Bob Handles ItLast updated: July 2026.
Bob Handles It ("we," "us") helps patients and caregivers organize medical records, track appointments and providers, and handle routine provider communication. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies to the Bob Handles It website and services (the "Service"). By using the Service, you agree to this policy.
1. Information we collect.
2. How we use your information. We use your information solely to provide and improve the Service for you: to organize your records and appointments, detect and match your healthcare providers, schedule or reschedule visits at your direction, request records, and send you reminders and notifications. We do not use your information for advertising, and we do not sell your personal information.
3. Automated processing and AI. To provide the Service, we use trusted AI processors (including Amazon Web Services / Amazon Bedrock and Anthropic) to perform tasks such as matching provider names from your calendar to public provider directories and summarizing records you ask us to organize. This processing happens only to deliver the Service's functionality, on a per-request basis, under agreements that restrict the processor's use of the data. We do not use your data — including data obtained from Google or other connected accounts, or your health information — to train, develop, or improve generalized or standalone AI/ML models. Where the data is protected health information, these processors act under a HIPAA Business Associate Agreement.
4. Google user data and connected calendars. If you connect a Google account, we request access to your Google Calendar for the sole purpose of operating the Service: reading your calendar events (event title, date/time, location, and description) to detect your healthcare appointments and providers, and creating or updating events only when you ask us to schedule or change an appointment. We access the minimum data needed, and you can revoke access at any time from your account settings or from your Google security settings. The same principles apply to Microsoft calendars.
Google Limited Use disclosure. Bob Handles It's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide or improve user-facing features that are prominent in the Service; we do not transfer or sell it to third parties for advertising, market research, or other unrelated purposes; we do not use it for serving advertisements; and we do not allow humans to read it except with your explicit consent, to comply with law, or as necessary for security and to operate the Service (e.g., a limited, need-to-know basis for support you request).
5. Medicare data (CMS Blue Button). If you choose to connect Medicare, we use the Centers for Medicare & Medicaid Services (CMS) Blue Button 2.0 API to retrieve your Medicare claims on your behalf, and only after you authorize it through Medicare's own sign-in and consent screens. We request the minimum scope needed — your claims (Explanation of Benefits) data — which we use to identify the healthcare providers you have seen so we can organize your care. We do not request your Medicare demographic information (name, address, date of birth, race, or sex) through Blue Button. You can revoke Bob Handles It's access to your Medicare data at any time from your account in the Medicare.gov connected-applications settings, or by disconnecting Medicare in Bob Handles It. When you revoke access we stop retrieving new claims and delete the Medicare claims data we retrieved for you, except where limited retention is required by law (see Section 9).
6. How we share your information. We share information only as needed to run the Service:
We do not sell your personal information, and we do not share it for third-party advertising. We do not disclose your Medicare claims data to any third party except the subprocessors above that help us operate the Service for you, the parties you direct us to contact, or as required by law.
SMS / mobile opt-in data. No mobile information — including your phone number and your SMS opt-in and consent — will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. We share this information only with the subprocessors that help us operate the Service (for example, our SMS provider), the parties you direct us to contact, or as required by law. See our SMS Terms.
7. We do not de-identify or sell your data. We do not de-identify, aggregate, or anonymize your health or Medicare data to create datasets for sale, licensing, advertising, market research, or other purposes unrelated to providing the Service to you. Your data is used to deliver the Service's features to you, and for no independent commercial purpose.
8. Security. Data is encrypted in transit and at rest, hosted on HIPAA-eligible infrastructure, and access is restricted to you, the people you authorize, and personnel on a need-to-know basis. We apply administrative, technical, and physical safeguards appropriate to the sensitivity of health information, and we require our subprocessors to maintain comparable protections.
9. Data retention, revocation, and deletion. We keep your information for as long as your account is active or as needed to provide the Service, and thereafter only as required to comply with legal obligations, resolve disputes, and enforce our agreements.
10. If there is a data breach. We maintain procedures to detect, investigate, and respond to security incidents. If your unsecured health information is involved in a breach, we will notify you and, where applicable, the appropriate authorities without unreasonable delay and consistent with our obligations under the FTC Health Breach Notification Rule and other applicable law (and, where the data is subject to HIPAA, its breach-notification requirements).
11. Your choices and rights. You can access, correct, or delete your information, disconnect any connected account (including Medicare), and opt out of text messages at any time. Depending on where you live, you may have additional rights under applicable privacy laws; contact us to exercise them.
12. Business transfers. If Bob Handles It is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will require the successor to honor this Privacy Policy, and if the transaction would materially change how your information is used, we will notify you beforehand and, where required, obtain your consent.
13. Children. The Service is intended for adults (18+) managing their own or an authorized patient's care. It is not directed to children under 13, and we do not knowingly collect their information.
14. Changes to this policy. We may update this policy. For material changes — including changes to how we use, share, or retain your health or Medicare data — we will post the update here with a new "last updated" date and notify you by email or an in-app notice before the change takes effect where required.
15. Contact. Questions or requests? Email support@bobhandlesit.com, Bob Handles It LLC.