ADDISON'S DIARY
Data Deletion & User Rights Policy
Pribco LLC · addisonsdiary.com
Effective June 21, 2026 · Version 7.2 · USA Only
Addison’s Diary · Data Deletion & User Rights Policy · Pribco LLC
ADDISON’S DIARY
Data Deletion & User Rights Policy
Pribco LLC · addisonsdiary.com
| HOW TO REQUEST DELETION OF YOUR DATA |
|---|
| Option 1 — Inside the platform: |
| Sign in → My Account → Close My Account → Confirm |
| Option 2 — By email: |
| support@addisonsdiary.com |
| Subject line: "Data Deletion Request" |
| Include: your full name and the email address on your account |
| We will acknowledge your request within 5 business days. |
| Standard deletion completes 30 days after confirmed request |
| (post-verification for email requests). |
| You will receive a confirmation email when deletion is complete. |
PREAMBLE — GOVERNING DOCUMENTS, THIRD-PARTY SERVICES, AND SECURITY
Governing Documents
This Data Deletion and User Rights Policy (“Policy”) is one of several legal instruments that govern your use of the Addison’s Diary platform. By accessing or using the Platform, you agree to be bound by each of the following documents, all incorporated herein by reference:
- Terms of Use — governs your access, rights, obligations, prohibited conduct, account termination, and limitation of liability. In the event of any conflict, the Terms of Use shall control except with respect to the specific provisions set forth herein.
- Privacy Policy — governs the collection, use, storage, and disclosure of your personal information, including operator access controls, data retention, and legal process disclosures.
- Platform Disclaimer — governs the medical, regulatory, and liability disclaimers applicable to your use of the Platform.
- HIPAA Notice and Health Data Policy — explains our HIPAA status, the health-related information we handle, our HIPAA-adjacent security practices, and your rights. Available at addisonsdiary.com/health-data.
- Cookie Policy — explains the cookies and tracking technologies used, their purposes, and how you can manage your preferences. Available at addisonsdiary.com/cookies.
- Acceptable Use Policy — governs permitted and prohibited uses of the Platform.
In the event of any conflict between these documents, the order of precedence is: Terms of Use, Acceptable Use Policy, Data Deletion and User Rights Policy, HIPAA Notice and Health Data Policy, Privacy Policy, then Cookie Policy. Capitalized terms not otherwise defined have the meanings ascribed to them in the Terms of Use or Privacy Policy.
Third-Party Service Providers — Disclaimer of Liability
The Platform operates through Amazon Web Services (cloud infrastructure), Stripe Inc. (payment processing), Postmark/Wildbit LLC (transactional email), Twilio Inc. (SMS delivery), and app store distribution partners. On the public landing page, Pribco LLC also uses Meta (Facebook Pixel and Conversions API for advertising), Google Analytics 4 (GA4), and Google Ads (conversion measurement for advertising), all of which are active on the public landing page. Google reCAPTCHA (bot protection) and Rewardful (affiliate referral tracking) are not currently active but may be used in the future. These tools operate only on the public landing page before sign-up and never inside the authenticated app or on any page where health or care data is present. Each provider is contractually bound to protect your information solely to deliver the service. These disclosures are not sales or commercial sharing.
Pribco LLC expressly disclaims all liability for any loss, harm, damage, or failure caused by the acts, omissions, errors, negligence, system failures, outages, security incidents, or service interruptions of any third-party provider. Your use of the Platform is also subject to those providers’ own terms of service. Third-party providers who store your data may independently receive legal process directed at them, in which case Pribco LLC may have limited ability to provide notice on your behalf.
Security — Policy Reference and Disclaimer
Pribco LLC employs reasonable safeguards including encryption in transit and at rest, two-factor authentication, strict per-family data isolation, operator access controls with break-glass logging, and append-only immutable audit trails. Full detail is in our Privacy Policy (Section 5) and HIPAA Notice and Health Data Policy (Sections 4 and 5).
