Privacy & Data Use

Effective date: August 11, 2026

1. What HealthHarbor is designed to access

With your explicit authorization, HealthHarbor may access health information made available by supported healthcare organizations through approved interfaces such as SMART on FHIR. Initial functionality is focused on appointment information and supporting provider and location data. Future versions may support additional patient-authorized records.

2. Portal credentials

HealthHarbor is designed not to collect or store your MyChart, NextGen, or other healthcare portal password. Authentication occurs on the healthcare organization's own authorization page. HealthHarbor receives authorization tokens only after you approve access.

3. OAuth tokens and security

Authorization tokens used by the iPhone app are intended to be stored using Apple's secure Keychain services. Tokens are not intended to be placed in website URLs, application logs, analytics payloads, or public source repositories.

4. Health information

HealthHarbor's architecture is designed to process and store patient-authorized healthcare data locally on the user's device. DadCanMakeIT does not sell health information, use health information for advertising, provide patient health information to data brokers, or maintain a server-side database of HealthHarbor patient records for the core app experience.

5. Apple Calendar and user-directed sharing

If you grant Calendar permission, HealthHarbor may read upcoming calendar events to identify likely matches or duplicates and may create calendar events only after user review and approval. When you choose to add appointment information to a calendar, that information may be synchronized by your selected calendar provider, including services such as iCloud, Google, or Exchange. If the selected calendar is shared, people or apps you have authorized to access that calendar may also be able to see the event. HealthHarbor cannot control the privacy settings of a calendar service after you choose to export an event.

6. Website and documentation

The DadCanMakeIT website hosts public documentation, terms, privacy information, and authentication-link support. The public website is not intended to receive or store medical records, portal passwords, FHIR payloads, or HealthHarbor access tokens as part of the normal native-app authorization flow.

7. Analytics and advertising

HealthHarbor does not use patient health information for advertising, research, sale, or purposes unrelated to providing direct app services. Patient health records and FHIR payloads are not intended to be included in third-party analytics. If privacy-preserving diagnostics are introduced later, this policy will be updated before production release.

8. Data sharing

HealthHarbor does not sell patient data. Health information is not shared with DadCanMakeIT staff, researchers, advertisers, data brokers, or affiliates as part of the core app. Information may leave the device only through actions the user authorizes, such as adding selected appointment details to a calendar or using another iOS sharing feature.

9. Access, export, deletion, and retention

HealthHarbor is being designed to let users view and export the complete set of information the app stores about them, disconnect connected health sources, and delete all locally stored HealthHarbor data and credentials. Local data may be retained until the user deletes it, disconnects the applicable source, closes their HealthHarbor account, or removes the app. HealthHarbor does not retain a separate server-side copy after those actions. Healthcare organizations and calendar providers retain their own records according to their own policies.

10. Access history

HealthHarbor does not currently provide a complete audit record identifying every person, organization, or system that has accessed a user's information. Connected healthcare organizations and third-party services may maintain their own access logs.

11. Children's data

HealthHarbor is not currently designed as a standalone service for children. Any future caregiver or proxy access will rely on authorization provided by the connected healthcare organization and will be documented separately.

12. Changes to this policy

This policy may change as HealthHarbor's features and integrations evolve. Material changes will be published here with a new effective date before applicable production functionality is released.

13. Contact

Privacy questions can be sent to everett@dadcanmakeit.com.