This policy applies to consumer health data about a Washington resident or a person whose consumer health data is collected in Washington, as covered by Washington’s My Health My Data Act. “Consumer health data” means personal information that identifies or can reasonably be linked to a consumer and identifies past, present, or future physical or mental health status.
1. Categories collected and purposes
- Mood, emotional wellbeing, symptoms, functioning, sleep, movement, activities, and self-care: to save and display check-ins and create the descriptive views you request.
- Medication and treatment information: to maintain medication history and show dated comparisons and recorded context.
- Menstrual-cycle information and calendar estimates: to maintain optional cycle history and show requested cycle context.
- Notes, custom answers, and emotions: to save the personal context you choose and include it in requested records or exports.
- Age, country, gender identity, and other profile context: to provide the settings and context you choose.
- Patterns, comparisons, summaries, and other inferences: to provide descriptive insights from recorded dates without diagnosing, predicting, or determining cause.
- Account, authentication, entitlement, transaction, device, and security records that may reveal use of a health app: to authenticate accounts, provide signed-in backup and Plus, maintain security, troubleshoot, and prevent abuse.
- Support, privacy-rights, and limited public-site request information that may reveal an interest in a health service: to respond, secure and deliver the website, and meet legal obligations.
2. Sources
Consumer health data comes directly from you; from Hues Within’s operation on your device and the descriptive outputs generated from your entries; from Apple when you choose Apple sign-in or make an App Store purchase; from Supabase service events for account and signed-in functions; and from support or rights messages you send.
3. Statutory sharing and service disclosures
Hues Within does not sell consumer health data and does not disclose it for an independent commercial purpose. For transparency, the service relationships and user-directed disclosures planned for launch are listed below. A disclosure is excluded from statutory “sharing” only when the Act’s conditions are met. Before Washington launch, Hues Within will verify the required contracts and legal roles; if any planned disclosure constitutes “sharing,” Hues Within will identify the categories and recipients and obtain separate consent before it occurs.
- Supabase: account, authentication, signed-in completed check-in and basic-profile backup, deletion-reconciliation, entitlement, security, and server-function information needed to provide those services.
- Apple: sign-in information when you choose Apple sign-in and transaction or entitlement information needed for App Store purchases and restoration.
- Google Workspace: support or privacy-request messages, participants, attachments, and related delivery and security metadata needed to provide and protect the email service.
- Public-site hosting infrastructure: limited website request and security information needed to deliver and protect the public site.
- A recipient you select: a report, spreadsheet, chart image, calendar image, or other file only when you choose to save or share it.
- Authorities or professional advisers: only information reasonably necessary when disclosure is legally permitted or required, needed to protect rights or safety, or needed to investigate an incident.
Hues Within has no corporate affiliates. It does not disclose consumer health data to data brokers, advertisers, employers, or insurers. It does not permit advertising or analytics companies to collect consumer health data over time and across unrelated websites or online services through Hues Within.
4. Consent and choices
Hues Within requests affirmative consent before collecting consumer health data for purposes beyond what is necessary to provide a product or service you request. Consent is separate from the Terms and identifies the categories and purposes. Hues Within requests separate consent before sharing consumer health data when Washington law requires it. Hues Within does not sell consumer health data; if that practice ever changed, it would first obtain the signed authorization Washington law requires.
You may withdraw consent through the consent control in the app’s Settings or by contacting the Privacy Lead. Hues Within will stop future collection or sharing covered by the withdrawal, subject to legally permitted processing, and will explain any service feature that can no longer operate.
5. Washington rights
Subject to applicable exceptions, you may:
- confirm whether Hues Within is collecting, sharing, or selling your consumer health data and access that data;
- obtain a list of every third party or affiliate with which your consumer health data was shared or sold and an active email address or other online contact for each;
- withdraw consent to collection or sharing;
- have consumer health data deleted from Hues Within’s records and networks; and
- appeal a refusal to act.
6. Submit a request
Email hello@hueswithinapp.com with the subject “Washington consumer health data request.” Include your name, account email if any, the right you want to exercise, a clear description of the request, and the email where you want the response. Do not send journal entries, medication details, passwords, or unnecessary health information. Hues Within may verify the request through the signed-in account, account email, a one-time code, or another proportionate step. You do not need to create a new account.
Records kept only on your device are not accessible to Hues Within. Use the in-app export, individual-deletion, or erase controls for records Hues Within never receives.
Hues Within will respond without undue delay and no later than 45 days after receipt. It may extend once for another 45 days when reasonably necessary, with timely notice and the reason. Requests are free up to twice in a 12-month period unless Washington law permits a charge for a manifestly unfounded, excessive, or repetitive request.
7. Deletion
When a verified Washington deletion request applies, Hues Within will delete the covered data from its records and networks and notify the affiliates, processors, contractors, and other third parties required by law. Data in archived or backup systems will be deleted as required when those systems are restored or accessed and no later than six months after authentication of the request, unless a legal exception applies.
8. Appeal
If Hues Within declines to act, the response will explain why and how to appeal. Email hello@hueswithinapp.com with the subject “Washington consumer health data appeal” and include the date of the original request and decision and a short explanation. Do not include health details unless necessary. Hues Within will respond in writing within 45 days with its decision and reasons. If the appeal is denied, the response will explain how to contact the Washington Attorney General.
9. Changes to this policy
Before collecting new categories of consumer health data or using already-collected data for materially different purposes, Hues Within will update this policy and obtain any consent required by law.
10. Contact
Cynthia Salinas Treviño is the Privacy Lead for Hues Within. Contact: hello@hueswithinapp.com. Legal domicile: Manuel Alanis 6, Col. Lomas del Hipico, 64989 Monterrey, Nuevo León, Mexico.