Your Health Data Privacy

Consumer health data is information that identifies your past, present or future physical or mental health status. In Oolite, that means what you choose to record:

• the treatment you are following, its schedule, and the doses and times you log;
• body measurements such as weight, and any measurement you import from a health platform on your device with your permission;
• symptoms and side effects, appetite and mood ratings, and free-text notes, photos or voice notes you add;
• the fact that you are a Oolite user seeking to manage a treatment, which is itself health data and which we treat as such.

We do not collect precise location data, and we do not use location to infer anything about your health.

If you turn on anonymous treatment statistics

You can choose, in Settings › Privacy, to share figures in ranges about how your treatment goes: your first-launch answers, doses, effects, mood and appetite, weight progress and changes in your treatment (the detail is in section 3.d of our Privacy Policy). They carry a random identifier created on your device and no name. Because that identifier is stable, we treat them as consumer health data, and we collect them only after you turn the setting on yourself. They never include a note, your name, an exact weight or anything from Apple Health.

If you add or report a product with photos

While a product you sent waits for its check, we keep an unreadable, one-way form of the IP address your photos came from, only to make sure two different people agree, and we erase it once the product is checked. Because a submission shows that someone uses Oolite, we treat that link as consumer health data while it exists, and we collect it only after you agree in the app.

• Directly from you, when you type or record it in the app.
• From your device’s health platform, only if you explicitly connect it and only for the categories you allow.
• From the app itself, as the record of your own activity in it (for example that a reminder was marked as taken).

We do not buy health data, and we do not obtain it from data brokers, pharmacies, insurers or healthcare providers.

• To show you your own history and charts.
• To send the reminders and timers you set up.
• To build the summary export that you, and only you, decide to share with your doctor.
• To keep the Service secure and working, and to fix errors you report.
• To check a product you add with the barcode scanner before it joins the product base (section 2).

We use it for nothing else. If we ever want to, we will ask you first, separately, and you will be free to say no.

We do not disclose consumer health data except in these limited cases:

• Processors we contract with to run the Service. Categories: cloud hosting and storage, database, backup, and transactional e-mail where strictly necessary. They act only on our written instructions and may not use the data for their own purposes.
• People you choose yourself, when you generate an export and send it.
• The advertising platform where our ads run. The app tells the platform that the app was opened, that its first-run questions were finished, and the plan and price of a purchase, with technical details of the device but never its advertising identifier, never your answers and never what you record (see our Privacy Policy, section 3.d). Because these signals come from Oolite, they show the platform that a device has the app, which this notice treats as health data (section 2). The platform uses them to measure our ads and may use them to show our ads to people who are more likely to be interested in Oolite.
• Legal compliance, where we receive a valid, binding legal request, which we review and answer as narrowly as the law allows.

Analytics providers do not receive consumer health data, and no advertising provider receives what you record. You can ask us for the current list of the specific processors, and of any affiliate, by writing to privacy@oolite.app.

Depending on where you live, you can ask us to:

• Confirm whether we hold consumer health data about you, and get a copy of it;
• Tell you the list of third parties and affiliates with whom we have shared it, and how to contact them;
• Delete it, including from our archives and backups, and require our processors to do the same;
• Withdraw your consent to its collection and sharing;
• Correct inaccurate data, and opt out of any sale, targeted advertising or profiling, none of which we do with health data in any case;
• Limit the use of sensitive personal information, in California.

How to exercise them

Write to privacy@oolite.app, or delete data directly in the app. We answer within 45 days and may extend once by 45 more days if the request is complex, in which case we tell you why. We verify the request using the e-mail address you write from.

If you turned on anonymous treatment statistics, turn the setting off to stop sharing, and use Settings › Privacy › Delete what I’ve shared to erase what you already sent. That is the only way to delete it: we never attach your e-mail, or any identifier you could give us, to those figures, because doing so is exactly what would make them linked to you.

An authorised agent may act for you if they provide your written permission; we may still contact you to confirm.

Appeals

If we refuse a request, you can appeal by replying to our decision within 30 days. A different person reviews the appeal, and we answer within 45 days with our reasons. If we refuse again, you may contact the attorney general of your state.

We do not sell consumer health data, so we do not seek the written authorisation that a sale would require under the Washington My Health My Data Act, and we have no reason to. We also do not offer financial incentives in exchange for your health data, and we never give you a worse service because you exercised a privacy right.

Oolite is a consumer application. We are not a HIPAA covered entity or a business associate, and using Oolite does not create a relationship with a healthcare provider. HIPAA protects records held by your doctor, your hospital and your insurer; the data you keep in Oolite is protected by this notice, our Privacy Policy and the state laws named above. See also our medical disclaimer.

DISTRIBEA OÜ, Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia. Health privacy requests: privacy@oolite.app.