Health data privacy policy

What we collect

Health information:

• Your answer to whether you are thinking about suicide or are in danger, including if you would rather not say.
• The needs you pick, such as health insurance or medication, or feeling overwhelmed or alone.
• Anything you write in the message box.
• What our form works out from your answers: how soon we suggest replying, and whether your message has words that can signal danger.

Other information we keep with it: the name you want us to use, your email, your phone number if you give it, how and when to reach you, your state, and any deadline you give us.

Where it comes from

From you, through the form. From our own notes when we reply to you. We do not buy health information, and we do not collect it from other websites or apps.

Why we use it

To read your request, decide how soon to reply, and reach you the way you asked. In an emergency, and only if you say yes, to try to get you help (see below).

We do not sell it, use it for ads, share it with an employer or former employer, or use it to train AI. We do not add it to an Offboard account.

Who receives it

Only the people on our team who answer these requests read it.

These companies store or carry it for us, under contract, and may not use it for anything else:

• Vercel, which hosts our website.
• Supabase, which hosts our database.
• Resend, which sends our emails.
• Our company email provider, where our team reads requests.

Our team chat gets a notice that a new request arrived. The notice has nothing from your request in it.

We have no affiliates that receive it. We share it with 988 or emergency services only if you say yes, as the next section explains.

In an emergency

We are not a crisis service, and we do not watch this form around the clock. If you are thinking about suicide or do not feel safe, call or text 988. If you are in immediate physical danger, call 911.

We contact 988 or emergency services about you only if you say yes. You can say yes in the optional box on the form, or when we talk. Then, if you are in immediate danger, we may share your name, how to reach you, where you are, and what you told us about your safety.

You can take back that yes at any time, by telling us when we talk or by emailing info@offboard.co. Without your yes, we will keep urging you to call 988 or 911 yourself, and we may ask 988 for advice without sharing anything that identifies you.

We cannot promise that we can find you or get help to you.

How long we keep it

90 days from the day you send it. Then we delete it from our database, our inboxes and our team chat.

Our database provider keeps short-term backups, and our email provider keeps a record of sent emails for a short time. A deleted request can stay in those copies until they expire. We never restore a backup to bring a deleted request back.

Your rights

You can ask us to:

• Tell you whether we have health information about you, and send you a copy.
• Tell you every company that has received it.
• Delete it.
• Correct it.
• Stop using it. You can take back your consent at any time, and we then delete your request.

Email info@offboard.co from the address you used in the form, or reply to the email we sent you. You do not need an account, and it costs nothing. To check that the request is yours, we reply to that address.

We answer within 30 days. If we say no, reply with the word Appeal and we answer within 45 days. If you still disagree, you can contact your state attorney general.

How we protect it

Every connection to our site uses HTTPS. Our database table for these requests can be read only by our own server, never by a web browser. Our team reads requests in company email accounts.

Changes to this policy

We change the dates at the top when we change this policy. Before we use your health information in a new way, we ask for your consent again.

Contact

Offboard, info@offboard.co.