Terms of Service — PBC Itch Tracker

DRAFT — pending final legal review by Community Liver Alliance counsel. This page reflects the app’s current practices for admin access and third-party data sharing and is published for transparency. The exact legal wording may be adjusted before it is finalized.

Admin access & third-party data sharing

We follow a two-tier identity model so we can operate the app and share what CLA learns without exposing you:

Admin support view (identified, audited). A small number of authorized CLA administrators can view a single user’s real name, email, and check-ins only when needed to answer a support request or investigate a safety issue. Every time an admin reveals your identity in the app, the system writes a permanent audit entry with the admin’s ID, timestamp, and stated reason.
Everything else is de-identified. All admin dashboards, cohort analytics, CSV/PDF reports, and datasets shared outside CLA are automatically stripped of direct identifiers (name, email, phone, exact dates of birth), replace your user ID with a stable pseudonymous code, coarsen dates to the ISO week, and exclude free-text notes. Aggregates with fewer than 10 people are suppressed (“insufficient sample”) so individuals cannot be re-identified from small groups.

Who receives your data, and in what form:

Recipient	Form	Requires your opt-in?
CLA internal / board	De-identified aggregate + row-level	No — needed to run the program
Academic researchers	De-identified row-level	Yes — Research participation opt-in
Pharmaceutical / industry sponsors	De-identified aggregate	Yes — Research participation opt-in
Your treating clinician	Identified single-patient report	Yes — per-request in Settings

What we never do: we do not sell your personal information; we do not share your name or email with researchers, pharma sponsors, or advertisers; we do not include your free-text notes in any external share; we do not disable the audit log.

You can withdraw research participation, request a copy of your data, or request deletion at any time from Settings → Privacy & consent.

Please read carefully. By creating an account or using the PBC Itch Tracker & Discussion Guide (the “App”), you agree to these Terms of Service and the Data Privacy Policy. If you do not agree, do not create an account and do not use the App.

1. What the App is (and is not)

The App is a free, patient-facing tool provided by the Community Liver Alliance (“CLA”), a 501(c)(3) nonprofit organization. It is designed to help people living with Primary Biliary Cholangitis (PBC) track itch and related symptoms, generate discussion prompts for their care team, and read plain-language educational content.

The App is not a medical device. It does not diagnose, treat, cure, monitor, mitigate, or prevent any disease or medical condition. It is not a substitute for professional medical advice, diagnosis, or treatment. Never disregard professional medical advice or delay seeking it because of information in the App.

Not an emergency service. If you think you are having a medical emergency, call your local emergency number or go to the nearest emergency department immediately. The App cannot deliver help in an emergency.

2. Eligibility

You must be at least 18 years old to create an account.
You must be a resident of the United States. The App is not offered to residents of the European Union, the United Kingdom, or other jurisdictions whose health-data laws (e.g., GDPR Article 9) require legal safeguards we do not currently support.
You must have the legal capacity to enter into a binding agreement.
You must provide accurate account information and keep your credentials confidential. You are responsible for all activity under your account.

2a. Your explicit consents

When you create an account, we ask you to actively check a series of boxes confirming (i) your age and US residency, (ii) that you understand the App is not a medical device, (iii) that you consent to CLA collecting the sensitive health information you choose to enter, and (iv) that you have read the Privacy Policy, Terms, and Consumer Health Data Policy. We record each consent (type, version, timestamp) so you can review them in Settings and withdraw the optional ones at any time.

2b. HIPAA does not apply; other laws do

CLA is not a HIPAA covered entity or business associate. Nothing in these Terms or in the App creates a HIPAA-regulated relationship. Your protections come from the FTC Act, the FTC Health Breach Notification Rule (16 CFR Part 318), and state consumer-health-data laws such as the Washington My Health My Data Act. If we experience a breach of your identifiable health information, we will notify you within the deadlines those laws require and, in any case, no later than 60 calendar days after discovery.

3. How the App works and what is collected

Full details are in the Data Privacy Policy. In summary, when you use the App you may create and store:

Account and profile data (e.g., email, display name, preferred language, reminder preferences, optional diagnosis year, optional baseline itch score, current treatments you list).
Daily check-ins (itch severity, sleep impact, mood impact, body regions, triggers, reliefs, notes, whether skin was damaged, time of day, life-impact selections, date).
Treatments you add and edit.
Survey responses you choose to submit and, optionally, a consent-to-research preference.
System data such as sign-in timestamps, browser session tokens, and error logs used to operate and secure the service.

The App is hosted on Lovable Cloud, which uses Supabase for authentication, database, and storage. Your data is processed by these platforms as our service providers. If you sign in with Google, Google receives standard OAuth information required to authenticate you. See the Data Privacy Policy for the full list of subprocessors, categories of data, and your choices.

4. Sharing of your data

We do not sell your personal information. Categories of sharing are limited to:

Service providers that operate the App under contract (hosting, database, authentication, error monitoring, email delivery when applicable).
You. You can export your own visit report (printable/PDF) to share with your clinician.
Aggregated, de-identified research and program reporting. If you have opted in to research use (consent-to-research), CLA may include your check-in and survey data in aggregated, de-identified statistics used to advocate for the PBC community and to report to funders and sponsors. Aggregated statistics do not identify you.
Legal. When required by law, subpoena, court order, or to protect the rights, safety, or property of CLA, our users, or the public.

