Health data privacy

Effective 2026-10-14

Extra context when a document contains information about your health.

This notice describes how Webspin, LLC, the operator of Lookover, handles consumer health data. It supplements our privacy policy. Lookover explains documents; it is not a healthcare provider, an emergency service or a substitute for professional advice.

Lookover is not a HIPAA covered entity or business associate, and it is not offered to healthcare providers, insurers or care organizations. HIPAA generally does not protect information you choose to send us. This notice and our privacy policy describe how we handle it.

Health information we may receive

If you choose to submit a medical bill, benefits statement, appointment letter or similar material, it may contain names and contact details linked to health conditions, symptoms, diagnoses, medications, treatments, providers, appointments, insurance coverage, claim information or healthcare payments. It may be about you or about someone else, such as a parent you help. Explanations and extracted facts may infer health information from those documents, and those inferences may be wrong.

Sources include you, the people in your household, the documents they submit, and the explanations Lookover produces. We do not access your medical provider’s records directly or collect precise location to infer visits to healthcare facilities. A photo you send may carry the time and place it was taken; Lookover does not use that information.

Why we process it

We process submitted health information only to provide the explanation you request, answer your follow-up questions, keep your record, identify dates and reminders, deliver the summaries you chose and provide support. Submit only information needed for that purpose. We do not use health information for targeted advertising, sell it, use it to train general-purpose systems, or use geofencing around healthcare facilities.

Your consent

Nothing you send is read until you have agreed. Each person gives their own permission, separately for each household:

On the website, in the app, at checkout or on the page an emailed request links to: two separate boxes. One accepts the terms of service and allows Lookover to collect and explain what you send. The other is your consent to Lookover collecting and using health information in what you send, only to explain it and keep track of it for you and the people you choose to share it with, and says that our service providers, including Anthropic, process it for that purpose and that you can withdraw this consent at any time.
By text or email: replying YES to Lookover’s request. The request says that what you send may include health or financial information, names our service providers, including Anthropic, links this notice and says how to withdraw (by text, replying STOP stops texts and processing).

We keep a record of each consent and each withdrawal: what it covered, the version and checksum of the wording you were shown, its language, how you gave it and when. Joining a household or agreeing to receive someone’s weekly summaries does not give Lookover permission to read anything you send; Lookover asks for it before your first document.

Health information about other people

Only send someone else’s health information if they have given you permission, or you have other legal authority to act for them, such as a power of attorney, guardianship or the role of executor. Lookover does not check that permission. A person whose information appears in a document, and who is not a member of the household, can ask us to delete it by emailing privacy@lookoverit.com.

Who may receive it

Collection and explanation are separate from optional sharing. A document texted from a number that has not agreed, or that is not on an account, is not read: we delete our copy straight away, and our text-message provider’s copy is deleted within about 30 days. An account cannot be started by text. To share health-related documents and explanations, choose each named person in People & sharing in your Lookover account. The choice covers earlier and new records, including diagnoses, medicines, appointments, providers, medical bills and insurance details. It allows the chosen person to help keep track through account views, summaries, reminders and alerts. A summary recipient must also accept their invitation.

Service providers process health information for us:

Amazon Web Services hosts and stores the service and delivers our email, in its US East (N. Virginia) region.
Anthropic processes what you send to sort and screen it, read and explain it, answer your follow-up questions, check it against our content rules and translate it.
Twilio and participating message carriers deliver text messages, and Twilio carries calls to our phone help line.
Retell runs the automated phone help line. It does not read documents, but a call may be recorded and transcribed, and callers may mention health matters.
Google hosts the Webspin, LLC mailbox that receives email sent to our published addresses, including privacy and health-privacy requests.

Apple and Google deliver app notices, which never contain document content. Sentry receives error reports that are filtered to exclude document text. Expo, which delivers app updates, receives no document content. The staff console does not provide original files or the text of documents and messages you send for explanation. Authorized staff may access explanations, processing records and support requests for necessary operations as described in the privacy policy. Restricted staff content views are logged. Household comments may also include health information and follow the source document’s sharing permissions. We do not share health information with affiliates for their independent marketing.

Disclosures legally required or necessary to protect rights and security are subject to applicable law. If a proposed collection or sharing requires separate consent, we must obtain it before that use. Agreeing to general terms does not replace a separate consent required by law.

Your health privacy choices

Use People & sharing in your Lookover account to stop sharing with one person or everyone. To withdraw your consent, open the household’s Data & privacy settings on the website or in the app; Lookover then stops reading new documents and messages from the addresses you have verified yourself, and records the withdrawal. A number someone else added for you stops being read when it replies STOP or is removed in People & sharing. Stopping processing does not change who you share with, and none of these choices cancels billing.

You can also ask whether we collect, share or sell your health data (we do not sell it), ask for access to it, including a list of the third parties and affiliates we have shared it with and how to contact them, ask us to delete it, and withdraw consent to its collection or sharing. Email privacy@lookoverit.com with “Health privacy request”, or choose Privacy request in Support & feedback in your account. We will verify your identity and any representative’s authority without asking you to send additional medical documents.

You can also get that list yourself, without asking: the download in a household’s Data & privacy settings, on the website or in the app, includes the records you can see, the service providers that receive what you send, what each receives and how to contact them, a statement that we have no affiliates that receive it and do not sell it, and the people you shared your documents with. The download in Account data & deletion carries the same list of service providers.

For requests covered by Washington’s My Health My Data Act, we respond within 45 days, with a further 45 days when reasonably necessary and with notice. If we deny a request, you can appeal by replying to our decision; we respond to the appeal within 45 days. Our appeal response will explain how to contact the Washington Attorney General if the appeal is denied.

Where applicable, deletion includes asking relevant processors and third parties to delete their copies. Deletion from archived or backup systems may be delayed as permitted by law; for a covered Washington request, that delay cannot exceed six months after authentication. Other applicable privacy rights and deadlines remain available. We do not penalize you for exercising protected rights.

Retention and contact

Health information follows the retention periods in our privacy policy, including the original-document window and account-record retention. A verified legal deletion request is handled separately from routine account cancellation. Disconnecting a sending address stops new documents from it and ends the sharing of what it sent; those documents stay for you. When a person leaves a household, is removed from it, or deletes their account, the documents they sent there are deleted after 30 days. Documents they shared stay for the people they shared them with, unless the person chooses to delete them when leaving or deleting their account. Removing a summary recipient stops new summaries and alerts to them but cannot recall copies already delivered.

Questions and requests go to privacy@lookoverit.com or Webspin, LLC, 5900 Balcones Drive, Suite 31281, Austin, TX 78731. We will provide notice of material changes and obtain any new consent required by law.