Legal

Your Health Data Privacy

Version 1.0, in effect since September 7, 2026

This notice is for people in the United States. It describes the consumer health data Oolite collects, why, who it goes to, and the rights you have over it under state health-privacy laws, including the Washington My Health My Data Act, Nevada SB 370 and the consumer privacy laws of California, Connecticut and other states. It adds to our Privacy Policy; where the two differ for health data, this notice governs.

1. The promises that matter most

We never sell your consumer health data. Not for money, not for anything else of value.
We never share it for advertising, and we do not use it to target you or anyone like you.
We never use it to train AI models.
We collect it only after you have given us specific, separate consent, and only for the purposes listed below.
You can withdraw that consent and delete the data at any time.

2. What counts as consumer health data here

Consumer health data is information that identifies your past, present or future physical or mental health status. In Oolite, that means what you choose to record:

the treatment you are following, its schedule, and the doses and times you log;
body measurements such as weight, and any measurement you import from a health platform on your device with your permission;
symptoms and side effects, appetite and mood ratings, and free-text notes, photos or voice notes you add;
the fact that you are a Oolite user seeking to manage a treatment, which is itself health data and which we treat as such.

We do not collect precise location data, and we do not use location to infer anything about your health.

3. Where it comes from

Directly from you, when you type or record it in the app.
From your device’s health platform, only if you explicitly connect it and only for the categories you allow.
From the app itself, as the record of your own activity in it (for example that a reminder was marked as taken).

We do not buy health data, and we do not obtain it from data brokers, pharmacies, insurers or healthcare providers.

4. Why we collect it

To show you your own history and charts.
To send the reminders and timers you set up.
To build the summary export that you, and only you, decide to share with your doctor.
To keep the Service secure and working, and to fix errors you report.

We use it for nothing else. If we ever want to, we will ask you first, separately, and you will be free to say no.

5. Who it is shared with

We do not disclose consumer health data except in these limited cases:

Processors we contract with to run the Service. Categories: cloud hosting and storage, database, backup, and transactional e-mail where strictly necessary. They act only on our written instructions and may not use the data for their own purposes.
People you choose yourself, when you generate an export and send it.
Legal compliance, where we receive a valid, binding legal request, which we review and answer as narrowly as the law allows.

Analytics and advertising providers do not receive consumer health data. You can ask us for the current list of the specific processors, and of any affiliate, by writing to fidele.richelieu@gmail.com.

6. Your rights

Depending on where you live, you can ask us to:

Confirm whether we hold consumer health data about you, and get a copy of it;
Tell you the list of third parties and affiliates with whom we have shared it, and how to contact them;
Delete it, including from our archives and backups, and require our processors to do the same;
Withdraw your consent to its collection and sharing;
Correct inaccurate data, and opt out of any sale, targeted advertising or profiling, none of which we do with health data in any case;
Limit the use of sensitive personal information, in California.

How to exercise them

Write to fidele.richelieu@gmail.com, or delete data directly in the app. We answer within 45 days and may extend once by 45 more days if the request is complex, in which case we tell you why. We verify the request using the e-mail address associated with your account.

An authorised agent may act for you if they provide your written permission; we may still contact you to confirm.

Appeals

If we refuse a request, you can appeal by replying to our decision within 30 days. A different person reviews the appeal, and we answer within 45 days with our reasons. If we refuse again, you may contact the attorney general of your state.

7. No sale, and no discrimination

We do not sell consumer health data, so we do not seek the written authorisation that a sale would require under the Washington My Health My Data Act, and we have no reason to. We also do not offer financial incentives in exchange for your health data, and we never give you a worse service because you exercised a privacy right.

8. Oolite is not a healthcare provider

Oolite is a consumer application. We are not a HIPAA covered entity or a business associate, and using Oolite does not create a relationship with a healthcare provider. HIPAA protects records held by your doctor, your hospital and your insurer; the data you keep in Oolite is protected by this notice, our Privacy Policy and the state laws named above. See also our medical disclaimer.

9. Contact

Oolite OÜ, Estonia. Health privacy requests: fidele.richelieu@gmail.com.