Health data privacy
Effective 2026-09-20
Extra context when a document contains information about your health.
This notice describes how Webspin, LLC, the operator of Lookover, handles consumer health data. It supplements our privacy policy. Lookover explains documents; it is not a healthcare provider, an emergency service or a substitute for professional advice. We do not represent the service as HIPAA-compliant.
Health information we may receive
If you choose to submit a medical bill, benefits statement, appointment letter or similar material, it may contain names and contact details linked to health conditions, symptoms, diagnoses, medications, treatments, providers, appointments, insurance coverage, claim information or healthcare payments. Explanations and extracted facts may infer health information from those documents, and those inferences may be wrong.
Sources include you, authorized participants in your account, the documents they submit, and the explanations we generate. We do not access your medical provider’s records directly or collect precise location to infer visits to healthcare facilities.
Why we process it
We process submitted health information to provide the explanation you request, answer follow-up questions, keep your account record, identify dates, deliver authorized summaries and provide support. Submit only information needed for that purpose. We do not use health information for targeted advertising, sell it, or use geofencing around healthcare facilities.
Who may receive it
Collection and explanation are separate from optional sharing. Before processing, the account holder makes a separate document-processing choice at signup; invited senders agree from their own phone or email. To share health-related documents and explanations, reply SHARE and choose each named person using the provided code. The choice covers earlier and new records, including diagnoses, medicines, appointments, providers, medical bills and insurance details. It allows the chosen person to help keep track through account views, summaries and alerts. A summary recipient must also accept their invitation. Do not submit another person’s health information without their permission or other lawful authority.
Service providers may process health information for hosting, storage, email and text delivery, and automated document explanations. These include Amazon Web Services, Anthropic, and, when configured, OpenRouter and its selected model providers, Twilio or Telnyx, and participating message carriers. Authorized staff may access stored content for necessary service operations as described in the privacy policy. We do not share health information with affiliates for their independent marketing.
Disclosures legally required or necessary to protect rights and security are subject to applicable law. If a proposed collection or sharing requires separate consent, we must obtain it before that use. Agreeing to general terms does not replace a separate consent required by law.
Your health privacy choices
Use People & sharing in your Lookover account to stop sharing with one person or everyone. Reply STOP to stop new processing from your registered contact. These choices do not cancel billing. You can also ask whether we collect or share your health data, request access or deletion, and withdraw consent to collection or sharing where applicable. Email legal@lookoverit.com with “Health privacy request.” We will verify your identity and any representative’s authority without asking you to email additional medical documents unnecessarily.
For requests covered by Washington’s My Health My Data Act, we respond within 45 days, with a further 45 days when reasonably necessary and with notice. If we deny a request, you can appeal by replying to our decision; we respond to the appeal within 45 days. Our appeal response will explain how to contact the Washington Attorney General if the appeal is denied.
Where applicable, deletion includes notifying relevant processors and third parties. Deletion from archived or backup systems may be delayed as permitted by law; for a covered Washington request, that delay cannot exceed six months after authentication. Other applicable privacy rights and deadlines remain available. We do not penalize you for exercising protected rights.
Retention and contact
Health information follows the retention periods in our privacy policy, including the original-document window and account-record retention. A verified legal deletion request is handled separately from routine account cancellation. Removing a sender stops new submissions and withdraws their sharing permissions, excluding earlier records from new views and summaries for other people. It does not delete those records. Contact us about deletion or help with withdrawal. Removing a summary recipient stops new summaries and alerts to them but cannot recall copies already delivered.
Questions and requests go to legal@lookoverit.com or Webspin, LLC, 5900 Balcones Drive #31281, Austin, TX 78731. We will provide notice of material changes and obtain any new consent required by law.