Consumer Health Data Privacy Policy

This is our Consumer Health Data Privacy Policy. It is a separate policy, required by the Washington My Health My Data Act and similar consumer-health-data laws, that explains specifically how we handle consumer health data. It sits alongside our general Privacy Policy; where health data is concerned, this policy governs.

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For us, that includes things like your weight and body measurements, how you feel day to day, sleep and energy, any medication and dose you record, and health information you choose to connect from Apple Health.

Questions about this policy or your health data can be sent to privacy@subjective.health.

Information you enter: your daily check-ins (how you feel, energy, mood, sleep, side effects), your weight and body measurements, any medication and dose you log, and your program, goals, and focus areas.

Information you choose to connect: if you turn on Apple Health, we read the specific categories you allow (for example weight and steps) so your check-in can fill itself and your trend stays honest. We only read — we do not write to Apple Health — and we use Health data solely to power features you asked for. We never use Apple Health data for advertising, and we never sell it.

Information from your care: if you receive clinical care through a licensed provider, information created in that care is handled under the separate health-privacy notices that apply to that care (such as HIPAA).

Directly from you, through the app and any forms you fill out.

From Apple Health, but only the categories you explicitly allow, and only after you turn it on.

To provide the service you asked for: to run your program, power your daily check-in and your coach, show your trends, and support your care. This is the core reason we collect it.

To keep the service working and safe, and to meet legal obligations where they apply.

We do not use consumer health data for advertising, and we do not profile you to sell you unrelated products.

We collect consumer health data that is necessary to provide the service you have asked us to provide. Before we would collect consumer health data for any purpose beyond that, we will ask for your consent, and before we would share your consumer health data with anyone for a purpose beyond providing the service, we will ask for your separate consent.

You can withdraw consent at any time by emailing privacy@subjective.health or through the app. Withdrawing consent does not undo what we did while it was in effect, and some data may be retained where the law requires.

Service providers who process data on our behalf and only under our instructions — for example our cloud hosting and database provider (Amazon Web Services, in the United States) that stores your data so the app works. These providers may not use your consumer health data for their own purposes.

Your care team, when you are receiving care and sharing is part of delivering it.

We do NOT share consumer health data with advertising networks, data brokers, or analytics used for advertising. We do NOT sell consumer health data. Our analytics tools are not given your consumer health data.

We may disclose information if the law requires it or to protect someone’s safety.

We do not sell consumer health data, and we will not, absent a valid, specific, written authorization from you of the kind the law requires. We treat your health data as something to protect, not to trade.

We do not use geofences around health-care facilities, and we do not use your location to identify or track you near any health-care facility or to serve you health-related advertising.

You have the right to know what consumer health data we have collected, shared, or sold (we do not sell), and the categories of anyone it was shared with; to have your consumer health data deleted; and to withdraw consent to its collection and sharing. We will not deny you the core service, charge you more, or provide a lesser experience for exercising these rights, except where the data is genuinely needed to provide a feature.

To exercise any right, email privacy@subjective.health with what you would like to do. We will verify your request and respond within the time the law allows. If we deny a request, you may appeal by replying to our response; in Washington you may also contact the Washington State Attorney General.

Your consumer health data is stored in the United States, encrypted in transit and at rest, and access is limited to authorized personnel who need it to do their work. No system is perfectly secure, but we treat this data as sensitive by default.

This policy is written to meet the Washington My Health My Data Act and to reflect similar consumer-health-data protections (such as Nevada’s SB370 and Connecticut’s health-data amendments). We extend these protections to our users generally, not only to residents of a single state.

We will update this policy as our product and the law evolve, and we will revise the date at the top when we do. Questions, requests, or concerns: privacy@subjective.health.