Consumer Health Data Privacy Policy
This policy covers only consumer health data as that term is defined by Washington's My Health My Data Act. Our general Privacy Policy covers everything else.
What we collect, and why
With your permission, our apps collect:
- Health and fitness measurements — sleep sessions, heart rate, heart rate variability, resting and low heart rate, blood oxygen, respiratory rate, wrist temperature, steps and active energy, and the device model that recorded them. Collected to produce the daily reading and forecasts you open the app for.
- What you tell us — your answers to the daily question and check-in (energy, sleep, mood, symptoms, what you consumed or did), and any note you type. Collected so the reading reflects how you actually felt, not only what a sensor measured.
- Year of birth and sex — collected because heart rate variability and resting heart rate differ by both, and without them your numbers cannot be read against a comparable group.
- Photographs of product labels and the ingredients read from them (Nutori) — collected to tell you what is in a product and how it relates to reactions you have recorded.
We also use de-identified, aggregated data to measure how well our analysis performs and to develop the physiological models behind it, including in scientific research. That work never uses records that can reasonably identify you.
Where it comes from
From Apple Health on your device, with permission you grant and can revoke at any time in iOS Settings or the Health app; and from what you enter in the app yourself. We do not buy health data, and we do not receive it from data brokers or from any other company.
What we share
We do not share or sell consumer health data. No category of it is disclosed to any third party for that party's own purposes, and none is sold — not to advertisers, not to data brokers, not to anyone.
Who processes it for us
Health data is stored on servers we operate in the United States (DigitalOcean) and is processed by Anthropic to generate the plain-language reading. These are service providers acting on our instructions, under contract, and may not use the data for their own purposes. They are not third-party recipients in the sense the Act uses, and nothing is disclosed to any affiliate.
Your rights
You may ask us to confirm whether we hold your consumer health data, to tell you who it has been shared with, to delete it, and to withdraw consent for its collection and sharing. We will not charge you or treat you differently for exercising any of these.
To delete everything immediately, open Settings in the app and delete your account. To make any request in writing, email support@ekydna.com; we will respond within 45 days, and will tell you if we need the one extension the Act allows. If we deny a request you may appeal by replying to that email, and if the appeal is denied you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint.
If you use an app without signing in, your data is identified only by a key held on your device. Delete the app and we have no way to recognise you or to act on a request afterwards — so delete your data from Settings first, or sign in, which ties it to an account you can reach from anywhere.
How long we keep it
Until you ask us to delete it. We do not delete it on a timer, because the analysis and the models improve with a longer history.
Changes
If this policy changes materially, we will post the new version here before the change takes effect and update the date above. Ekydna, support@ekydna.com.