LymeHQ · Your data
Everything is off until you turn it on
Not as a setting we default kindly, but as the only state the database will create. This page says what each switch shares, what it does not, and what happens the moment you change your mind.
01 · The starting point
Off is not a default — it is the only thing that can be created
Which is a stronger promise than a well-set default.
When an account is made, a row of sharing choices is created for it automatically, with every switch false. Two separate mechanisms guarantee it: each column refuses to be created as anything but false, and a trigger creates the row so that a missing row and a row of all-offs can never be confused with each other. Nobody has to remember to set them, because there is no code path that sets them.
All-off is a complete, legitimate answer. It is not an incomplete setup, it is not a score, and nothing on your dashboard will nag you about it. Access to LymeHQ is never conditional on sharing anything — no switch gates the tracker, the education library, finding care, or applying for help with a bill.
A rule we hold to, and its name
A switch that unlocks something is a price, not a consent. So the test we apply when a new feature meets a new switch is narrow: does this switch govern what the feature discloses, or does it merely sit near it? Only the first may gate. Beacon needs your record to answer questions about your record, so that switch gates it and Beacon says so when it is off. A positive tick test on a household pet warns the people in that household whatever the sharing switches say — that alert is the household's own safety signal, and charging for it in data would be exactly the thing this rule exists to stop.
Consent is a gate, not a promise
Onboarding asks four, every one starts off, and this is what switching a single one on actually does.
- On — this channel is open
- Off — the read stops at the gate
Every read the site does for you runs as you: the database resolves your identity, applies the rule and decides which rows come back. Where a toggle governs sending data onward rather than reading it, the gate sits in front of the request instead — a row rule can ask whether you may read a row, not whether the server may forward it.
Onboarding asks four. More exist, and they are asked later, where the feature is offered — not at signup, for something the account cannot use yet.
Switch it off and the channel closes on the very next request.
The barrier is not a wall around the platform. System work — webhooks, scheduled jobs, audit writes — runs on a connection that is deliberately not subject to those row rules, and an aggregate already released into a scheduled research refresh moves on that schedule rather than on your next request.
Nothing on this drawing is a measurement. Both halves are tested on every build: turning sharing off reaches your clinician on their very next page load, in the session they already have open — and every consent change is recorded by the database itself, proved by changing a switch with the application removed from the loop entirely.
02 · The ones you are asked at signup
What each one actually shares
In the same words the switch itself uses — this page renders that text rather than a paraphrase of it.
Contribute to Lyme research
Adds your health data to the de-identified research commons that approved researchers can query.
Exactly what is shared
Symptoms, lab values, treatments and outcomes — stripped of your name, email, exact birth date and street address. Location is reduced to the first three ZIP digits, ages 90+ are grouped, and no result is ever released for a group smaller than five people.
If you leave it off
Nothing changes. Every part of LymeHQ works exactly the same.
Research licensing funds patient care through the Access Fund — 20% of research and 25% of pharma dataset revenue. Contributing is a gift, never a requirement, and it is not a condition of receiving a grant.
Let Beacon see your health record
Lets Beacon reference your symptoms, labs and history when you ask it something.
Exactly what is shared
Your record is sent to the AI model only while you are in a conversation, and only the parts relevant to what you asked. Conversations are logged to your account so you can read them back.
If you leave it off
Beacon stays available for general Lyme and tick-borne disease questions — it just will not know anything about you.
Beacon provides health information and education only — not medical advice, diagnosis or treatment.
Share with your providers
Lets a provider you have connected with view your LymeHQ record.
Exactly what is shared
Only providers you have explicitly connected to, and only for as long as that connection is active. Turning this off cuts off every provider at once.
If you leave it off
You can still open your own record to share at an appointment. Nothing is sent automatically.
Contribute pet sentinel data
Shares your pets’ tick-test results as early-warning signal for your area.
Exactly what is shared
Test result, date and ZIP3 — no pet name, no address, nothing about the humans in the household.
If you leave it off
You still get your own sentinel alerts. A positive dog C6 test will still prompt us to suggest testing for the people in your household.
A dog testing positive is a documented early indicator of local tick activity, which is why this one helps neighbours you will never meet.
03 · And the rest, asked later
Not at signup, because the features do not exist yet
A form covering every switch would be asking about screens nobody has seen.
The remaining switches live in the database and are born false alongside the ones above. You are asked about each at the moment it would do something, rather than at signup — the argument for sharing belongs at the point of decision, not on a form for a feature the account cannot use. None of them is switched on for anyone today.
Share within your household
Will let the adults in your household see your symptom trends and exposure history, once household sharing is built. Nothing is visible to anyone today, whichever way this is set.
Your household still works for pets and shared exposure tracking. Your personal record stays private.
Appear in community aggregates
Will include your data in the anonymous patterns shown to other patients, once the community surface is built. Nothing is counted or shown today.
This only controls whether you are counted. Reading community patterns will never require contributing to them — access is not a price.
Import your insurance claims
Lets you connect your Medicare account so LymeHQ can pull in your claims history — what care you received, when, and what it cost.
Nothing is connected and nothing is pulled. Turning it off later stops all syncing and disconnects your insurer account; claims already imported stay in your record.
Let your provider generate visit summaries
Lets a provider you share with generate a written visit summary from your record before an appointment.
Your provider still sees your live record exactly as before. Nothing is generated or sent.
04 · Changing your mind
Where a switch bites, and how fast
Three different answers, because the mechanisms genuinely differ.
Sharing with a clinician
Their very next page loadTheir view is rebuilt on every request and the database re-checks the rule each time, so there is no cached screen still showing your record. We test this on every build — including against a deliberately stale screen, so we know the test would notice if it stopped being true.
Letting Beacon see your record
Your next messageConsent is re-read before every reply. There is no grace period and no context kept from the previous conversation. We test this on every build.
Contributing to research
The next rebuild of the aggregatesThis is the one place revocation is not immediate, and the reason is mechanical rather than a policy choice: researchers query a pre-computed table of group counts, and you leave it when that table is next recomputed. Nothing individual about you was ever in it.
What a change leaves behind
Switching something off stops the sharing. It does not erase the record that you once switched it on — that history is written by the database itself, and no update or delete can touch it. That is deliberate, and it cuts both ways: a consent trail that can vanish is not evidence that consent was ever given, so the same permanence that protects you also means we cannot quietly rewrite what you agreed to.
Deleting your account
You can ask us to delete your account, and we will. Your record goes — every row, every file, every stored credential. What stays is the evidence that the deletion happened: an append-only log entry pointing at a tombstone that names nobody. We keep that because a deletion nobody can verify is a deletion you have to take on faith.
The mechanisms behind all of this — where the rules are enforced and what we deliberately do not claim — are on the security page.
Where to go next
- The mechanismsSecurityWhere each rule is enforced, the script that proves it, and the claims we refuse to make.
- The whole productHow LymeHQ worksWhat you put in, who can see it, and what comes back.
- The moneyHow this is fundedWhere the revenue comes from, and why none of it is a sale of your data.
- PolicyPrivacyThe formal version, and what changes when real accounts launch.