Consumer Health Data Privacy Policy
Effective [effective date pending]
This policy explains how Önduřř (Ondurr LLC, a California limited liability company) collects, uses, and shares consumer health data, and the rights of Washington and Nevada residents under the Washington My Health My Data Act and Nevada Senate Bill 370. It supplements our Privacy Policy; where this policy addresses consumer health data, this policy controls.
Consumer health data we collect
- HIV status, an optional profile field you may choose to fill in. This is the only health information we intentionally collect.
We collect it for one purpose: to display it on your profile to other users, because you chose to share it. We do not use it for advertising or marketing, we do not use it to make inferences about you, and we do not use it for analytics.
Sources
We collect consumer health data from one source: you, when you enter it in your profile. We do not collect health data from third parties and we do not infer it.
How we share it
- Other users of the Service can see your HIV status on your profile if and only if you have chosen to add it. You can remove it at any time in Settings.
- Service providers (processors) that host and operate the Service store this data on our behalf and only on our instructions: our database and authentication provider (Supabase) and our application hosting providers (Vercel and Railway).
We do not sell consumer health data, and we will not sell it without the separate, signed authorization the law requires. We do not share it with advertisers, data brokers, analytics providers, or anyone else not listed above, except where the law requires disclosure.
Consent
We ask for your consent, separately from the Terms of Service and the Privacy Policy, before collecting your HIV status. Providing it is never a condition of using the Service. You can withdraw consent at any time by removing the field in Settings or by contacting us; we will stop collecting and displaying it.
Your rights
If you are a Washington or Nevada resident, you have the right to:
- Access your consumer health data, including a list of the third parties and affiliates with whom we have shared it and how to contact them.
- Withdraw consent to our collection and sharing of your consumer health data.
- Delete your consumer health data. Deletion extends to our service providers and to archives and backups as the law requires.
To exercise any of these rights, remove the field in Settings, or contact privacy@ondurr.com. We will respond within the time required by law (generally 45 calendar days, with one 45-day extension where permitted, and we will tell you if we take it). If we refuse a request, you may appeal by replying to our decision or writing to privacy@ondurr.com with the subject "Health data appeal"; we will respond to appeals within the statutory period and, if the appeal is denied, provide a way to contact your state Attorney General.
We do not use geofencing around health care facilities, and we do not discriminate against you for exercising your rights.
Contact
Postal address: [Apppiggy LLC postal address]