Privacy Policy

1. Who We Are

Threshold Works is an end-of-life planning service operated by Lauren Milan, based in Seattle, Washington. We provide guidance, documentation, and organizational support to individuals and families navigating end-of-life planning.

For privacy inquiries, contact us at: hellolaurenmilan@gmail.com
Threshold Works · Seattle, WA

2. Information We Collect

Information you provide directly

• Account information: Your email address, used to authenticate your access to the client portal.
• Questionnaire responses: All information you enter in your Threshold Legacy Planning Questionnaire, including healthcare preferences, estate planning details, personal letters, disposition wishes, financial account information (locations only — not account numbers), digital asset instructions, and related planning information.
• Acknowledgment record: Your name, the date you signed the client acknowledgment, and the timestamp of your signature.
• Communications: Emails and messages you send to Lauren Milan.

Information collected automatically

• Audit log: A record of significant actions in your account (sign-in, questionnaire saves, acknowledgment signing) including approximate timestamps. This log is used for security and legal defensibility. It does not include the content of your responses.
• Authentication tokens: Managed by our authentication provider (Supabase) to keep you signed in securely.

Information we do not collect

We do not collect your Social Security number, full financial account numbers, passwords, or payment card numbers through this service. We do not use cookies for tracking or advertising. We do not collect geolocation data.

3. How We Use Your Information

• To provide our services: To display your questionnaire responses to you and to Lauren Milan, to enable you to save and resume your work, and to support Lauren’s review and guidance process.
• To communicate with you: To send authentication codes, respond to your questions, and provide planning-related follow-up.
• For security and legal compliance: To maintain audit logs, detect unauthorized access, and comply with our legal obligations.
• To improve our services: In aggregate, non-identifiable form only — for example, understanding which sections clients find most useful.

We do not use your information for advertising, profiling, automated decision-making, or any purpose inconsistent with the services described above.

4. Your Health and Personal Planning Information

The information you share in your planning questionnaire includes sensitive health-related and personal data, including healthcare preferences, end-of-life wishes, advance directive details, and related information. We treat this information with the highest level of care.

Your explicit consent to our collection of this information is obtained through the client acknowledgment you sign before accessing your questionnaire. You may withdraw consent and request deletion of your information at any time (see Section 7).

5. How We Protect Your Information

• Encryption at rest: All data stored in our database is encrypted using AES-256 encryption.
• Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher (HTTPS). Unencrypted HTTP connections are automatically redirected to HTTPS.
• Row-Level Security: Our database enforces access controls at the row level, meaning each client’s data is cryptographically isolated from every other client’s data. Only you and Lauren Milan (via administrator credentials) can access your records.
• Authentication: We use email-based one-time passwords (OTP) for authentication. No passwords are stored. Codes expire after a short time.
• Access controls: Lauren Milan is the only person with administrative access to client data. No third parties have access unless explicitly required for legal compliance.
• Infrastructure compliance: Our database provider (Supabase, Inc.) is SOC 2 Type II certified and maintains its own comprehensive security program.

No method of electronic transmission or storage is 100% secure. While we employ industry-standard measures, we cannot guarantee absolute security.

6. Who Has Access to Your Information

• You: Full access to your own questionnaire responses and account data.
• Lauren Milan: Access to your questionnaire responses and account status for the purpose of providing planning services to you.
• Supabase, Inc.: Our database and authentication provider, operating as a data processor. Supabase processes your data solely to deliver their services to us and is bound by their Data Processing Agreement. Supabase does not access your data for their own purposes. Learn more at supabase.com/privacy.

We do not sell, rent, license, or share your information with any other third party, including data brokers, advertisers, marketing platforms, insurance companies, or employers.

We may disclose your information if required by law, court order, or to protect the rights, property, or safety of Threshold Works, our clients, or others — but only to the minimum extent required and after notifying you where legally permitted.

7. Your Privacy Rights

Depending on your state of residence, you have the following rights:

Right	What it means	WA	OR
Access	Request a copy of the personal information we hold about you	✓	✓
Correction	Ask us to correct inaccurate information	✓	✓
Deletion	Request that we delete your personal information	✓	✓
Portability	Receive your data in a machine-readable format	✓	✓
Opt out of sale	We do not sell data — this right is satisfied by default	✓	✓
Health data deletion (WA MHMD)	Request deletion of consumer health data within 30 days	✓	—

To exercise any of these rights, email hellolaurenmilan@gmail.com with “Privacy Request” in the subject line. We will respond within 30 days. We will not discriminate against you for exercising your privacy rights.

Note: Deletion of your account will permanently remove your questionnaire responses from our systems. We recommend downloading a copy of your completed questionnaire before requesting deletion.

8. Data Retention

We retain your personal information for as long as your client relationship with Threshold Works is active, plus a reasonable period thereafter to comply with our legal obligations and to resolve disputes. If you have not logged into your account in 3 years and have not engaged with Threshold Works services, we may contact you before archiving or deleting your data.

Audit log records are retained for 5 years for legal defensibility purposes.

You may request deletion of your data at any time under Section 7. Upon a verified deletion request, we will remove your personal information within 30 days, except where retention is required by law.

9. Data Breach Notification

In the event of a data breach that creates a material risk of harm to you, we will:

• Notify affected individuals within 30 days of discovering the breach, as required by the Washington Data Breach Notification Act (RCW 19.255.010)
• Notify the Washington State Attorney General’s Office if the breach affects more than 500 Washington residents
• Comply with Oregon’s breach notification law (ORS 646A.604) for affected Oregon residents, which requires notification within 45 days
• Provide information about the nature of the breach, the data involved, and steps you can take to protect yourself

We maintain an internal incident response procedure to detect, contain, and investigate potential security incidents promptly.

10. Children’s Privacy

Our services are intended for adults aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18. If we learn that we have collected information from a minor, we will delete it promptly. If you believe we have inadvertently collected information from a minor, please contact us immediately.

11. Third-Party Links and Services

Our website may contain links to third-party services, including Calendly (for appointment scheduling) and Google (for Drive/email). This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party services you use.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. We will update the “Last updated” date at the top of this page. For material changes, we will notify active clients by email. Your continued use of our services after the effective date of a revised policy constitutes your acceptance of the changes.

13. Contact Us

For privacy questions, requests, or concerns:

We will respond to all privacy inquiries within 30 days.

This Privacy Policy was prepared by Threshold Works. While we have made every effort to comply with applicable privacy laws, this document does not constitute legal advice. Threshold Works encourages clients with specific legal questions to consult a qualified privacy attorney.