Consumer Health Data Privacy Notice

Your Washington Privacy Rights

Effective date: [EFFECTIVE DATE]

This notice is provided under Washington's My Health My Data Act (RCW 19.373) and applies to residents of Washington. Residents of Nevada (SB 370) and Connecticut have substantially similar rights and may rely on this notice as well. It supplements our Privacy Policy.

1. What counts as consumer health data in Immuno

The following information we collect is consumer health data:

• Any autoimmune condition or health condition entered in a profile
• Symptom entries — the symptom, its severity, notes, and dates
• Food and nutrition logs, and the nutrition figures derived from them
• Hydration, sleep, and activity or workout logs
• Body weight
• Vitals and metrics synced from Apple Health or a wearable — including heart rate, resting heart rate, blood oxygen, step count, and sleep
• Inferences we draw from the above, such as trends and pattern or "flare" signals shown in the Parent Dashboard

2. How we collect it

We collect it directly from you: a parent or child enters it in the app, or you authorize Apple Health to sync specific metrics to us. We do not buy consumer health data, obtain it from data brokers, or collect it from third-party sources.

3. Why we collect it

Only to provide the features you signed up for: displaying your child's habits, nutrition, symptoms, and trends in the Parent Dashboard, and driving in-game progress. We do not use consumer health data for advertising, marketing, profiling, or AI model training.

4. Who we share it with

Only with the service providers listed in SUBPROCESSORS.md, under contracts that limit them to processing on our behalf. In practice, consumer health data is stored with Supabase and, if you use voice logging, briefly processed by OpenAI and Anthropic to produce a food entry.

We may also disclose it if legally required, or to protect someone's safety.

Categories of third parties with whom we share consumer health data: cloud infrastructure and database providers; speech-to-text and language-model providers (voice logging only). No affiliates, advertisers, marketers, or data brokers.

5. We do not sell consumer health data

[COMPANY LEGAL NAME] does not sell consumer health data and has never sold it. We will not sell it without first obtaining your separate, signed valid authorization, as that law requires.

6. Who can access it inside our company

Access is limited to the small number of personnel who need it to operate the Service, provide support, or investigate a security issue. Access is controlled by authentication and least-privilege credentials, and health data is isolated per family by database-level access rules.

7. Your rights

You have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data
• Access it, including a list of every third party with whom we have shared it and contact information for each
• Withdraw consent to our collection and sharing of it
• Delete it — including from our records and, on request, from our service providers' systems
• Appeal if we deny your request
• Not be discriminated against for exercising any of these rights

How to exercise them: email [PRIVACY EMAIL] from the address on your account, stating what you want. We will verify that the request comes from you (or from the parent on the account, for a child's data) and respond within 45 days, with one 45-day extension where the law allows and we notify you.

If we deny your request, we will explain why and how to appeal. To appeal, reply to our decision within 30 days. We will respond to an appeal within 45 days. If we deny the appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint.

8. Deletion

When you request deletion, we delete the consumer health data from our live systems within 30 days and from backups within 90 days, and we notify our service providers to do the same. We may retain the minimum required by law — for example, billing records, which contain no health data.

9. Changes

We will post any changes here with a new date and notify the parent on each account before a material change takes effect.

[COMPANY LEGAL NAME] [COMPANY MAILING ADDRESS] [PRIVACY EMAIL]