Tax60 Consumer Health Data Privacy Notice
Version 2.0 · Effective October 1, 2026 · Last updated October 1, 2026
Effective October 1, 2026. This Notice is published by PLUSH LLC, a Puerto Rico limited liability company doing business as Tax60, as a regulated entity under the Washington My Health My Data Act (RCW 19.373) and Nevada Senate Bill 370 (NRS 603A.400 through 603A.560), and we apply it to every Tax60 user regardless of residence. It supplements our Privacy Policy (https://tax60.app/legal/privacy), which governs everything this Notice does not address.
Requests and questions: privacy@tax60.app.
1. Why this Notice exists
Federal rules for Puerto Rico bona fide residency let a person count certain days spent outside Puerto Rico as Puerto Rico days when they were receiving qualifying medical treatment, or accompanying a parent, spouse or child full-time who was receiving it (Treas. Reg. § 1.937-1(c)(3)(i)(B), (c)(3)(ii)(A) and (c)(4)). Tax60 lets you tag such days and attach the documents the regulation expects you to keep. A tagged day, its documents, and the location fixes recorded on that day can reveal that you or a family member received health care. Washington and Nevada treat that kind of information as "consumer health data." This Notice tells you exactly what we collect, how we use it, who can see it, and your rights over it.
2. The consumer health data we collect
The medical-exception feature is optional. If you never tag a day as medical, we collect none of the data in this section.
| Data | How it arises | Where it is kept |
|---|---|---|
| A medical-exception tag on a calendar day, with the variant (your own treatment, or accompanying a parent, spouse or child) | You apply it in the day sheet or calendar | On your iPhone and in your Tax60 account |
| Evidence checklist answers for the tag (for example, that the care was inpatient, that a physician's statement exists, the treating facility's name if you enter it) | You answer them | On your iPhone and in your Tax60 account |
| Attached certifications and documents (physician's statement, discharge summary, appointment confirmations, receipts, travel documents for the accompanied family member) | You attach them from your camera, photo library, Files or the share sheet | On your iPhone and in a private storage location in your Tax60 account |
| Location fixes recorded on a tagged day, which may fall inside or near a health-care facility | Normal operation of location tracking | On your iPhone and in your Tax60 account |
| The tag's effect on your presence-test figures (the day counted as a Puerto Rico day) | Computed by the app on your iPhone | On your iPhone and in your Tax60 account; printed in binders you generate |
Your Tax60 account is stored with our hosting provider in the United States, encrypted in transit and at rest and protected by access controls, as Privacy Policy Section 3 describes. Only you, a professional you invite if you include medical details for that professional (Section 6), and a small number of authorized Tax60 staff, acting only for support you ask for, security, and valid legal process, can access it.
3. Sources
The only sources of consumer health data are you (your tags, answers and attachments) and your iPhone's Location Services (fixes recorded on a tagged day, with your permission). We do not obtain health information from health-care providers, insurers, HealthKit, data brokers, or anyone else.
4. Purposes
We collect and process consumer health data for exactly one purpose: to keep, for you, the record that Treas. Reg. § 1.937-1(c)(4)(iii) expects a taxpayer to be able to produce within 30 days of an IRS request, and to reflect the medical exception in the presence-test figures your iPhone computes. Storing it in your account lets you restore it on a new iPhone and, in the versions of the Service that include them, see it on the web and include it, if you choose, in what a professional you invite can see. We do not use it for any other purpose: not for analytics, advertising, profiling, or product research, and never to infer anything about your health.
5. Consent
- Collection. The first time you tag a day as medical, the app shows this Notice and asks for your affirmative, opt-in consent before saving the tag. The consent text version and time are stored in your profile. Declining leaves the day untagged and changes nothing else about the Service.
- Sharing with a professional. When you invite a professional, medical-exception details are left out unless you include them for that professional. Left out, the professional sees that a medical exception applies to a day and how the day counts, but not its details, not the day type, notes or activities you wrote for that day, and not the documents dated that day. Including them is a separate, specific consent for that professional, recorded with its time and the version of this Notice, and you can withdraw it at any time.
- Support access. When you open support access for our staff (Privacy Policy Section 3.3), they never see consumer health data: the same details, notes and documents are left out, whatever you chose for any professional.
- Sale. We do not sell consumer health data and never will. Washington law would require a signed valuable-consideration authorization for any sale; we will never request one.
- Withdrawal. You may withdraw consent at any time by removing the tag, deleting the attached documents, leaving medical details out of a professional's access, or deleting your account (Section 7). Withdrawal does not affect the lawfulness of anything done before it, and does not affect your subscription.
