Consumer Health Data Privacy Policy

Effective date: October 1, 2026

Last updated: October 1, 2026

Invivus Technologies LLC ("Moldlist," "we," "us," or "our") operates moldlist.com. This notice explains our practices concerning consumer health data collected through Moldlist, including data protected by Washington's My Health My Data Act, Nevada's consumer health data provisions, and other applicable health-privacy laws. It covers the health-data practices described here for our users, while particular statutory rights depend on the law that applies.

Moldlist helps people find professionals, services, and products. We do not provide healthcare through the directory, but using a directory to seek care can itself involve health information. A diagnosis is not required for information to qualify as consumer health data. Identifiers, such as an account email or IP address, can make a search or interaction reasonably linkable to a person.

This notice concerns Moldlist. Moldmap is a separate Invivus service with its own policies. General personal-information practices are explained in our Privacy Policy. If this notice provides a more protective rule for covered consumer health data, this notice controls for that data.

1 Categories of consumer health data

Depending on the features you use and the information you submit, Moldlist processes the following categories when linked or reasonably linkable to you and when they reveal health status or the seeking of health-related services:

• Information about seeking care or support. Search text and filters are used to return results and are not written into Moldlist's database. A signed-in saved list stores listing identifiers with the account. Opening Saved merges the list on that device with the account list. Comparison selections stay in the browser and are sent as listing identifiers on the compare page; the application does not store that selection on the account. An outbound contact click is not stored.
• Health information in contributions or communications. An experience can include your relationship to the service (patient, caregiver, or building-service customer), how far it went, the service focus, the month and year, an optional rating, a recommendation, short answers about that service, and optional text. The form asks you not to include medical records, diagnoses, or an address, and says you do not have to include health details. Corrections, claim notes, review reports, and appeals are free-text fields. Corrections and claim notes ask you not to include symptoms, diagnoses, patient information, or medical records. An email you send can include whatever you write.
• Identifiers associated with that information. Account email, the public display name you choose, a session cookie, a hash that ties a sign-in code to the browser that requested it, and timestamps on accounts, saved lists, experiences, corrections, claims, reports, and appeals. For sign-in codes, corrections, suggestions, claims, new listings, and review reports, the application stores the requesting IP address as a rate-limit key with request times. Password-attempt limits keep an IP in server memory only. Ordinary page views are not stored as an IP history in the application database.
• Location connected with seeking care. A country, region, or city you enter as a search filter is part of that request and is not saved as a profile. Moldlist does not collect precise device location. A saved or compared listing can identify the professional's published location.
• Records needed to handle those interactions. Moderation status, reviewer notes, review reports, appeals, claim replies, and withdrawal of an experience. A privacy request sent by email is not stored as its own record type in the application.

We do not ask for medical records, laboratory results, genetic data, biometric identifiers, or detailed treatment histories. Please do not submit them. If you send sensitive information we did not request, we still handle it under applicable law and may ask you to remove unnecessary details or provide a less sensitive version.

An ordinary professional listing is information about the professional's services. It is not automatically health information about that professional or every visitor. We do not assign a diagnosis to you merely because you search for or save a listing. Provider claim fields ask for role, authority, and business listing facts, and they tell you not to include patient information or medical records.

[CONFIRM CATEGORY INVENTORY BEFORE PUBLICATION: Check actual review fields, account saves and automatic merge, requests and server logs, analytics, optional provider self-disclosure fields, and all support channels. Remove unused categories and add any actual covered category or inference not accurately described. Do not publish this as a completed audit.]

2 Sources of consumer health data

We receive covered information directly from you when you use a feature or send a communication, from your browser or device through the requests needed for the Service, and from records created by our systems to operate and review those interactions. Our service providers may process those requests and records on our behalf.

We may also receive information from someone acting with your authority or from another person's submission or report. Our rules prohibit publishing another person's private health information without appropriate authority. Receiving an improper submission does not make it authorized; we assess it for removal, minimization, and any further steps required by law.

We do not obtain private patient records from listed providers, buy consumer health profiles from data brokers, or import private Moldmap health preferences into Moldlist.

3 Purposes and permission

We process covered consumer health data for the feature you use: returning a search, keeping a saved list you associate with an account, showing a comparison you open, reviewing an experience you submit, and responding to a correction, claim, report, appeal, or email.

The application does not write search text into its database. Processing a search to return results does not authorize a person-linked search history, advertising use, or an unrelated disclosure. This notice does not confirm whether the host keeps the address of a search request in its own logs.

You can use the public directory without an account, a health narrative, or a published experience. If you submit an experience, you must confirm that it is firsthand and that Moldlist may publish your display name and the experience after a person reviews it. The application does not show a separate health-data consent control for searching, saving a listing, or sharing. Acceptance of the Terms of Use or the general Privacy Policy is not health-data consent.

Where law permits processing without consent to provide the product or service you requested, or for a specific legal exception, we rely on that basis only within its limits. We do not use a broad security, business-interest, or legal-claims statement to override a stricter health-data rule.

4 Categories shared and recipients

We disclose only the covered data needed for a permitted purpose and only with the required consent, direction, or legal basis. The categories and recipients are:

[CONFIRM RECIPIENTS BEFORE PUBLICATION: Verify the complete health-data recipient inventory and contracts. Project records identify Vercel, Supabase, and Postmark, but this draft does not verify their exact role, configuration, subprocessors, or access to health data. Identify any support/email provider, outside reviewer, AI service, analytics recipient, or other third party that actually receives covered data. Do not treat a vendor as a restricted processor unless its terms and behavior support that classification.]

