Consumer Health Data Privacy Policy

1. Why This Policy Exists

Several states have passed laws that protect health information held by companies that are not hospitals, clinics, or insurers. The two that shape this document are the Washington My Health My Data Act and Nevada Senate Bill 370. Both require companies like ours to publish a consumer health data privacy policy that is separate from our general privacy policy. This is that policy.

Sensa Wellness is a general wellness product. It is not a medical device, it does not diagnose or treat anything, and we are not a covered entity under HIPAA. That is exactly why these state laws matter here: they are the rules that apply to wellness information when HIPAA does not.

This policy covers the Sensa mobile and web app and the website at sensawellness.org. It sits alongside our Privacy Policy, which covers everything else we collect, such as account details, orders, and newsletter sign-ups. Where the two documents describe the same practice, they are meant to say the same thing.

2. What We Mean by Consumer Health Data

These laws define consumer health data broadly: information that identifies you and relates to your past, present, or future physical or mental health. For Sensa, that means the following.

Scan results

• Wellness score: a value from 0 to 100 produced by each vial scan
• Score range: In range, Worth watching, or Time to reset
• Timestamp of each scan, which together with your other scans forms your history
• Optical color index: the color measurement derived from the vial image, which is what the score is calculated from
• Average blue channel value: a second measurement taken from the same image analysis

Health profile answers (optional)

If you choose to fill in the health profile, the answers are consumer health data. The fields are age range, biological sex, activity level, diet type, average sleep hours, stress level, smoking status, primary wellness goal, race and ethnicity, alcohol use, body weight range, self-reported health conditions, supplement use, peptide use, oral health, and gut health. Every field is optional, and the sensitive ones include a "prefer not to say" choice.

Support messages

When you write to our support assistant, Melissa, or email our team, your message may describe symptoms, a diagnosis, or how you are feeling. We treat that content as consumer health data even though you, not a form, decided what to put in it.

What is not consumer health data

Your email address, display name, shipping address, order history, and newsletter sign-up are personal data but not health data on their own. Website analytics collected on our marketing pages, described in Section 6, are not health data and are never joined to any of the information listed above. Our Privacy Policy explains how we handle those categories.

3. Where This Data Comes From

Every piece of consumer health data we hold comes from you.

• The vial scan your device performs. The photo of the vial is analyzed on your phone. The image itself stays on your device and is never uploaded to our servers. Only the resulting numbers, the score, range, optical color index, and blue channel value, are sent to your account.
• Answers you type. The health profile is filled in by you inside the app.
• Messages you write. Support chats and emails are written by you.

We do not buy health data from data brokers, we do not collect it from other apps or devices, and we do not infer health conditions about you from your browsing or purchase behavior.

4. Why We Collect It

We collect and use consumer health data only for these purposes:

• Showing you your results: your current score, your range, and your history over time in the app
• Personalizing wellness content: if you provided health profile answers, we use them to tailor the action plans and suggestions you see
• Producing your exportable report: the PDF summary you can download and choose to share with anyone you like, including a healthcare provider
• Answering support questions: generating a reply to your message and, if you ask for a person or the assistant flags a concern, letting a member of our team follow up
• Keeping the service running: operating, securing, and troubleshooting the app and its infrastructure
• Meeting legal obligations: responding to your rights requests and complying with law

We do not use consumer health data to advertise to you, to build marketing profiles, to score or rank you for any purpose outside the app, or to train artificial intelligence models. Your scores are calculated by fixed image-analysis rules on your device, not by AI.

5. Who Can Receive It

Sensa Wellness has no corporate parent, subsidiaries, or affiliates, so there is no internal sharing beyond our own team. Outside our team, the only recipients are the service providers that run our infrastructure. Each is bound by contract to process data only on our instructions, and each receives only what its function requires.

• Google Firebase (Google LLC) hosts Cloud Firestore and authentication. This is where your account, scan records, and health profile are stored. Firebase can technically access the stored data as the hosting provider, and our security rules restrict reads and writes to the authenticated account that owns the record. See the Google Privacy Policy.
• Vercel Inc. hosts our website and the server functions that sit between the app and our other providers, and keeps standard server logs. See the Vercel Privacy Policy.
• Anthropic PBC provides the AI model behind Melissa. It receives only your support chat text and your first name. It does not receive your scan results, your health profile, or your email address, and it does not train its models on what is sent through its API. See the Anthropic Privacy Policy.
• Resend delivers the escalation email that is sent when a support conversation is handed to a human. That email contains the chat transcript together with your name and email address. See the Resend Privacy Policy.

We may also disclose consumer health data if we are required to by law, such as a valid subpoena or court order, or where disclosure is necessary to protect someone's safety. If we ever receive a legal demand for your health data, we will tell you unless we are legally prohibited from doing so.

6. We Do Not Sell Your Consumer Health Data

Sensa Wellness does not sell consumer health data. We do not exchange it for money or for anything else of value, and we have never done so. Because we do not sell it, we do not collect the signed authorizations that Washington law requires before such a sale, and you will never be asked for one.

