Consumer Health Data Privacy Policy

Last updated: November 1, 2026

This policy applies to "consumer health data" as defined by Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), and similar laws such as Connecticut's protections for consumer health data. It adds to our general Privacy Policy. If you use the app without an account, or without turning on cloud sync, your data stays in your browser and we don't collect any of it.

1. Consumer health data we collect

Only if you create an account and agree to cloud sync, we collect:

• Medication check-in: whether you marked the daily "Meds — have you taken it today?" check-in as done, and on which days. We don't ask for medication names or doses.
• Other wellness check-ins: whether you marked check-ins such as water, eating, movement, time outside, breathing, eye breaks, posture, sensory breaks, connecting with someone, and "one win" as done each day, and your wellness nudge settings.
• Tasks, routines and notes: anything you type into tasks, the Must-Do, routines or brain dump notes. This may include health information if you write it — for example "call psychiatrist" or "refill prescription". The app may also automatically label tasks like these as health-related.
• Account information linked to this data: your email address and account ID.

We don't collect diagnoses, symptoms, mood scores, precise location or biometric data. Analytics on our website (Google Analytics and Microsoft Clarity) record which articles are viewed, including articles about ADHD and medication. We don't combine this with your account or app data, and the app page is masked from Clarity session replays.

2. Sources

We collect this data only from you, through what you enter in the UpOrbit web app. We don't buy health data or receive it from other companies.

3. Why we collect and use it

• To store and sync your UpOrbit data across your devices — the service you asked for.
• To keep the service secure, and to fix problems you report to us.
• To comply with the law.

We don't use consumer health data for advertising, marketing, profiling or product analytics, and we don't use it to make decisions about you.

4. Who we share it with

We share consumer health data only with Netlify, Inc., our hosting provider. It stores the data (Netlify Blobs) and manages accounts (Netlify Identity) on our behalf under contract, and may not use it for its own purposes. We may also disclose it if required by law, such as a valid court order.

We never sell consumer health data, never share it with advertisers or data brokers, and never send it to Google Analytics, Microsoft Clarity or any other analytics provider.

5. Consent

We collect and sync consumer health data only after you agree to it. Before the first sync, the app asks you to tick a box agreeing to store your UpOrbit data, including wellness and medication check-ins, in the cloud under this policy, and to confirm you are 18 or older. Cloud sync is only for adults. If you don't agree, nothing is uploaded and the app keeps working in your browser only. We will ask for separate consent before sharing consumer health data for any other purpose, and we won't sell it.

6. Withdrawing consent and deleting your data

You can withdraw consent at any time:

• In the app: Settings → Delete my cloud data. This stops sync, permanently deletes your synced data from our storage, and deletes your account login.
• By request: use the contact form and choose "Delete my data".

Deletion removes the data from active storage right away. Remaining copies in our provider's backups or logs are overwritten in the normal course of operations. Data saved in your browser is not affected; use Settings → Reset this browser to clear it.

7. Your rights

You have the right to:

• confirm whether we collect, share or sell your consumer health data (we never sell it);
• access your consumer health data, including a list of the third parties and affiliates we have shared it with (currently Netlify only), and get a copy (Settings → Export also downloads everything);
• delete your consumer health data;
• withdraw consent to its collection and sharing;
• correct inaccurate data (you can also edit or delete entries directly in the app); and
• appeal if we decline your request.

To exercise these rights, use the contact form and choose "Privacy request", "Delete my data" or "Correction". We'll verify the request using the email on your account and respond within 45 days. If we need more time, we'll tell you why (up to another 45 days). To appeal a decision, use the contact form with "Appeal" at the start of your message; we'll respond within 45 days. If your appeal is denied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint, or your own state attorney general. We won't treat you differently for exercising your rights.

8. Retention and security

We keep consumer health data only until you delete it or delete your account. It is sent only over encrypted (HTTPS) connections, stored separately for each account, and accessible only to you and to the people who operate UpOrbit, who access it only as described in this policy.

9. Not medical advice

UpOrbit is a productivity and organization tool, not a medical device or healthcare service. Check-ins are personal reminders. They are not monitored, are not used for diagnosis or treatment, and don't replace care from a licensed professional. If you are in crisis, call or text 988 (Suicide & Crisis Lifeline, US) or your local emergency number.

10. Changes and contact

We'll update the date above when this policy changes, and we'll ask for your consent again before using consumer health data in a new way. Questions? Use our contact form.