Consumer Health Data Privacy Policy

1. Who We Are

OpenRoad LLC, 5941 39th Ave SW, Seattle, WA 98136. Contact: openroad2026@gmail.com.

2. Categories of CHD We Collect

Out of an abundance of caution, we treat the following categories of data as CHD under RCW 19.373.010(8):

• Precise location information collected during drives, including GPS coordinates recorded while a drive session is active, and the same coordinates after they are uploaded to our servers.
• Speed, heading and altitude recorded at each of those coordinates. A speed reading is stored alongside every point of a route, both on your device and in the drive record we hold on our servers.
• Motion and sensor data (accelerometer, gyroscope) collected while a drive session is active, including the per-reading accelerometer values held in the raw-readings file for each synced drive.
• Drive metadata (start/end times, duration, distance, route polyline).
• Drive Score and component metrics derived from the above.
• Biometric data limited to avatar photos you choose to upload (we do not extract facial geometry, and we do not create voiceprints from voice chat).

We do not intentionally collect or infer (and we do not want) information about your health conditions, reproductive-health status, gender-affirming care, mental-health status, prescriptions, or medical diagnoses.

3. Sources of CHD

We collect CHD directly from you, from your device's sensors while you are actively using the Service, and from third-party service providers (Apple, Google, Firebase) acting on our behalf.

4. Purposes of Processing CHD

• Provide core app features you request (drive logging, convoy location sharing, Drive Score).
• Operate, secure, and debug the Service.
• Comply with legal obligations.

We do not use CHD for advertising, and we do not sell CHD.

5. Categories of Third Parties and Affiliates Who Receive CHD

Our product-analytics provider (Firebase Analytics) and our real-time voice provider (LiveKit) do not receive your CHD. Location, route, and address values are blocked from analytics events at the point of sending, and voice chat is transmitted in real time and never recorded. They are therefore not categories of recipients of CHD.

Affiliates: OpenRoad LLC has no affiliates that receive CHD.

6. Consent

Before we collect any CHD, you will see an in-app consent screen that identifies (i) the categories of CHD to be collected, (ii) the purposes of collection, (iii) the categories of recipients, (iv) the retention period, and (v) your right to withdraw consent. Your consent is separate from acceptance of the general Privacy Policy and Terms. You can withdraw consent at any time in Settings → Privacy & Data → Consumer Health Data Consent.

7. No Sale Without Authorization

We do not sell your CHD. If we were ever to propose to sell CHD, we would first obtain your written valid authorization that complies with RCW 19.373.030, including the statutorily required elements. No authorization currently exists, and we request none.

8. Retention

We keep CHD only as long as needed for the purposes above:

• Drives (locally on your device): until you delete them.
• Drives synced to our servers: drive sync is on by default when you are signed in, and it runs for every drive, not only the ones you share. The drive record, the trimmed route, the speed readings along it, and the raw-readings file are kept until you delete the drive or your account. There is no timed expiry.
• Real-time convoy presence on our servers: approximately 90 seconds via automatic time-to-live (TTL) expiry, with a periodic server sweep removing any stale entries.
• Drive Score: recomputed from drives; deleted when the underlying drive is deleted.
• Backups: residual data may persist in encrypted backups, log archives, and provider-side replicas for up to 180 days from deletion, after which data is irretrievably purged.

9. Your Rights

Under RCW 19.373.050 you have the right to:

1. Confirm whether we are processing your CHD.
2. Access the CHD we process, including a list of third parties and affiliates that have received your CHD.
3. Withdraw consent to collection or sharing.
4. Delete your CHD. We will honor deletion requests and instruct our processors and affiliates to do the same, including with respect to archived and backup copies, within the timeframe permitted by the statute.

Submit requests in Settings → Privacy & Data or by emailing openroad2026@gmail.com with subject "MHMDA Request." We will respond within 45 days and may extend once by 45 days when reasonably necessary.

10. Appeals

If we deny a request, you may appeal by emailing openroad2026@gmail.com with subject "MHMDA Appeal" within 30 days of the denial. We will respond within 45 days with our reasoning. You may also contact the Washington Attorney General at atg.wa.gov/file-complaint or, under Washington's Consumer Protection Act (RCW 19.86), bring a private action for actual damages, treble damages up to $25,000, injunctive relief, and attorneys' fees.

11. Geofencing Prohibition

We do not implement any geofence around any in-person healthcare facility for the purposes of (i) identifying or tracking consumers seeking health services, (ii) sending health-related notifications or advertisements, or (iii) collecting CHD from consumers in those areas. We comply with RCW 19.373.100.

12. Changes

We may update this policy as the Service changes. The current version is always the one posted here, and the "Last updated" date tells you when it changed. Where a change would mean collecting or sharing consumer health data for a new purpose, we will ask for your consent before that collection or sharing begins, as RCW 19.373 requires.

13. Contact

OpenRoad LLC, 5941 39th Ave SW, Seattle, WA 98136 · openroad2026@gmail.com (subject "MHMDA").