No security measure is perfect. Pribco LLC expressly disclaims all liability for any security incident, breach, or unauthorized access arising from: (i) vulnerabilities in third-party systems; (ii) circumstances beyond our reasonable control; (iii) your failure to maintain the security of your account credentials; or (iv) the inherent limitations of internet-based communications.
Your Information Is Yours — You Control Who Sees It
Pribco LLC does not access, review, use, share, sell, or process the personal or sensitive information you enter into the Platform except to the limited extent strictly necessary to operate and deliver the service, or as required by applicable law, valid legal process, or mandatory reporting obligations. Disclosures to service providers are made under strict contractual restrictions for service delivery only and are not commercial sharing. We do not read your care journals, review your documents, or monitor your family messages. Your information is never sold, licensed, or shared with advertisers, insurers, employers, healthcare systems, or any third party for their independent use.
Compliance with Law and Legal Process
Pribco LLC may be required to disclose your information when required by valid legal process (subpoena, court order, search warrant, or other enforceable legal mandate); when disclosure is necessary to prevent or investigate a crime or protect the safety of any person; or pursuant to mandatory reporting obligations under 18 U.S.C. § 2258A (CSAM reporting to NCMEC). Where permitted by law, we will notify you upon receipt of legal process and will disclose only the minimum information required.
1. Purpose and Scope
This Data Deletion and User Rights Policy (“Policy”) explains your rights regarding the personal data and content that Pribco LLC holds in connection with your use of Addison’s Diary, and describes exactly how to exercise those rights — including how to request deletion of your account and all associated data.
This Policy applies to all users of Addison’s Diary, including:
- California residents exercising rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
- Virginia, Colorado, Connecticut, Texas, and other US state residents exercising rights under applicable state privacy laws
- All other users
This Policy is incorporated into and should be read together with the Addison’s Diary Terms of Use, Privacy Policy, Acceptable Use Policy, Platform Disclaimer, HIPAA Notice and Health Data Policy, and Cookie Policy — all available at addisonsdiary.com. Purposes, recipients, and retention periods for each data category described herein are set forth in the Privacy Policy: see Privacy Policy Section 2 (Information We Collect) for data categories, Section 3 (How We Use Your Information) for purposes and legal bases, Section 4 (Third-Party Service Providers) for sharing and recipients, and Section 7 (Data Retention and Deletion) for retention schedules. For HIPAA applicability and security safeguards for health-related data, see Privacy Policy Section 10 and the HIPAA Notice and Health Data Policy at addisonsdiary.com/health-data. For the definitive no-targeted-advertising and no-cookie-sale commitments, see Cookie Policy Section 9 and Privacy Policy Section 3.
2. What Data We Hold About You
Account and Identity Data
- Your name and display name
- Your email address
- Your mobile phone number (if provided)
- Your account password, stored in encrypted form by Amazon Cognito (we never see or store your raw password)
- Your profile photo (if uploaded)
- Your account creation date and last sign-in timestamp
- Your two-factor authentication settings
Family Care Content — Information You Enter
- Care journal entries you have written
- Medication reference information you have entered
- Medication dose log entries (who gave what, when)
- At-home care task records and completion logs
- Appointment information
- Medical team contact information
- Weekly caregiver schedule assignments
- Caregiver check-in and check-out records
- Family messages and direct messages you have sent or received
- SOS alert records
- Memory Book entries and photos
- Documents uploaded to the Document Vault
- Home care instructional videos (if uploaded)
- “I’m OK” check-in records
BE SURE TO READ THE TERMS OF USE FOR DATA YOU ARE NOT PERMITTED TO ENTER INTO THE PLATFORM.
Technical and Usage Data
- Sign-in and session records
- Notification preference settings
- WebSocket connection records (ephemeral)
- Support tickets you have submitted and the associated message thread
- Error and crash logs (anonymized where possible)
Billing Data
- Your Stripe customer ID and subscription ID (we never store card numbers — Stripe processes all payments)
- Subscription status and billing history records held by Stripe
Legal Records — Retained After Deletion
The following records survive account deletion and are retained for legal purposes:
- Your Terms of Use acceptance record: the version you accepted, your typed electronic signature, the timestamp, and your IP address — retained for at least 7 years under WORM Object Lock (S3 archive, governance-mode retention), or as long as legally required. The legal basis for this retention is a legal obligation that cannot be waived by deletion request.
