Consumer Health Data Privacy Policy
This policy is for residents of Washington, Nevada and other US states with consumer health data laws (such as Washington’s My Health My Data Act). It adds to our Privacy Policy.
1. The consumer health data we collect
- Reproductive and sexual health: periods, cycle and fertility signs, ovulation tests, pregnancy, due date, pregnancy loss, birth and recovery, contraception notes, menopause symptoms
- Bodily functions and measurements: symptoms, weight, blood pressure, temperature, glucose, sleep
- Mental health: mood check-ins, journal entries, self-check answers (such as PHQ-9, GAD-7, EPDS)
- Medicines and supplements, and health conditions you note
- Health information about your children that you add
- Anything else you choose to log, write or photograph in Grrl
Grrl doesn’t infer health information from other data, doesn’t collect precise location, and doesn’t use geofencing.
2. Where it comes from
From you, and from people you choose to share your tracker with (for example, a partner who logs for you, or a note a guest leaves on your event page).
3. How we use it
Only to provide Grrl to you: your trackers, predictions, guides, reminders and reports for your doctor, sharing with the people you choose, and keeping the service secure. We don’t use it for advertising, and we don’t sell it.
4. Who we share it with
- People you choose: your partner, family and friends, in the categories you pick.
- Our processors, only to run Grrl: Supabase (database), Netlify (hosting), Cloudflare (photo storage and services), Resend (account emails), Stripe (payments; no health data).
- When valid legal process requires it, as described in our Privacy Policy.
We don’t have affiliates that receive your health data.
5. Your consent
We collect consumer health data with your consent, which you give when you create your account and each time you choose to log something. You can withdraw it at any time by deleting entries or your account. We don’t share consumer health data with third parties beyond our processors, except as you direct (for example, when you share your tracker).
6. Your rights
- Know and access: whether we collect your health data, a copy of it, and a list of the third parties and processors it has been shared with. Use Me → Export backup, or email privacy@grrl.app.
- Delete: Me → Your account → Delete your account, or email privacy@grrl.app. Deletion reaches our processors and backups (within 7 days).
- Withdraw consent at any time.
- Appeal: if we decline a request, reply to our answer with “Appeal”. We’ll respond in writing within 45 days. If you’re not satisfied, you can contact your state Attorney General (in Washington: atg.wa.gov).
We respond to requests within 45 days, and may need to confirm your identity. We won’t treat you differently for using these rights.
7. Contact
[Legal entity name], [Postal address]. Email privacy@grrl.app.