy or dietary information through an RSVP page, the guest must affirmatively agree to its collection and use for that party. A host or co-host who enters health information represents that they have authority or appropriate permission to provide it.

You may withdraw consent for future collection or sharing by removing the information from the party record, asking the host to remove it, or emailing us. Withdrawal does not affect processing that occurred before withdrawal where permitted by law.

5. Sharing

We share consumer health data only as necessary to provide the requested party-planning service:

with the host and authorized co-hosts for the party;
with Supabase or another contracted database provider that stores the party record;
with Vercel or another contracted hosting provider that runs the Service;
with technical contractors or support providers only when access is necessary to operate, secure, or support the Service; and
with regulators, courts, law enforcement, or other parties when legally required.

We do not sell consumer health data. We do not share it with advertisers, data brokers, Geoapify, payment providers, or the AI Theme Maker provider.

6. Retention and deletion

Health information attached to a published RSVP is deleted when the invite expires after the party date plus approximately 30 days or sooner if the host unpublishes or deletes the party. Health information stored in an active party record remains until the host removes it or deletes the party. When a party is deleted, substantive content is scrubbed from the active server record immediately and the minimal deletion tombstone is removed after up to 30 days.

Backups may take up to six months to cycle out where permitted by law. Deleted information is not restored to active use except when necessary for disaster recovery, security, or legal compliance.

7. Your rights

Depending on applicable law, you may have the right to:

confirm whether we collect, share, or sell consumer health data about you;
access the consumer health data and obtain information about recipients;
withdraw consent to future collection or sharing;
request correction;
request deletion from our systems and notification to processors or other recipients; and
appeal a refusal to act on a request.

Submit a request to zach@protocolmediallc.com with the subject "Consumer Health Data Request." You do not need to create a new account. Include enough information for us to locate and authenticate the relevant RSVP or party record, but do not send passwords or full payment-card numbers.

We aim to respond without undue delay and within 45 days when required. We may extend once when reasonably necessary and permitted by law. If we deny a request, you may appeal by replying with the subject "Consumer Health Data Appeal." We will not discriminate against you for exercising a right.

8. Security

We restrict access to consumer health data to people and service providers who need it for the purposes described in this Notice. We use safeguards designed for the nature of the information, including encrypted network transport, access controls, restricted server-side database access, and deletion controls.

9. Changes

We will not collect, use, or share a new category of consumer health data or use existing health data for a materially new purpose without updating this Notice and obtaining consent when required.

10. Contact

Questions and requests may be sent to zach@protocolmediallc.com.