How Longview handles personal health record data.

1. Scope

Longview Health provides a personal health record product for individuals who want to organize labs, documents, biomarkers, protocols, and related context. Longview is not a medical provider, health plan, or healthcare clearinghouse.

Longview is intended to operate as a vendor of personal health records for purposes of the FTC Health Breach Notification Rule, 16 CFR Part 318. This policy does not describe HIPAA-covered provider or health-plan practices.

2. Information we collect

• Account information, including email address, authentication identifiers, subscription state, and support communications.
• Health record information you provide or upload, including lab reports, biomarker values, vitals, body-composition records, performance metrics, medication or supplement context, symptoms, goals, notes, and document review decisions.
• Technical information needed to run the service, including device/browser metadata, IP-derived security signals, audit logs, error logs, and usage events.
• Payment information handled by our payment processor. We do not intentionally store full payment card numbers on Longview systems.

3. How we use information

We use information to provide the product, authenticate users, normalize biomarker records, preserve source context, generate deterministic summaries, show trends, operate security controls, troubleshoot errors, provide support, and comply with legal obligations.

Longview does not sell personal health record data. We do not use uploaded health records for third-party advertising.

4. Sharing and processors

We share information with service providers only as needed to operate Longview, such as hosting, authentication, database, storage, payment, email, analytics, support, or optional model infrastructure. These providers are expected to process data for Longview's service purposes, not for their independent advertising purposes.

We may disclose information if required by law, to protect rights and security, or as part of a business transaction where privacy obligations continue to apply.

5. Security and retention

Longview uses technical and organizational safeguards appropriate for a production web application, including authenticated access, database isolation controls, transport security, least-privilege runtime credentials, and monitoring. No system can be guaranteed perfectly secure.

We retain information while your account is active or as needed to provide the service, comply with law, resolve disputes, enforce agreements, maintain auditability, and preserve data integrity.

6. Your choices

You may request access, correction, export, or deletion of your account information by contacting us. Some records may be retained when necessary for security, legal compliance, backup integrity, dispute resolution, or audit logs.

You control what health documents and biomarkers you upload. You should not upload another person's health information unless you have authority to do so.

7. Health breach notices

If Longview discovers a breach of security involving unsecured personal health record identifiable health information, we will evaluate notice obligations under the FTC Health Breach Notification Rule and applicable state laws.

Where notice is required, we will provide notice using available contact information and include the information required by law.

8. Contact

Questions or privacy requests can be sent to hello@longviewhealth.org.

Website: longviewhealth.org