Legal
Common Plays LLC, operator of RarePause.
This page describes the health information RarePause handles, why, who receives it, and how you control it. It sits alongside our privacy policy, which covers everything else.
Some US states, including Washington, Nevada, and Connecticut, give people specific rights over health information held by companies that are not doctors or insurers. Washington's My Health My Data Act is the strictest of these. We apply this page to everyone, wherever you live.
RarePause is operated by Common Plays LLC. We are not a healthcare provider, health insurer, or medical record system, and HIPAA does not apply to us (our privacy policy, section 11, explains why). The laws on this page apply regardless.
Consumer health data is information that is linked, or could reasonably be linked, to you and says something about your physical or mental health, past, present, or future. It includes things that are only implied. On a platform built around rare-disease communities, that means:
We do not collect precise location, biometric data, or genetic data, and we do not geofence or track visits to health care facilities.
We do not buy health information, and we do not receive it from doctors, hospitals, insurers, or data brokers.
We collect and use consumer health data only to provide what you asked for:
We do not use it for advertising, we do not sell it, we do not use it to train AI models, and we do not use it to build profiles of you. If we ever want to collect a new kind of health information or use it for a new purpose, we will tell you first and ask for your consent.
For registrations and event activity, the organization running the community decides what is collected and why, and Common Plays handles it on the organization's behalf. For your account, and for the fact that one account takes part in several communities, Common Plays decides, and this page is our policy.
The organization running the community. Its administrators see registrations, including answers to its registration questions, and can export what members did at its events. Section 10 of our privacy policy describes exactly what each kind of staff member sees. One organization never sees another community's members or content, except where you take an action that involves both.
Other attendees. A question you submit appears with your name after the organization's staff approve it. Reactions and poll votes are never shown with your name.
Booth exhibitors, only when you book an appointment. The people staffing the booth see your name and the time you booked. Whether they also see your email address is a setting the organization running the event chooses for each booth, and you are not shown which way it is set. Some booths ask you to agree to a short statement before you can book, and you see it first. Exhibitors can be companies with a commercial interest in the condition. If you would rather an exhibitor not have your email address, do not book, or ask the organization what it has chosen. Nothing reaches an exhibitor unless you book.
Service providers that process it for us, under contract, only to provide their service, and barred from using it for their own purposes. By category:
| Category | Provider | What it handles |
|---|---|---|
| Hosting and security | Cloudflare | Every request, including addresses that name a community |
| Main database and sign-in | Supabase | Registrations, event activity, questions you submit |
| Separate store for health answers | Amazon Web Services | Free-text registration answers and answers a community marked sensitive |
| Transactional email | Resend | Emails we send you, which may name an event and so a condition |
| Payments | Stripe | Amount, identifiers, and in one checkout flow the event name |
The full, current list is on our subprocessors page.
One recipient that is not our service provider. Session video plays from YouTube. When a session page loads, Google receives your IP address, browser details, and the address of the community page, which may name the condition. Google handles this under its own terms.
Affiliates. No company affiliated with Common Plays receives consumer health data.
We may also disclose information where the law requires it, and we will tell you if we can.
We do not sell consumer health data, and we do not exchange it for anything of value. If that ever changed, we would ask for your separate, signed authorization first, naming who would receive what and why, as the law requires, and you could refuse without losing access to anything.
You can:
How to ask. Write to help@rarepause.com, or use your account settings. You do not need an account to make a request. We may ask for information to confirm the request is really from you.
Timing. We respond within 45 days. If we need longer, we will tell you within those 45 days why, and take at most 45 more.
Cost. Free, at least twice in any twelve months.
Deletion and backups. Health answers are erased from our live systems at the next hourly run. They then age out of backups within 35 days. Other data ages out of backups within about a week. Our privacy policy, section 13, explains what a deleted account leaves behind (for example, a payment record kept without your name, as the law requires).
Copies outside our own systems. Deletion reaches our own database and the separate store for health answers. It does not automatically reach copies that have already left them, such as emails we sent you or the details a booth exhibitor received when you booked. Tell us when you ask, and we will contact those recipients and ask them to delete what they hold. What Google received when a session video played is held under Google's own terms, and we cannot delete it for you.
When a community controls the data. For registrations and event activity, we may pass your request to the organization running that community and tell you we have. If they do not respond within thirty days, we act on your request ourselves.
If we refuse a request, in whole or in part, we will tell you why. You can appeal by replying to that message or writing to help@rarepause.com with the word "appeal". We will review the decision again and send you a written answer, with our reasons, within 45 days.
If we still refuse, you can complain to the attorney general in your state. Washington residents can contact the Washington State Attorney General's Office at atg.wa.gov/file-complaint.
Health answers are kept in a separate system from the rest of the platform, with its own access controls, and are encrypted at rest. Each community's data is kept apart by the database itself. Access to production systems is limited to the few people who need it. Our privacy policy, section 14, describes our security honestly, including what we do not yet have.
If we change this page in a way that affects what health information we collect, why, or who receives it, we will post the change here with a new date before it takes effect, and ask for your consent where the law requires it. Previous versions stay available.
Questions and requests: help@rarepause.com, which reaches a person.
Common Plays LLC · operator of RarePause