Pausa Consumer Health Data Privacy Policy
Draft — not yet in effect.
This notice is linked separately from our main Privacy Policy because Washington’s My Health My Data Act expects a distinct consumer health data privacy policy. It is the document behind the “Consumer Health Data Notice” link on every Pausa page.
This is Pausa’s Consumer Health Data Privacy Policy for the Washington My Health My Data Act (RCW 19.373), the Nevada consumer health data law (SB 370), the Connecticut Data Privacy Act’s consumer-health provisions, and similar U.S. state laws.
Categories of consumer health data we collect, and why:
| Category | Collected? | Purpose |
|---|---|---|
| Individual health conditions, symptoms, and related logs (symptoms, severity, sleep, cycle/spotting, HRT/supplement adherence) | Collected on your device only; never stored on our servers | To provide the journal, trends, narratives, and reports you request |
| Derived/aggregated health statistics (the transient AI summary) | Processed transiently with your consent; not stored by us | To generate your narrative/report |
| Inferences that could reveal health status from non-health records (e.g. that your account uses a perimenopause app) | Our pseudonymous account/usage records inherently indicate use of a perimenopause-support app | Service operation only; protected under this policy as consumer health data |
| Biometric, genetic, precise-location, or reproductive-health services location data | Not collected | — |
Sources: you (your in-app entries) and your device. Sharing: consumer health data is disclosed only to the processors named in Pausa’s Privacy Policy (AI providers under the transient-summary disclosure, with your consent; infrastructure providers), under contracts restricting use to our instructions. We have no affiliates. We do not sell consumer health data and do not share it for advertising. We do not use geofencing, and specifically do not geofence around any facility providing in-person health care.
Consent: we collect and process consumer health data only with your consent, obtained through a separate, plain-language in-app consent screen (not bundled into general terms acceptance) before any health data leaves your device. Collection limited to your device happens as part of the service you signed up for; nothing is transmitted without the separate consent.
Your rights (WA/NV/CT residents): the right to confirm whether we collect or share consumer health data; to access it, including a list of the third parties (and any affiliates) it was shared with; to withdraw consent; and to have it deleted — including propagation of the deletion to our processors and, on the timeline in Pausa’s Privacy Policy, to backups. Submit requests in-app or to support@nexapps.co. We respond within 45 days (extendable once by 45 days where reasonably necessary). If we refuse a request, you may appeal by replying to our decision or writing to us with the subject “Health data appeal”; we decide appeals within 45 days and, if the appeal is denied, we provide a way to contact the Washington Attorney General (or your state’s equivalent) to raise a concern.
Legal process (our subpoena policy): we do not disclose consumer health data to government entities or litigants except upon valid, binding legal process, which we review and construe narrowly; where lawful, we notify you before disclosure. Structurally, the most protective answer is architectural: we cannot produce symptom histories we do not possess — your logs are on your device, not on our servers, and the transient AI summaries are not stored. What could be produced from our systems is limited to the pseudonymous account, subscription, and content-free usage records described in Pausa’s Privacy Policy.