Consumer Health Data Notice

The ordinary CommuterCart Platform does not request diagnoses, treatment details, prescription names, reproductive or sexual-health information, or other unnecessary consumer health data. Prescription drugs, medical specimens, and regulated medical deliveries remain prohibited unless CommuterCart expressly activates a separately approved workflow. This notice applies if information processed through an approved workflow is regulated as consumer health data under an applicable state law and is not otherwise governed by a more specific medical-privacy law.

An approved workflow may process only the minimum information required to determine delivery eligibility, handling requirements, authorized release, identity or age verification, delivery status, chain of custody, and proof of delivery. Sources may include the consumer, an authorized Sender or Recipient, a licensed pharmacy or health-related merchant, a Driver, and contracted identity, communications, payment, or delivery providers.

Consumer health data is used only to create and complete the authorized delivery; verify lawful release and receipt; provide support; prevent fraud or unsafe handling; administer a claim; comply with law; and secure the workflow. It is not used for targeted advertising, unrelated profiling, data brokerage, or ordinary TransportAI training.

We may share the minimum necessary information with the Sender, authorized Recipient, approved Driver, regulated merchant, and contracted providers needed to complete or secure the delivery, and with insurers, advisers, emergency services, regulators, courts, or law enforcement when lawfully required. We do not sell consumer health data.

Before a workflow collects or shares consumer health data in a manner requiring authorization, CommuterCart or the responsible merchant will present the required standalone disclosure and obtain valid consent. A merchant may not submit protected health information unless the parties have approved the workflow and entered any legally required agreement, including a business associate agreement where applicable.

Where applicable, a consumer may request confirmation, access, correction, deletion, withdrawal of consent, or a list of relevant recipients through /privacy-request. We verify the request and respond within the legally required period. Withdrawal applies prospectively and may prevent the regulated delivery workflow from continuing.

We restrict access, use secure approved workflows, apply appropriate contractual and technical safeguards, and retain consumer health data only as long as necessary for delivery, claims, security, legal compliance, and the retention periods disclosed at collection. Ordinary support messages must not be used to transmit health details, prescriptions, government identifiers, or medical documents.

Questions or requests may be submitted through in-app support or /privacy-request, or mailed to CommuterCart, 186 Main Street, Farmington, ME 04938, United States.