Effective date: August 26, 2026
EverPacket is local-first. Health-related information that you choose to enter into a packet is processed and stored in your browser and in files or outputs you control through ordinary product use. EverPacket’s servers are not designed to receive that packet content.
1. Scope and relationship to other notices
This Consumer Health Data Privacy Notice (Notice) supplements the EverPacket Privacy Policy, Terms of Use and Software License, Cookie and Device-Storage Notice, and Digital Product, Delivery, Compatibility and Local-Storage Disclosure. It explains EverPacket’s practices for health-related information under consumer-health-data laws that may apply, including laws in Washington, Nevada, Connecticut, and other United States jurisdictions.
For this Notice, consumer health data means information that identifies or can reasonably be linked to a person’s past, present, or future physical or mental health status, health care, treatment, medication, or efforts to obtain health care. Mandatory law controls if it provides broader rights or uses a different definition.
EverPacket publishes this Notice as an additional transparency measure. It does not mean that every consumer-health-data law applies to every user, feature, or activity. EverPacket does not provide health care, connect to electronic health records, pharmacies, insurers, fitness trackers, medical devices, or other health-data sources, or receive and maintain ordinary packet contents on its servers.
2. The local-first health-data boundary
Through ordinary product operation, the editable packet and any health-related information in it remain in the browser profile and device storage you use and in project files, PDFs, contact cards, QR codes, printouts, or other outputs you choose to create.
The application processes local packet information in your browser only as needed to provide the functions you request, such as saving, editing, searching, reviewing, importing, exporting, and generating outputs. That local processing does not by itself transmit the content to EverPacket.
An EverPacket account stores account, authentication, purchase, consent, and operational information. It does not upload, synchronize, back up, transfer, inspect, or recover packet contents. Signing in on another device does not move the packet.
A permitted, redacted support image is a limited exception to the ordinary local-only boundary. The support form must not be used to submit consumer health data, packet entries, project files, generated packet outputs, medical information, or other prohibited content.
3. Categories of consumer health data
Depending on what a user chooses to enter or import, local packet information may include:
-
healthcare-provider, pharmacy, insurance, caregiver, emergency-contact, or other health-related contact information;
-
the location of a medication list, allergy list, advance directive, medical power of attorney, emergency folder, member card, or other health-related record;
-
health-related care routines, emergency instructions, access prerequisites, or notes about where information or assistance can be found;
-
information that may indicate that a person sought, received, or may need health care; and
-
other health-related information a user voluntarily enters despite product guidance, including information about a condition, diagnosis, treatment, procedure, medication, reproductive or sexual health, gender-affirming care, genetic information, biometric information, or mental health.
EverPacket does not ask for detailed medical records, clinical notes, test results, prescriptions, full insurance or government-identification numbers, biometric templates, genetic test files, or other information that belongs in a purpose-built healthcare or secure-record system. The product does not diagnose a condition, infer health status from non-health data, or create health profiles for advertising or eligibility decisions.
4. Sources and purposes
4.1 Sources
Consumer health data processed locally may come from:
-
information the user types, selects, pastes, or otherwise enters into a packet;
-
an .EverPacket project file the user chooses to import;
-
local project history, review state, or other browser state created from the user’s own actions; and
-
a user-directed output created from the local packet, such as a PDF, contact card, QR code, or printout.
EverPacket does not obtain packet health information from healthcare providers, electronic health records, pharmacies, insurers, data brokers, advertising platforms, fitness trackers, medical devices, or government databases.
4.2 Purposes
EverPacket processes local consumer health data only to provide the product functions the user requests, including:
-
displaying, saving, editing, organizing, searching, and reviewing local packet entries;
-
importing and exporting a user-selected project file;
-
generating a user-selected PDF, contact card, QR code, printout, or other output;
-
maintaining local revision, integrity, backup-status, and multi-tab safety information; and
-
allowing the user to delete, move, back up, or share information using controls and services the user selects.
EverPacket does not use packet health information for advertising, behavioral profiling, unrelated analytics, model training, sale, or decisions about employment, housing, insurance, credit, education, or access to health care.
5. Sharing, affiliates, and third parties
Categories of consumer health data shared by EverPacket through ordinary product operation: none.
Categories of third parties or affiliates that receive ordinary local packet health data from EverPacket: none. EverPacket currently has no affiliate that receives consumer health data.
A user may direct information to a browser, operating system, cloud drive, email or messaging service, printer, contacts application, QR scanner, recipient, or other third party by exporting, downloading, printing, scanning, or sharing an output. That is a user-directed disclosure outside EverPacket’s server systems, and the selected third party’s terms and privacy notice apply.
If prohibited health information is inadvertently submitted through a support form, Cloudflare, Supabase, and authorized EverPacket personnel or service providers may process it only as necessary to secure the request, restrict access, investigate the incident, contain or delete the information, comply with law, or establish, exercise, or defend legal claims. Such an inadvertent submission does not authorize EverPacket to use the information for ordinary support, analytics, advertising, or model training.
6. No sale, advertising, profiling, or health-care geofencing
EverPacket does not sell consumer health data or exchange it for monetary or other valuable consideration.
EverPacket does not share consumer health data for cross-context behavioral advertising, build advertising audiences from packet content, or use packet content to infer a person’s health status, interests, or eligibility.
EverPacket does not use precise location information or implement a geofence around a healthcare facility to identify or track people seeking care, collect consumer health data, or send health-related messages or advertisements.
