Consumer Health Data Privacy Notice

This notice is provided under the Washington My Health My Data Act and comparable state consumer health data laws. It is separate from, and in addition to, our Privacy Policy. Where the two describe the same practice, they are intended to agree; if they ever conflict, this notice governs consumer health data.

Chronic Trace is not a covered entity or business associate under HIPAA, and the information described here is not protected health information under that law. That is precisely why this notice applies.

Directly from the subject during a screening session, from the device camera and sensors during that session, and from the operator who enters identifying or demographic details. We do not purchase consumer health data, and we do not obtain it from data brokers, advertising networks, or public records.

To produce wellness screening indicators scored against the subject's own prior baselines rather than a population norm, to make those results available to the operator and the subject, to maintain the tamper-evident record that makes a result trustworthy over time, and to improve the accuracy of the measurement itself.

We do not use consumer health data for advertising, for profiling unrelated to the screening, for facial recognition, or for identity verification, and we do not create a face template or faceprint.

We share consumer health data only with service providers who process it on our behalf under contract, and only to the extent each one needs to do its job:

• Supabase: managed database, file storage and authentication. Holds the stored record.
• Vercel: application hosting. Processes data in transit.
• Resend: transactional email. Receives email addresses, not screening data.
• RevenueCat and Stripe: subscription and payment processing. Receive billing information for operator accounts, not screening data.

We may also share data with research or clinical partners in de-identified or aggregated form only, under agreements prohibiting any attempt to re-identify individuals, and where we are legally compelled to do so.

Chronic Trace does not sell consumer health data, and has never sold it. We would not do so without first obtaining the separate signed authorization that state law requires. The service providers listed above are processors acting on our instructions; paying a vendor to host or process data on our behalf is not a sale.

You have the right to:

• confirm whether we hold consumer health data about you, and access it;
• obtain a list of the third parties with whom we have shared it, including how to contact them;
• withdraw consent to our collection and to our sharing of it, separately from one another; and
• have it deleted, including by our service providers, without being charged or penalized for asking.

Operators with an active session can export and delete their own account directly from the Settings page. For any other request, including a request made on behalf of a subject, write to justinbordner@chronictrace.com. We will respond within the time the applicable law allows, and we will tell you if we need to verify your identity before acting.

We collect consumer health data only after consent is recorded for the specific screening session, and sharing with the service providers above is consented to separately from collection. Withdrawing consent stops future collection and sharing. It does not by itself delete what was already collected, so if you want existing records removed, make a deletion request as well.

Where the subject is a minor, consent must be granted by a parent or legal guardian, and the same withdrawal and deletion rights belong to that guardian.

We will post any change here and update the effective date above. Where a change materially expands what we collect or who we share it with, we will seek fresh consent rather than rely on this notice alone.

Chronic Trace, Inc., Dover, Delaware, United States. justinbordner@chronictrace.com