The application is hosted on Vercel. Stored directory data, including accounts, saved listing identifiers, experiences, and rate-limit records, uses Supabase when that database is connected. Postmark sends the sign-in code when it is configured. That message does not include a saved list, an experience, or a search. This repository does not establish those vendors' contracts, subprocessors, or independent use of data.

Affiliates and related products. We do not share covered Moldlist consumer health data with a separate affiliated legal entity or transfer it into Moldmap for that product's own purposes. No affiliate is designated to receive consumer health data under this notice. Invivus's own authorized personnel may access it as necessary to operate Moldlist. A future affiliate disclosure would require us to identify the specific affiliate and satisfy applicable notice and consent requirements first.

5 Restrictions on use and disclosure

[CONFIRM THESE COMMITMENTS BEFORE PUBLICATION against current and historical data flows, including first-party event handling, logging, server-side forwarding, advertising, analytics, embeds, vendor independent uses, and any AI tools. The cross-site collection disclosure must cover all third parties, not only advertising vendors.]

The current application does not sell consumer health data, include an advertising or analytics script, supply data to a data broker, or create an advertising audience. It does not call device location or operate a healthcare geofence. It does not send covered private user information to an AI training service. A first-party event request accepts an event name and, for a contact click, the listing's country. It rejects search text and does not store the event. Aggregate counts for a submitted claim, approved claim, correction, or suggestion do not include search text or a saved list.

We do not disclose your private email, saved-list history, or account health-related activity to a provider simply because you viewed, saved, or reviewed its listing. Information you send directly to a provider by calling, emailing, or visiting its site is handled under that provider's practices.

A public experience can still reveal sensitive information. Search services and other people may copy it. Removing it from Moldlist cannot guarantee the removal of every independent copy, but we will meet any applicable obligations to notify recipients of a covered deletion request.

6 Your health-data rights

Depending on applicable law, you may have the right to confirm whether we collect, share, or sell your consumer health data; access it; receive the required list of recipients and their contact information; withdraw consent to collection or sharing; request deletion; correct information where a correction right applies; and appeal a refusal.

Email justin@invivus.io with "Moldlist health data request" in the subject line. State the right you want to exercise and identify the relevant account, contribution, or interaction as clearly as you can. An authorized representative may contact us where permitted. You do not need to create an account, and you should not send a medical record, password, or sign-in code.

You may also request to review or correct information by emailing that address and identifying the information you believe is inaccurate. We will assess the request, seek any necessary clarification, and make corrections as required by applicable law.

We use reasonable, proportionate measures to authenticate requests and authority. If we cannot match a request to information, we may ask for limited additional details. We do not require unrelated health evidence. We will explain if we cannot fulfill a request and why, as required by law.

We respond within applicable deadlines. For Washington requests, the ordinary response period is 45 days after receipt; a permitted extension requires notice and an explanation. Nevada requests generally have a 45-day response period after authentication, while a valid Nevada deletion request has a 30-day deletion requirement after authentication, subject to the law's specific provisions. Where a different or shorter applicable deadline governs, we follow that deadline. We do not charge a fee unless the law expressly permits it.

You can withdraw an experience you submitted. Withdrawal removes it from public display. Withdrawal does not, by itself, delete every related account, moderation, or rate-limit record. We will explain if a requested feature can no longer operate without the information and will not require optional processing as a condition of unrelated browsing.

7 Deletion and retention

We retain covered consumer health data only for as long as necessary for the permitted purpose, and honor applicable deletion and withdrawal rights. A general recordkeeping preference does not justify keeping health information indefinitely.

For a valid deletion request, we remove covered information from the systems within our responsibility and notify processors, affiliates, and other recipients to the extent the applicable law requires. The application does not include an automated backup-deletion job. Where Washington law limits backup deletion to no more than six months after authentication, this repository does not show that deadline being carried out.

If a specific law permits or requires us to retain limited information, we restrict it to that purpose and explain the exception when required. The rules applicable to ordinary business records do not automatically create a health-data retention exception.

8 Appeals and complaints

To appeal a denied request, reply to our decision or email justin@invivus.io with "Moldlist health data appeal." Explain what you want reconsidered. We will review the appeal and provide the required written explanation within the applicable deadline, ordinarily 45 days under the Washington and Nevada health-data appeal provisions.

If an appeal is denied, we provide the complaint contact required by the applicable law. You may also contact the Washington Attorney General, the Nevada Attorney General, or your own state or national privacy regulator directly. You do not have to complete an internal appeal before contacting a regulator. We do not retaliate against you for exercising a protected right.

9 Changes to this notice

We update the dates above when this notice changes and provide additional notice of material changes as required. Before collecting a new health-data category, using it for a new purpose, or sharing it with a new recipient outside the scope already lawfully authorized, we provide the required notice and obtain any required new consent or authorization. Continued browsing is not a substitute for that choice.

10 Contact

Invivus Technologies LLC
Moldlist health-data privacy: justin@invivus.io
Business mailing address: 407 S Lakeshore Blvd #309, Marquette, MI 49855