DRAFT · Not in force

Consumer Health Data Privacy Policy

Effective date: {{EFFECTIVE_DATE}}

Operator: {{ENTITY_NAME}}, {{ENTITY_ADDRESS}}. Health data requests and rights appeals: {{PRIVACY_EMAIL}}. This notice supplements the Privacy Policy for US adults 18 or older.

Categories and sources

We treat these questionnaire measures as health-adjacent consumer health data:

• Mini-IPIP Neuroticism.
• IPIP-NEO-120 Neuroticism and its Worry, Anger, Low mood, Self-Consciousness, Immoderation and Vulnerability facets.
• CAT-Q total, compensation, masking and assimilation scores.
• Associated answers, including partial answers and retakes, instrument/scoring versions, completion/answer timing, quality flags and health-related inferences.
• Outside self-reported health, masking, monotropism or neurodivergence results and their names, scales, dates, corrections and link-action timing; health-revealing writing, feedback, messages or channel eligibility can also fall in this category.

Sources are the member's entries and activity, scores/quality summaries calculated from those entries, and content supplied through social/reporting features. We do not obtain clinical records from health-care providers. These results are not diagnosis or clinical findings.

Guest Mini-IPIP answers stay in browser localStorage until signup/sign-in and explicit Save to my Sheet. The browser holds the quest ID, version, answers, progress and any signup save choice/email. Consent saved during signup carries only to the same email. Discard removes the local quest; saving successfully clears it. Page-request information still reaches the host/Cloudflare, and account creation separately sends account details.

Purposes and consent

These records support requested private results, history and the features a member selects. CAT-Q has two separate unchecked choices: collection/use to calculate and show the private result, and sharing with the hosting/backup services described below for operation. Both are recorded and required before CAT-Q access; skipping it leaves other quests available.

Separate consent to collect and separate consent to share are the standard for consumer health data. Current controls implement that separation for CAT-Q. Mini-IPIP and IPIP-NEO-120 currently use product consent, including their health-adjacent dimensions. Saving optional outside results requests storage and display with a health-information notice beside Save, without an additional collection/sharing screen. We do not claim those paths already have separate health-consent controls. Broadening those controls is an implementation requirement, not permission created by this notice.

Health-adjacent scales and results are excluded from matching. Optional channel-access choices are separate: requesting/joining can reveal to the owner and moderators that eligibility conditions were met, without displaying numeric scores or answers. Trait gates exclude flagged sensitive scales, while CAT-Q completion and eligible outside health-result gates can operate with the separate channel-access choice. Community contribution is another default-off member choice; it permits eligible outside results to contribute to community names and percentiles. It is not research consent or consent merely inferred from confirming an assessment label.

The FAQ is static, identical for everyone and uses no member data. No member data is sent to AI models today. A future AI assistant requires its own opt-in, default off, an updated policy and re-consent. Health-adjacent scores including Neuroticism and CAT-Q remain excluded unless separately consented. Continuous research copying is inactive; outside research switches record choices only. The initial future research scope excludes these health measures and outside results.

Recipients and sharing

The operator stores records on an operator-controlled US Windows machine with local PostgreSQL 17. Cloudflare DNS/tunnel services route requests and can process their contents and connection information. Microsoft OneDrive holds encrypted offsite database backups; local and operator-PC copies are also maintained. These infrastructure services support storage, delivery and recovery. No assertion is made that all provider processing is US-only or that operator-hosted PostgreSQL is an independent third-party company.

The configured email service—Postmark or SMTP2GO in the production deploy, with Resend also supported by application configuration—receives account email addresses and account-link messages, not questionnaire answers through that integration. Provider log retention is not specified by the app. Authorized operators may access reported content for safety; recipients see health-revealing content that a member chooses to post and the eligibility signals described above. Health-related content sent to a rights or support contact is handled for that request.

We do not share consumer health data with affiliates or third parties for their independent commercial use. Legally required disclosures are limited to the applicable requirement. Access requests can include a list of third parties and affiliates that received health data and contact details where required.

No sale, advertising or geofencing

We never sell consumer health data or use it for advertising. We do not use geofencing to identify or target visits to health-care facilities. There are no ads at launch. Future contextual EthicalAds or Carbon Ads (BuySellAds) placements may appear only on general pages, labelled “Sponsored”, never on test-taking, results/sheet, outside results, health-adjacent pages, DMs, channel message views or Nearby. Ordinary browser ad requests can disclose IP/browser/page/referrer information as explained in the Privacy Policy; no account, assessment, health, social or saved location records will be supplied. Any first-party personalized ads need a separate default-off button-and-typed-“consent” opt-in and can never use consumer health data.

Withdrawal, deletion and retention

Settings CAT-Q deletion withdraw both CAT-Q choices and delete active CAT-Q sessions, answers and scores. Resuming CAT-Q requires both choices again. Withdrawal events remain with the account as consent history. Outside results have deletion controls; corrections append history until deletion. Account deletion removes account-owned product records, including health results, and creates no research copy.

Product withdrawal in Settings stops further product/social use without deleting existing records. For withdrawal of other collection/sharing, correction, recipient information or deletion including processors, contact {{PRIVACY_EMAIL}}. Turning off channel-access consent is separate from deleting results; already-observed eligibility and recipient copies cannot be recalled.

Account records generally remain until deleted. Feedback loses its account link on deletion but its text can remain identifying; no automatic feedback purge exists. Locked/timed-out accounts can leave an email-derived restriction code, with no expiry for permanent locks. Older unlinked research records cannot reliably be found by account and are not claimed anonymous. These records cannot be repurposed for advertising or new health uses.

Nightly dumps, operator-PC copies and encrypted OneDrive backups have configured 30-day retention. Offsite staging retains three dumps by count. Account deletion does not automatically erase provider/backups, and recovery/export copies or failed jobs can outlast 30 days. No universal deletion deadline for every backup is claimed. Rights-request handling must notify processors and other required recipients to delete; restored data must have deletions/withdrawals reapplied before use. These are operator duties, not automated features.

Rights and appeals

Washington My Health My Data Act, Nevada SB 370 and Connecticut consumer health data protections are addressed through the following request routes, offered to all launch members without restricting additional rights:

• Confirm collection/sharing and access health data, including a copy and a list of third parties/affiliates receiving it, with contact details where required.
• Correct inaccurate records and withdraw consent to collection or sharing.
• Delete health data, including required deletion notices to processors and other recipients.
• Appeal a denied request by replying to the decision at {{PRIVACY_EMAIL}}.

No new account is required. An authorized agent may provide evidence of authority; proportionate verification protects the requester and others. Ordinary requests are free and do not result in retaliation. We respond within 45 days; where permitted, one extension of up to 45 days requires reasons and notice within the first period. Shorter mandatory deadlines control. Denials explain their basis and appeal route; appeal decisions are communicated within 45 days. This is a manual email process.

See Washington rights, Nevada consumer health data law and Connecticut data privacy law. Complaints may be sent to the Washington Attorney General, Nevada Attorney General or Connecticut Attorney General.

Material changes will be described before activation. New health purposes or sharing require new separate consent; this notice does not activate unfinished features.