6. Sharing, affiliates and third parties
- Professionals you invite. We share consumer health data with a professional you invite only when you have included medical details for that professional (Section 5). They can read it, not change it, for the tax years and the period you chose, and their access is logged.
- Processors. Our hosting, storage and backup providers (listed at https://tax60.app/legal/subprocessors) are processors that store and process consumer health data only on our instructions, under a written contract, to operate the Service. They may not use it for any purpose of their own.
- No one else. We share consumer health data with no other third party and no affiliate. PLUSH LLC has no affiliates that receive any user data.
- Legal process. We disclose consumer health data to a government authority only under the process our Legal Process Policy (https://tax60.app/legal/legal-process) requires for the contents of a user's record, with notice to you before we comply unless a court or statute prohibits it, and never voluntarily to any tax authority.
7. Your rights
Every user has the rights below; Washington and Nevada residents have them by statute.
- Confirm and access. Confirm whether we are collecting, sharing or selling consumer health data about you, and access it. Your iPhone and your Tax60 account hold the complete record, which we send you on request, free of charge and in a machine-readable format (Privacy Policy Section 12.1, item 2). On request we also send you a copy of the consumer health data we hold about you, together with the list of all third parties and affiliates with whom it has been shared (the professionals you included it for, and no one else) and an active email address or other online contact for each.
- Withdraw consent to collection and to sharing (Section 5).
- Delete. Have consumer health data deleted. Removing a tag or a document in the app takes it out of your record, and a removed document's file is deleted from your iPhone and from your account. Because your record keeps the earlier versions of each entry, a removal alone leaves them in your account's history; when you ask us to delete consumer health data (privacy@tax60.app), we also delete every stored version that holds it, and note the deletion in your record's change log (dates and the fact of deletion only) so your record's integrity statement stays truthful. Deleting your account deletes everything (Privacy Policy Section 7). Deleted data leaves our encrypted backups within 30 days, and we pass your deletion request to our processors and to any professional you shared the data with. Deletion is completed within 30 days of the request, or, for account deletion, within 30 days after the seven-day grace period.
- Non-discrimination. We do not deny the Service, charge a different price, or reduce quality because you exercised a right or declined to consent.
- Appeal. If we decline a request, you may appeal by emailing privacy@tax60.app with "Appeal" in the subject line; a different person reviews it and answers in writing within 45 days with reasons. If we deny the appeal, our answer includes how to contact the Washington Attorney General (atg.wa.gov), the Nevada Attorney General (ag.nv.gov), or your state's regulator to submit a complaint.
How to exercise a right: in the app, by email to privacy@tax60.app from your account email, or by mail to PLUSH LLC, Attn: Privacy, 348 Calle Mendez Vigo 1001, Dorado, PR 00646, United States. We verify requests as described in Privacy Policy Section 12.2 and respond within 45 days (extendable once by 45 days with notice). Authorized agents are accepted with your written permission, and requests concerning a family member whose treatment you accompanied are handled as your own request, because the data is yours.
8. No geofencing of health-care facilities
Tax60 does not establish, and will not establish, any geofence around any in-person health-care facility to identify, track, collect data from, or send notifications or messages to anyone. The only geofences the app creates are a small fence around the place your iPhone last stopped, which follows the device, the three Puerto Rico airports (SJU, BQN, PSE), a ring around the island, and temporary fences around the place you currently are while you travel, all for the purpose of detecting jurisdiction changes and when you leave a place. None is placed on, or sized to, a health-care facility, and none is used to infer health status.
9. Security
Consumer health data has the same protection as everything else in your record: TLS in transit; encryption at rest in your account and in our backups; row-level access control so that only your account reaches it; staff access limited to named administrators; signed hash commitments for integrity; and iOS Data Protection on your iPhone. Details are in Privacy Policy Section 15.
10. Changes
We will give at least 30 days' notice of material changes to this Notice by email and in the app, and we will ask for fresh consent before any change that would let us process consumer health data in a new way. Version 2.0 of this Notice describes consumer health data stored in your account. Consumer health data you recorded while version 1.0 was in force comes under it only after you give, in the app, the separate consent to version 2.0 of this Notice that Section 5 describes; agreeing to our Privacy Policy or Terms of Service is not that consent, and until you give it your iPhone does not send that data to your account. Prior versions are archived at https://tax60.app/legal/health-data/versions.
11. Contact
PLUSH LLC, doing business as Tax60 348 Calle Mendez Vigo 1001, Dorado, PR 00646, United States Privacy: privacy@tax60.app · Legal: legal@tax60.app · Support: support@tax60.app