We do not share consumer health data with advertisers. There are no advertising networks, remarketing tags, conversion pixels, social media trackers, or data brokers in the Sensa app or on our website.

Our marketing website uses Google Analytics 4 to count visits and see which articles people read. That is website measurement, and it is limited to the marketing site. Google Analytics is not present in the Sensa app, and it never receives scan results, health profile answers, or support chat contents. IP addresses are truncated by Google, and ad personalization, Google Signals, and advertising reporting features are not used. You can opt out of it with the Google Analytics opt-out browser add-on, with your browser's tracking protection, or with a content blocker.

7. Consent and How to Withdraw It

Collecting and storing your scan results is part of delivering the app you asked us for, and it is limited to the purposes listed in Section 4.

The health profile is collected only with your affirmative opt-in. You choose to open it, you choose which questions to answer, and you can skip all of them. Nothing in the scanning experience requires it.

You can withdraw your consent at any time:

• Delete your health profile in the app to remove those answers
• Go to Profile → Delete Account & Data to delete your account, your scan history, and your profile together
• Email info@sensawellness.org and ask us to do it for you

Withdrawing consent stops any further collection or use of that data. It does not undo processing that already lawfully took place before you withdrew, and it does not affect records we are required to keep by law, such as order and tax records, which contain no health data.

8. We Do Not Use Geofencing

Sensa Wellness does not use geofences. We do not create virtual boundaries around health care facilities, pharmacies, clinics, or any other location. We do not use your location to identify you, track you, send you advertising or notifications, or collect any data about you.

9. Your Rights

If you are a resident of Washington, Nevada, or another state with a consumer health data law, and in practice for anyone who asks us, you have the following rights.

• Right to know and access: ask for confirmation of whether we hold consumer health data about you, get a copy of it, and receive a list of the third parties in Section 5 that have received it, along with contact details for them.
• Right to withdraw consent: withdraw your consent to our collection or sharing of consumer health data, as described in Section 7.
• Right to delete: ask us to delete your consumer health data. When you do, we delete it from our own systems and instruct each processor listed in Section 5 to delete their copies as well, including backups, on their standard deletion schedules. We will tell you if any legal obligation requires us to retain something, and what it is.

How to make a request

Email info@sensawellness.org and tell us what you want. Please write from the email address on your Sensa account, or tell us enough for us to match the request to an account, so we can confirm the request is really yours. We will not charge you for a request, and we will not treat you differently for making one.

We will respond within 30 days. Where the law allows and the request is complex, we may extend that period once, and we will tell you within the first 30 days that we are doing so and why.

If we say no: your appeal

If we decline your request, our reply will explain why. You can appeal by emailing info@sensawellness.org with "Privacy Appeal" in the subject line. A person who was not involved in the original decision will review it, and we will write back within a reasonable period with our decision and the reasoning behind it. If we still deny the request, we will tell you how to complain to your state regulator.

Complaining to your attorney general

You can complain to a regulator at any point, and you do not have to appeal to us first.

• Washington residents: the Washington My Health My Data Act is enforced under the state Consumer Protection Act. You can file a complaint with the Washington State Attorney General.
• Nevada residents: you can file a complaint with the Nevada Attorney General.

10. How Long We Keep It

• Scan results and health profile: kept while your account is active, so your history stays meaningful, and deleted when you delete the record, the profile, or the account.
• Scan photos: never uploaded. They stay on your device and are removed when you delete your account in the app or uninstall it.
• Support chats: not stored in a database. If a conversation is escalated to a person, the transcript sits in our support mailbox and is deleted after 90 days, unless an open request still depends on it. You can ask us to delete it sooner.
• Inactive accounts: if you do not sign in for 24 months, we may delete the account and its data. We will email you a warning first so you can sign in or export your history.

Once data is deleted it cannot be recovered.

11. How We Protect It

Consumer health data is encrypted in transit with TLS and at rest on Google's servers. Firebase Security Rules restrict every record to the authenticated account that owns it, so no other user can read or change your data, and no member of our team outside of authorized administrators can reach your personal records. We collect the minimum we need for the purposes in Section 4.

Security incidents. If we discover a breach of security affecting your unencrypted personal or health data, we will notify affected users without unreasonable delay and no later than 60 days after discovery, describing what happened, what data was involved, and what you can do. Where the law requires it, we will also notify the Federal Trade Commission, state attorneys general, or other regulators within the timelines they set.

12. Children

Sensa Wellness is not directed to children under 13, and we do not knowingly collect consumer health data from them. If you believe a child under 13 has created an account or given us data, email info@sensawellness.org and we will delete it promptly.

13. Changes to This Policy

If we change how we handle consumer health data, we will update this page and change the "Last updated" date at the top. We will not use consumer health data we already hold for a materially new purpose without asking for your consent first.

14. Contact Us

Questions, requests, and appeals all go to the same place:

• Email: info@sensawellness.org
• Appeals: info@sensawellness.org with "Privacy Appeal" in the subject line
• Website: sensawellness.org

For everything outside consumer health data, see our full Privacy Policy.