Administrators of the App (CLA staff or contractors acting on CLA’s behalf) can see aggregate metrics and, for support and content moderation, individual records. Access is limited to those with a business need and is logged in an internal audit log.

5. Your responsibilities

Provide accurate information and update it when it changes.
Do not upload content that is unlawful, harassing, infringing, defamatory, or that contains another person’s personal information without their consent.
Do not attempt to reverse engineer, disrupt, overload, or gain unauthorized access to any part of the App or its infrastructure.
Do not use the App to provide medical advice to others or to represent yourself as a licensed clinician.

6. Educational content

Articles in the Learn library are provided for general educational purposes only. They may be updated, corrected, or removed at any time. Reliance on any information appearing in the App is solely at your own risk.

7. Third-party services and links

The App may contain links to third-party websites or services (including but not limited to Lovable, Supabase, Google, and healthcare information sources). CLA does not control and is not responsible for the availability, content, privacy practices, or terms of those third parties. Your use of third-party services is governed by their terms.

8. Intellectual property

The App, its content (excluding user-submitted content), the “PBC Itch Impact Score™”, and the CLA name and logo are the property of the Community Liver Alliance or its licensors. You retain ownership of the content you submit but grant CLA a worldwide, royalty-free, sublicensable license to host, store, reproduce, and — in de-identified, aggregated form — analyze and publish it to operate and improve the App and pursue CLA’s nonprofit mission.

9. DISCLAIMER OF WARRANTIES

THE APP AND ALL CONTENT ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. TO THE MAXIMUM EXTENT PERMITTED BY LAW, CLA AND ITS OFFICERS, DIRECTORS, EMPLOYEES, VOLUNTEERS, CONTRACTORS, SPONSORS, AGENTS, AND SERVICE PROVIDERS (COLLECTIVELY, THE “CLA PARTIES”) DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, RELIABILITY, AVAILABILITY, SECURITY, AND QUIET ENJOYMENT.

CLA DOES NOT WARRANT THAT THE APP WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE OF HARMFUL COMPONENTS; THAT ANY CONTENT WILL BE ACCURATE OR COMPLETE; OR THAT DEFECTS WILL BE CORRECTED. YOU USE THE APP AT YOUR OWN RISK.

10. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE CLA PARTIES BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATING TO YOUR USE OF OR INABILITY TO USE THE APP, ANY CONTENT, ANY THIRD-PARTY SERVICE, OR ANY MEDICAL DECISION MADE IN CONNECTION WITH INFORMATION FROM THE APP, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT THE CLA PARTIES HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE TOTAL AGGREGATE LIABILITY OF THE CLA PARTIES ARISING OUT OF OR RELATING TO THESE TERMS OR THE APP WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US$100.00).

Some jurisdictions do not allow the exclusion of certain warranties or the limitation of certain damages. In such jurisdictions, the above exclusions and limitations apply only to the maximum extent permitted by applicable law.

11. Indemnification

You agree to defend, indemnify, and hold harmless the CLA Parties from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of or related to (a) your use of the App, (b) your violation of these Terms or any applicable law, (c) content you submit, or (d) any medical or personal decision you or another person makes in connection with information from the App.

12. Assumption of risk; medical decisions

You acknowledge and agree that any medical, treatment, lifestyle, or self-care decision you make based on, or in connection with, use of the App is made at your sole risk. You are solely responsible for seeking and following the advice of qualified healthcare professionals.

13. Suspension and termination

You may delete your account at any time from the Settings page or by contacting CLA. CLA may suspend or terminate your access at any time, with or without notice, for any reason, including suspected violation of these Terms.

14. Changes to the App and to these Terms

We may change, suspend, or discontinue any part of the App at any time. We may update these Terms from time to time. Material changes will be indicated by updating the “Effective” date at the top of this page, and, when appropriate, by additional notice in the App. Continued use after changes take effect constitutes acceptance of the updated Terms.

15. Governing law and dispute resolution

These Terms are governed by the laws of the United States and the state in which the Community Liver Alliance maintains its principal office, without regard to conflict-of-laws principles. Any dispute arising out of or relating to these Terms or the App will be resolved exclusively in the state or federal courts located in that jurisdiction, and you consent to personal jurisdiction there.

16. Miscellaneous

These Terms, together with the Data Privacy Policy, are the entire agreement between you and CLA regarding the App. If any provision is held unenforceable, the remaining provisions remain in effect. Failure to enforce a provision is not a waiver. You may not assign these Terms; CLA may assign them to an affiliate or in connection with a merger, acquisition, or sale of assets.

17. Contact

Questions about these Terms can be sent to the Community Liver Alliance via the contact information published at communityliveralliance.org.

This page is maintained by the Community Liver Alliance to describe how the PBC Itch Tracker & Discussion Guide works. It is provided for transparency and is not legal advice. Your rights under applicable consumer-protection, health-privacy, or other mandatory laws are not affected.