- Support ticket history: retained for up to 3 years, or such longer period as may be required by an active legal hold or applicable law.
- Stripe billing records: retained for 7 years as required by applicable financial and tax law.
3. How to Delete Your Account and Data
Option 1 — Self-Service Deletion Inside the Platform
The fastest way to delete your account is directly inside Addison’s Diary. Follow these steps:
- Step 1: Sign in to your account at addisonsdiary.com
- Step 2: Go to My Account — click or tap your name or profile icon, then select “My Account”
- Step 3: Scroll to Close My Account — locate the “Close My Account” section
- Step 4: Click “Close My Account” — to begin the closure process
- Step 5: Confirm your decision — read the information about the 30-day grace period and confirm your choice
- Step 6: Account enters Pending Closure — your account immediately becomes read-only. You have 30 days to change your mind. During this period you will receive three warning emails (Days 1, 23, and 29) and a deletion confirmation email on Day 30
- Step 7: Permanent deletion — after 30 days, all family data is permanently and irreversibly deleted
| If you are a Care Team member or Concerned Friend (not the account Admin), |
|---|
| your personal account closure path is: |
| Sign in → My Account → "Delete My Account" |
| This removes your personal account and login credentials. |
| It does not close the family account — only the Admin can do that. |
| Your contributions to the family’s care records remain visible to the family |
| until the family account itself is closed. |
Option 2 — Email Deletion Request
| Email: support@addisonsdiary.com |
|---|
| Subject: Data Deletion Request |
| Please include in your email: |
| Your full name |
| The email address associated with your Addison’s Diary account |
| A clear statement that you are requesting deletion of your account and data |
| If you are a California resident or exercising a specific statutory right, |
| please state that in your email |
| We will acknowledge your request within 5 business days. |
| We may ask you to verify your identity before processing the request. |
| Standard deletion completes 30 days after confirmed request |
| (post-verification for email requests). |
Option 3 — Expedited Deletion Request
If you need your data deleted immediately — for example, if you are making a CCPA expedited deletion request or an urgent deletion request for any reason — state this clearly in your email to support@addisonsdiary.com. Mark the subject line “URGENT Data Deletion Request.”
Pribco LLC can initiate immediate deletion bypassing the standard 30-day grace period. An operator will process the expedited request and confirm completion by email.
| WARNING — EXPEDITED DELETION IS PERMANENT AND IRREVERSIBLE. |
|---|
| Before we process an expedited deletion request, you must explicitly confirm |
| that you understand the following: |
| All data is permanently purged immediately. There is no recovery window. |
| Memory Book photos, Document Vault files, care journals, and all other |
| family content will be gone permanently and cannot be retrieved. |
| We will ask you to confirm this understanding before processing. |
| Expedited deletion will not proceed without that confirmation. |
4. What Gets Deleted — The Complete List
| PERMANENTLY DELETED ON ACCOUNT CLOSURE: |
|---|
| Family Account Record |
| All patient profile information |
| All family settings and notification preferences |
| Subscription state and lifecycle records |
| All Family Care Content (FamilyData table — completely purged) |
| All care journal entries |
| All medication records and dose logs |
| All at-home care task records and completion logs |
| All appointment records |
| All medical team contact records |
| All weekly caregiver schedule entries |
| All caregiver check-in and check-out logs |
| All family messages and direct message threads |
| All SOS alert records |
| All Memory Book entries and photos |
| All Document Vault files and metadata |
| All home care video records |
| All "I'm OK" check-in records |
| All notification deduplication records |
| All Family Member Records |
| All invited member profiles, roles, and permissions |
| All member notification preference settings |
| All Files in Cloud Storage |
| Every photo, document, and video file uploaded to your family's storage |
| All profile photos associated with family members |
| Your Login Credentials |
| Your Cognito account (email, password hash, MFA settings) |
| Your active session tokens |
| RETAINED AFTER DELETION (legal records only): |
| Terms of Use acceptance: version, typed electronic signature, timestamp, IP address (at least 7 years / as long as legally required) |
| Support ticket history: up to 3 years (or longer if legal hold applies) |
| Stripe billing records: 7 years (as required by applicable financial law) |
