Consumer Health Data Privacy Notice

This notice applies to you if you are a resident of Washington State, or if your consumer health data is collected in Washington. It is published by Lova Health LLC under the Washington My Health My Data Act, RCW 19.373.

It sits alongside our general Privacy Policy, which applies to everyone. Where this notice gives you a right that the Privacy Policy does not, this notice prevails for you.

The Act defines consumer health data broadly: personal information that identifies your past, present or future physical or mental health status. It expressly includes reproductive and sexual health data, which is the subject matter of this App.

We take a deliberately wide reading of that definition. In particular, we treat the terms you type into the Learn Library as consumer health data, even though they are not records of a diagnosis, because searching “spotting after menopause” or “HRT side effects” in an app like this one discloses something about your health.

We collect this data only with your consent, and only for the purposes stated. We do not use it to profile you, to infer characteristics about you, or for advertising. We do not collect consumer health data for any secondary purpose, and if that ever changes we will ask for your consent again before doing so.

This section is as much a part of the disclosure as the one above. The following remain on your device, encrypted, and are never transmitted to us:

• cycle, period, symptom and basal body temperature entries;
• pregnancy, postpartum and baby data;
• hormone-therapy regimens and guided intervention sessions;
• reproductive goals; and
• quick-log entries and free-text notes.

We hold no copy of any of it, which means there is nothing for us to sell, share, disclose under subpoena, or lose in a breach. The full inventory is in our Privacy Policy.

We collect consumer health data from one source only: you, directly, through your use of the App or the Website. We do not buy consumer health data, we do not obtain it from data brokers, affiliates or public records, and we do not derive it from third-party tracking.

We share consumer health data with the following categories of recipient, and no others. Each acts as our processor under contract and may use the data only to perform the service we have engaged them for.

• Our content delivery and hosting providers, which serve Learn Library requests on our behalf.
• Our crash diagnostics provider, if you have enabled crash reporting.
• Our support tooling provider, which processes correspondence you send us.

We do not share consumer health data with advertisers, data brokers, insurers, employers, or law enforcement absent a legally valid and binding order that we have assessed. We will not disclose consumer health data in response to an informal request.

We have never sold consumer health data, and we do not sell it. The Act requires valid written authorisation, separate from consent, before any such sale. We have obtained no such authorisation from anyone, because we have never sought one.

If that position ever changed, the Act would require us to obtain your signed authorisation first, containing the specific disclosures the Act prescribes, and you would be free to refuse or to revoke it. We would also update this notice before, not after.

Under the Act you have the right to:

• Confirm whether we are collecting, sharing or selling your consumer health data, and to access that data;
• Obtain a list of all third parties and affiliates with whom we have shared or to whom we have sold your consumer health data, together with contact details for each;
• Withdraw your consent to our collection and sharing of your consumer health data; and
• Have your consumer health data deleted, including from our archived and backup systems, and to have us notify any processor or third party that received it of your deletion request.

Exercising any of these rights costs nothing, and we will not degrade your use of the App or charge you differently because you did.

Write to legal@lova.health with the subject line “My Health My Data request”, or use our contact form. Tell us which right you are exercising.

Because the App has no account, we usually cannot identify which records are yours from your name alone. For a deletion or access request we may ask for the random per-installation token shown in the App’s privacy settings. If we cannot verify that the data is yours, we will tell you so rather than guess — handing one person another person’s health data would be the worse error.

We respond within 45 days, and may extend once by a further 45 days where the request is complex, telling you why within the first period.

You may also use an authorised agent. We will ask for written proof of their authority.

If we decline your request, we will tell you why, and explain how to appeal. To appeal, reply to our decision or write to legal@lova.health with the subject line “Appeal”. A person who was not involved in the original decision will review it, and we will respond in writing within 45 days with our reasons.

If we deny your appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint. The Act also gives you a private right of action under Washington's Consumer Protection Act.

Nevada SB370 regulates consumer health data on similar lines. The disclosures in this notice apply equally to Nevada residents: we collect the categories listed in clause 3 from you alone, share them only with the processors listed in clause 6, operate no geofences, and do not sell consumer health data. You may exercise the equivalent Nevada rights through the process in clause 9.

• Consumer health data requests: legal@lova.health
• Contact form: lova.health/contact