7. User direction and consent
A user who deliberately enters or imports health-related information and invokes a local feature is requesting the local processing necessary to provide that feature. EverPacket relies on the user-requested-product basis where applicable for this ordinary local processing.
Acceptance of general Terms is not treated as a separate consumer-health-data consent. If a future feature would collect, use, or share an additional category of consumer health data or use it for an additional purpose not disclosed in this Notice, EverPacket will first update the Notice and obtain a separate, specific, affirmative opt-in consent when required by law.
EverPacket will not condition ordinary product access on consent to sell consumer health data, because EverPacket does not sell consumer health data.
8. Consumer rights and how to exercise them
Depending on applicable law, a consumer may have the right to:
-
confirm whether EverPacket is collecting, sharing, or selling consumer health data concerning the consumer;
-
access consumer health data that EverPacket controls and receive information about applicable recipients;
-
withdraw consent for future collection or sharing when processing is based on consent;
-
delete consumer health data that EverPacket controls;
-
appeal a refusal to act on a request;
-
receive service without unlawful discrimination for exercising a right; and
-
contact a competent state attorney general, privacy authority, or court.
For information held only in the local packet, exercise these rights directly by editing or deleting entries, deleting the packet, clearing the site’s IndexedDB and other browser data, or deleting exported files and outputs from every location where they were saved or shared. Export any copy you need before clearing site data. Account deletion does not delete local packet data, and EverPacket cannot remotely access or delete content that never reached its servers.
For consumer health data that may be held by EverPacket, send a request to privacy@everpacket.com. Identify the right you wish to exercise and provide the minimum information needed to locate and authenticate the request. Do not send packet contents, medical records, passwords, complete payment credentials, or unnecessary identification. You do not need to create a new account to make a request, although EverPacket may require use of an existing account or other proportionate authentication when available.
EverPacket will respond within the deadline required by applicable law. Where Washington law applies, EverPacket will respond without undue delay and ordinarily within 45 days, subject to one permitted 45-day extension with notice. An appeal may be submitted to the same address with the subject “Consumer health data appeal,” and will be answered within the applicable deadline.
9. Deletion and retention
Ordinary packet consumer health data has no EverPacket server-retention period because EverPacket’s servers are not designed to receive it. Local data remains until the user deletes it or the browser, operating system, device, storage provider, recipient, or another holder removes it.
Downloaded project files, PDFs, contact cards, QR codes, screenshots, backups, cloud-drive copies, email or messaging copies, and printouts remain until the user or another holder deletes or destroys them. Deleting an EverPacket account does not delete those copies.
If EverPacket identifies consumer health data in a prohibited or unnecessary support submission, it will restrict access and delete or contain the information promptly under its privacy and security procedures. EverPacket may preserve the minimum necessary information for a documented security incident, legal hold, regulator request, or legal claim and will return it to the ordinary deletion process when the exception ends.
10. Security
EverPacket uses safeguards appropriate to the account, transaction, consent, support, and operational information it receives. Access to any inadvertently received consumer health data is restricted to people and providers who need it for containment, deletion, security, legal compliance, or protection of rights.
Local packet records in IndexedDB and exported .EverPacket project files are not currently encrypted by EverPacket. Use device login, full-disk or device encryption, screen lock, a private browser profile, protected backups, and careful sharing. Do not treat EverPacket as a medical-record system, password manager, or encrypted vault.
11. Children and information about other people
EverPacket is not directed to children under 13. Accounts and purchases require the age of legal majority. An adult may enter information about a dependent or another household member locally, but the adult is responsible for having a lawful and appropriate basis, limiting the information, keeping it accurate, and sharing it only with appropriate recipients.
A request concerning another person may require proof that the requester is legally authorized to act for that person.
12. Data incidents
EverPacket maintains an incident-response process for personal information it controls. If an incident involving consumer health data creates a notification duty under applicable law, EverPacket will notify affected people and authorities in the manner and time required by that law.
Loss, theft, exposure, or unauthorized sharing of a user’s device, browser profile, unencrypted project file, output, backup, or printout that never reached EverPacket is not an incident in EverPacket’s server systems, but it may still create serious risk. The person controlling that copy is responsible for evaluating any notification or protective action that may be required.
13. Changes to this Notice
EverPacket may update this Notice prospectively and will post the current version and effective date. For minor, administrative, clarifying, formatting, or non-material changes that do not materially expand the categories of consumer health data processed, the purposes of processing, or the recipients of the data, posting the updated Notice is ordinarily sufficient and EverPacket does not ordinarily send an individual email or in-product notice.
EverPacket will provide additional notice or obtain consent when required by law. EverPacket will not process an additional category of consumer health data or use or share consumer health data for an additional undisclosed purpose without first providing the required disclosure and obtaining affirmative consent where required.
14. Contact and appeals
Controller / business
Kimi Chen, a California sole proprietor doing business as EverPacket
8843 Villa La Jolla Drive Apt 2, La Jolla, CA 92037
San Diego, California, USA
Privacy and consumer health data requests: privacy@everpacket.com
Product support: support@everpacket.com
To appeal a decision on a consumer health data request, email privacy@everpacket.com with the subject “Consumer health data appeal” and explain why you believe the decision should be reconsidered. You may also submit a complaint to a competent state attorney general or other authority where applicable.