5. The Account Closure Lifecycle — How Deletion Works
Standard Closure Path (Self-Service or Email Request)
| ACTIVE → PENDING CLOSURE → PERMANENTLY DELETED |
|---|
| Day 0: You close your account (in-app) or we confirm your verified email request. |
| Account becomes immediately read-only. |
| Warning email sent: "Your account will be deleted in 30 days" |
| Day 23: Second warning email sent |
| Day 29: Final warning email sent: "Deletion in 24 hours" |
| Day 30: All data permanently and irreversibly deleted |
| Confirmation email sent: "Your data has been deleted" |
| Recovery: At any time before Day 30, sign in and reactivate your subscription from |
| your dashboard. |
Subscription Cancellation Path
| ACTIVE → DORMANT (90 days) → PENDING CLOSURE (30 days) → DELETED |
|---|
| Cancellation: Account becomes read-only (dormant) |
| Day 67: Warning email: "Reactivate or your account will close" |
| Day 90: Account moves to Pending Closure |
| Three warning emails over 30 days (Days 1, 23, and 29) |
| Deletion confirmation email sent on Day 30 |
| Day 120: All data permanently deleted |
| Recovery: Reactivate your subscription at any time before Day 120 |
| to restore full access to all your data. |
Expedited / Immediate Deletion
If you request immediate deletion — bypassing all grace periods — a Pribco LLC operator will manually initiate a force-delete after receiving your explicit confirmation of irreversibility. We will initiate the purge within 1 business day of your verified and confirmed request and complete it within 5 business days. This permanently purges all data with no recovery window, is recorded in our internal audit log with the operator’s identity and your request, and satisfies CCPA expedited deletion and similar statutory requests.
6. Your Rights by Jurisdiction
All Users — Universal Rights
Regardless of where you live, you have the following rights with respect to your personal data held by Pribco LLC:
- The right to close your account and have your data deleted
- The right to receive a copy of your personal data — to request a copy of your data, send your request via email to privacyandlegal@pribco.com
- The right to correct inaccurate personal data
- The right to update your notification preferences and SMS opt-in at any time
- The right to be informed about what data we hold and how we use it
To exercise any of these rights, including to request a copy of your data, send your request via email to privacyandlegal@pribco.com. Contact privacyandlegal@pribco.com as the primary channel for all privacy and legal requests, or support@addisonsdiary.com for general deletion requests.
California Residents — CCPA / CPRA Rights
If you are a California resident, you have the following additional rights under the CCPA as amended by the CPRA:
- Right to Know: You have the right to request disclosure of what personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom it is shared
- Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions
- Right to Correct: You have the right to request correction of inaccurate personal information
- Right to Opt Out of Sale: We do not sell personal information. This right is acknowledged but not applicable
- Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (health-related data) only to provide the service — we do not use it for advertising or profiling
- Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA right
- Right to Appeal: If Pribco LLC denies your CCPA/CPRA request, you have the right to appeal that decision. To appeal, submit a written request to privacyandlegal@pribco.com with the subject line “California Privacy Rights Appeal” and include a description of your original request and the reason you believe the denial was incorrect. Pribco LLC will respond to your appeal within 45 days. If your appeal is denied, you may contact the California Privacy Protection Agency at cppa.ca.gov to submit a complaint.
| California residents: To exercise any CCPA/CPRA right, contact: |
|---|
| Email: privacyandlegal@pribco.com |
| Subject: California Privacy Rights Request |
| We will respond to verifiable consumer requests within 45 days. |
| We may extend this by an additional 45 days (90 days total) for complex requests |
| and will notify you if an extension is required. |
| You may also submit a complaint to the California Privacy Protection Agency |
| at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy. |
Virginia, Colorado, Connecticut, Texas, and Other US States
Residents of states with comprehensive consumer privacy laws — including Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Montana, Oregon, Delaware, Iowa, Indiana, Nevada, Utah, Tennessee, and others — have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of certain processing. To exercise your rights, contact privacyandlegal@pribco.com with the subject line “State Privacy Rights Request.” We will respond within the timeframe required by your state’s law.
