Consumer health data privacy policy
Last updated [DATE, set at publication]
This policy is for people in Washington State, under the My Health My Data Act, in Nevada, under its consumer health data law, and in Connecticut and any other state with a similar law. It adds to our privacy policy. Kithmark is made by The Wired Ape Inc., Delaware, United States, [REGISTERED ADDRESS].
Kithmark is a private family record, not a health service. Some of what it handles could still count as consumer health data under these laws, which define it very broadly, including anything that could be inferred about someone's physical or mental health. We treat all of the following as consumer health data.
What consumer health data we collect, and why
On your phone only, never collected by us: everything you write in your record, including feelings you name, notes, voice notes, entries about relatives and the words you use for a health matter. It stays on your phone, encrypted, and we never receive it in readable form.
Received by our server, only if you ask for a reading: codes and numbers from your record, never your words or anyone's name. Of these, the following could be consumer health data: which people know about a health matter and how they found out, if you turned sensitive records on; your answers to the optional research questions about how you feel in close relationships and how faith helps you cope, if you turned those on; and codes for things you logged that could suggest how someone feels. We use them for one purpose: to put together the reading you asked for. We keep none of them after the reading is made.
Your locked backup, if you turn it on, holds your whole record, but it is locked on your phone with a key only you hold. We cannot open it.
Where it comes from
Only from you, through the app. We do not buy data, receive it from anyone else or infer health information about you from outside sources. We never collect precise location or use geofencing; the only place information is the broad region you choose to describe yourself, such as South Asia.
Consent
We collect consumer health data only with your consent, given separately for each kind: sensitive records, and each research module, each have their own switch, off until you turn it on. You can withdraw consent at any time by switching it off, and what it allowed is deleted at once.
Sharing
We do not sell consumer health data, share it with anyone for their own use, or use it for advertising. It is processed for us by our service providers, which act only on our instructions: Supabase, which stores accounts and locked backups, and Vercel, which runs our server and works out readings. Framer hosts this website and receives none of it. No affiliate receives it.
Your rights
You can ask to confirm whether we collect or share your consumer health data and to see it, ask for the list of the processors that received it, withdraw consent, and ask us to delete it, including from our processors. In the app, Delete my account and backup deletes everything we hold, and switching off sensitive records or a research module deletes what it held. For anything else, write to privacy@kithmark.com. We answer within 45 days, and may extend once by 45 more if we tell you why. If we decline, you can appeal by replying to our answer; we decide an appeal within 45 days, and if you disagree you can complain to your state attorney general.