Legal
Midturn Consumer Health Data Privacy Policy
This notice is linked separately from our main Privacy Policy because Washington’s My Health My Data Act expects a distinct consumer health data privacy policy. It is the document behind the “Consumer Health Data Notice” link on every Midturn page.
This is Midturn’s Consumer Health Data Privacy Policy for the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370), the Connecticut Data Privacy Act’s consumer-health provisions, and similar U.S. state laws.
Categories of consumer health data we collect, and why:
| Category | Collected? | Purpose |
|---|---|---|
| Individual health conditions, symptoms, and related logs (symptoms, severity, sleep, cycle/spotting, HRT/supplement adherence) | Collected on your device; never stored on our servers | To provide the journal, trends, narratives, and reports you request |
| Derived/aggregated health statistics and, for the weekly narrative, each day’s entries for the week being summarized (the transient AI summary) | Processed transiently with your consent; not stored by us | To generate your narrative/report |
| Inferences that could reveal health status from non-health records (e.g. that your account uses a perimenopause app) | Our pseudonymous account/usage records inherently indicate use of a perimenopause-support app | To provide the app, and, if you allow usage data, for content-free product analytics (Privacy Policy §3.5); protected under this policy as consumer health data |
| Biometric, genetic, precise-location, or reproductive-health services location data | Not collected | — |
Sources: you (your in-app entries) and your device. Sharing: consumer health data is disclosed only to the processors named in Midturn’s Privacy Policy (the AI provider, under the transient-summary disclosure and only with your consent; the hosting, subscription and crash-reporting providers; and, only if you allow usage data, the analytics provider — which receive the account and usage records in the third row above), each acting under its own data-processing terms. We have no affiliates. We do not sell consumer health data and do not share it for advertising. We do not use geofencing, and specifically do not geofence around any facility providing in-person health care.
Consent: we collect consumer health data only with your consent, with one exception: what is necessary to provide the app you asked for — your pseudonymous account and subscription records, which by their nature show that you use a perimenopause app. Midturn’s usage analytics, which would show it too, are collected only if you allow them when the app asks (Privacy Policy §3.5). Your consent is asked on a separate, plain-language in-app consent screen (not bundled into general terms acceptance), and Midturn never sends the summary of your check-ins without it. Collection limited to your device happens as part of the service you signed up for.
Your rights (WA/NV/CT residents): the right to confirm whether we collect or share consumer health data; to access it, including a list of the third parties (and any affiliates) it was shared with; to withdraw consent; and to have it deleted — including propagation of the deletion to our processors and, on the timeline in Midturn’s Privacy Policy, to backups. Submit requests in-app or to support@nexapps.co. We respond within 45 days (extendable once by 45 days where reasonably necessary). If we refuse a request, you may appeal by replying to our decision or writing to us with the subject “Health data appeal”; we decide appeals within 45 days and, if the appeal is denied, we provide a way to contact the Washington Attorney General (or your state’s equivalent) to raise a concern.
Legal process (our subpoena policy): we do not disclose consumer health data to government entities or litigants except upon valid, binding legal process, which we review and construe narrowly; where lawful, we notify you before disclosure. Structurally, the most protective answer is architectural: we cannot produce symptom histories we do not possess — your logs are on your device, not on our servers, and we do not store the transient AI summaries. What could be produced from our systems is limited to the pseudonymous account, subscription, and content-free usage records described in Midturn’s Privacy Policy.