Washington residents are additionally protected by the Washington My Health My Data Act (MHMDA), which provides expanded rights with respect to consumer health data. Under the MHMDA, Washington residents have the right to access, delete, and withdraw consent to the collection, sharing, or sale of consumer health data. The MHMDA applies to health data that identifies or is reasonably linkable to a Washington resident, regardless of whether the entity is a HIPAA covered entity. To exercise your MHMDA rights, contact privacyandlegal@pribco.com with the subject line “Washington Health Data Rights Request.”
7. Identity Verification
To protect your privacy and security, Pribco LLC will verify your identity before processing any data rights request. We will not delete, provide, or modify data based on a request we cannot verify.
Verification steps by request type:
- In-app deletion (Close My Account): identity verified by your existing login credentials and two-factor authentication — no additional verification required
- Email deletion request: we confirm the request comes from the email address associated with your account and send a one-time verification code to that address — you must provide the code before processing begins
- Access or portability request: same email verification as above; for complex requests we may ask for additional confirmation of account ownership
- California CCPA requests: we take reasonable steps to verify identity consistent with CCPA requirements and without requiring account creation; verification method scales with sensitivity of the request
Authorized agent requests (California CCPA):
- Provide written proof of your authorization to act on the consumer’s behalf (e.g., signed power of attorney or written authorization signed by the consumer)
- Include the consumer’s full name and the email address associated with their Addison’s Diary account
- We may contact the consumer directly to verify the request, even when an authorized agent submits it
- Send authorized agent requests to support@addisonsdiary.com with the subject line “Authorized Agent — CCPA Request”
8. Response Timeframes
| Request Type | Response Deadline |
|---|---|
| Acknowledgment of any request | 5 business days |
| Account deletion — in-app (standard) | 30 days from confirmed request |
| Account deletion — email (standard) | 30 days after confirmed request (post-verification) |
| Account deletion — expedited | Initiate within 1 business day; complete within 5 business days |
| California CCPA request | 45 days (extendable to 90 with prior notice) |
| Virginia / Colorado / CT / TX and other states | Varies by state law (typically 45–60 days) |
| All other requests | 30 days |
9. Data You Cannot Recover After Deletion
| WARNING — DELETION IS PERMANENT AND IRREVERSIBLE. |
|---|
| Once your account is deleted — whether at the end of the 30-day grace period |
| or immediately via expedited request — the following cannot be recovered: |
| All care journal entries |
| All medication records and dose logs |
| All care task records and completion logs |
| All family messages and direct messages |
| All Memory Book entries and photos |
| All Document Vault files |
| All appointment and medical team records |
| All caregiver schedule and check-in records |
| All files stored in your family account |
| Before requesting deletion, we strongly recommend downloading or saving |
| any content you wish to keep — particularly Memory Book photos and |
| Document Vault files. Pribco LLC cannot recover deleted data under any |
| circumstances after deletion is complete. |
10. Authorized Agent Requests
California residents may use an authorized agent to submit a CCPA rights request on their behalf. If you are submitting a request as an authorized agent, provide written proof of your authorization to act on the consumer’s behalf, include the consumer’s full name and account email address, and note that we may contact the consumer directly to verify the request. Send authorized agent requests to support@addisonsdiary.com with the subject line “Authorized Agent — CCPA Request.”
11. Exceptions and Limitations on Deletion
In limited circumstances, we may decline to delete certain data or may be required to retain it. Reasons for retention include:
- Legal obligation: we are required by law to retain certain records, including Stripe billing records (7 years) and the Terms of Use acceptance audit trail (at least 7 years / as long as legally required)
- Legal claim: we may retain data necessary to establish, exercise, or defend a legal claim during the period in which such a claim is active or reasonably anticipated
- Safety: we may retain data if its deletion would create a material risk of harm to any person
- Fraud prevention: we may retain data in connection with an ongoing fraud investigation
- Mandatory reporting: we may retain data where required in connection with mandatory reporting obligations under 18 U.S.C. § 2258A or other applicable law
If we decline to delete data based on an exception, we will provide a written explanation identifying the specific items retained, the applicable exception or legal basis, and the anticipated retention period or review date. This written explanation will be provided within the same timeframe as our standard response to the deletion request.
12. No Sale of Personal Information — Commitment to Users
Pribco LLC does not sell your personal information. We do not use your care or health data for behavioral advertising. We do not build advertising profiles from your care data. We do not share care or health data with healthcare providers, insurers, employers, or any commercial third party for their own use. The sensitive details of your family’s caregiving experience exist on this Platform for your family, and for no one else.
Addison’s Diary uses a Meta Pixel on the public landing page for marketing and advertising purposes. This tool operates only before sign-up, on public pages, and never inside the authenticated app. No care or health data is ever transmitted to Meta. Landing page visitors can opt out of this tracking by declining the cookie consent banner or enabling a Global Privacy Control (GPC) signal in their browser.
Addison’s Diary also uses Google Ads conversion measurement on the public landing page to measure the effectiveness of advertising. This tool operates only before sign-up, on public pages, and never inside the authenticated app, and is configured for conversion measurement only — not remarketing or audience building. No care or health data is ever transmitted to Google. Landing page visitors can opt out by declining the cookie consent banner or enabling a Global Privacy Control (GPC) signal in their browser.
Disclosures to service providers (including AWS, Stripe, Postmark, and Twilio) are made under strict contractual restrictions solely to deliver the service and do not constitute selling or sharing for commercial purposes. This commitment is irrevocable and applies regardless of any changes to the ownership or control of Pribco LLC, subject only to legal obligations that cannot be contractually waived and to necessary service-provider disclosures as described above.
13. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, the platform, or applicable law. When we make material changes, we will notify registered users by email and in-app notice before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
14. Contact Us
Pribco LLC — Addison’s Diary
Primary Privacy, Legal Requests: privacyandlegal@pribco.com
Data Deletion Requests: support@addisonsdiary.com
Website: addisonsdiary.com
Use privacyandlegal@pribco.com as the primary channel for all privacy and legal matters including CCPA requests and state privacy requests. General support inquiries that are not privacy-related may be sent to support@addisonsdiary.com.
QUICK REFERENCE — HOW TO DELETE YOUR DATA
| FASTEST WAY: DELETE INSIDE THE PLATFORM |
|---|
| Sign in → My Account → Close My Account → Confirm |
| Your account enters a 30-day grace period (read-only, recoverable). |
| After 30 days: all data permanently deleted. Confirmation email sent. |
| Need it gone now? Email support@addisonsdiary.com — "URGENT Data Deletion Request" |
| You must confirm irreversibility before expedited deletion proceeds. |
| BY EMAIL |
| To: support@addisonsdiary.com |
| Subject: Data Deletion Request |
| Include: your name + account email address |
| STATE / JURISDICTION SPECIFIC |
| California (CCPA): privacyandlegal@pribco.com — "California Privacy Rights Request" |
| All other states: privacyandlegal@pribco.com — "State Privacy Rights Request" |
| WHAT GETS DELETED |
| Everything in your account: journals, medications, schedules, messages, |
| memory book, documents, photos, care logs, and your login credentials. |
| WHAT STAYS (legal records only): |
| Your signed Terms acceptance — retained at least 7 years / as long as legally required |
| Support ticket history — up to 3 years |
| Stripe billing records — 7 years (required by law) |
| WARNING |
| Deletion is permanent and irreversible. |
| Download anything you want to keep BEFORE you request deletion. |
| Pribco LLC cannot recover deleted data under any circumstances. |