What This Notice Covers
This Consumer Health Data Privacy Notice supplements our Privacy Policy and specifically addresses how NeuroAmaze collects, uses, and shares consumer health data as defined by the Washington My Health MY Data Act (MHMD) and similar state laws. If you are a Washington State resident, this notice applies to you and provides additional rights.
1. What Is Consumer Health Data?
Under the Washington My Health MY Data Act (effective March 31, 2024) and similar state privacy laws, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.
This includes, but is not limited to:
- Mental health conditions, diagnoses, or assessments
- Symptoms, medications, and treatment information
- Physical health measurements (including sleep data)
- Information derived from health data, such as AI-generated wellness insights
- Location information that could reveal health information (e.g., visiting a mental health facility)
NeuroAmaze applies the highest level of protection to all consumer health data, regardless of your state of residence.
2. Health Data We Collect
| Category | Examples | Stored Where |
|---|
| Mental health assessments | PHQ-9 depression scores, GAD-7 anxiety scores, PSS stress scores, PSQI sleep quality scores, RSA-5 resilience scores | Device only (encrypted) |
| Mood and emotional data | Daily mood ratings (1–5 scale), mood notes, emotional symptom tags | Device + optional cloud sync |
| Symptom data | Anxiety, depression, stress, fatigue, irritability, insomnia, and 12+ other tracked symptoms, each with intensity rating | Device + optional cloud sync |
| Sleep health data | Bedtime, wake time, sleep quality rating, sleep duration, 7-night trends | Device + optional cloud sync |
| Mental health journal entries | Text and voice journal entries, CBT thought records, behavioural activation logs | Device only by default |
| Medication information | Medication names, doses, forms, schedules, and adherence logs | Device + optional cloud sync |
| Derived health data | AI-generated insights, trends, correlations between mood and sleep, CBT programme progress | Device + optional cloud sync |
3. How We Use Health Data
We use consumer health data solely for the following purposes:
- Providing the Service: generating your personalised CBT programme, mood calendar, sleep coaching, and AI wellness insights
- Delivering notifications: sending medication reminders and daily check-in prompts that you configure
- Caregiver sharing (opt-in): if you choose to share with a caregiver or clinician, providing them with the specific data you authorise
- App improvement (anonymised only): aggregated, de-identified analytics to improve app features — no individual health data is used for this purpose
- Safety: crisis resources are surfaced if mental health assessment responses indicate risk of self-harm
We do not use health data for advertising, marketing, personalised advertising profiles, or to infer characteristics unrelated to wellness service delivery.
4. How We Share Health Data
NeuroAmaze does not share consumer health data except in the following limited circumstances:
- Firebase / Google Cloud (BAA in place): for encrypted data storage and authentication services. A Business Associate Agreement is signed. Google Cloud processes data under our instructions only.
- Cloud AI provider (explicit opt-in only): if you enable cloud AI in Privacy Settings, aggregated mood and symptom trends (not verbatim journal text, not your name or identifying information) may be processed by our AI provider to generate personalised insights. You can revoke this at any time.
- Caregivers (explicit opt-in, per-caregiver consent): medication adherence percentages and mood trend summaries only, unless you explicitly grant expanded access.
- Legal requirements: if required by a court order, legal process, or to protect safety.
We Never Share Health Data For
Advertising targeting · Behavioural profiling · Sale to data brokers · Employment decisions · Insurance underwriting · Law enforcement without legal process · Any purpose inconsistent with the delivery of the Service.
5. What We Do NOT Do
NeuroAmaze makes the following firm commitments regarding consumer health data:
- ❌ We do not sell consumer health data to any third party.
- ❌ We do not share consumer health data with data brokers.
- ❌ We do not use consumer health data for targeted advertising or allow advertising networks to access it.
- ❌ We do not use geofencing to infer health status (e.g., proximity to mental health facilities, pharmacies).
- ❌ We do not require you to consent to the collection of unnecessary health data as a condition of using the Service.
- ❌ We do not discriminate against you for exercising your health data rights.
6. Your Rights Under MHMD & Similar Laws
If you are a Washington State resident, you have the following rights under the My Health MY Data Act. Similar rights may apply in Nevada, Connecticut, Colorado, Virginia, and other states with consumer health data protections.
✅ Right to Confirm & Access
You have the right to confirm whether NeuroAmaze collects, shares, or sells your consumer health data, and to receive a copy of the specific health data we hold about you.
How to exercise: Settings → Privacy → Your Data Rights → Export My Data
✅ Right to Withdraw Consent
You have the right to withdraw consent for the collection and sharing of your consumer health data at any time. Withdrawal does not affect the lawfulness of prior processing.
How to exercise: Settings → Privacy → Consent Management
✅ Right to Delete
You have the right to request deletion of all consumer health data we hold about you, including data shared with third-party service providers.
How to exercise: Settings → Privacy → Delete Account. We will delete all data within 30 days and instruct our processors to do the same.
✅ Right to Know About Sharing
You have the right to obtain a list of all third parties and affiliates to whom we have disclosed your consumer health data.
How to exercise: Contact privacy@neuroamaze.com
We will respond to all consumer health data rights requests within 45 days. We may extend this by an additional 45 days with notice if the request is complex or numerous.
We will not discriminate against you for exercising these rights. We will not deny you the Service, charge different prices, or provide a lower quality of service because you exercised your rights.
7. Data Security for Health Data
We implement enhanced security measures for consumer health data beyond our standard security practices:
- Encryption at rest: all health data is encrypted with AES-256 in Firebase Firestore and with iOS Data Protection on-device
- Encryption in transit: TLS 1.3 for all data transmitted to our servers
- Access controls: Firebase security rules restrict each user's data to their authenticated UID only — employees cannot access individual health records without your explicit consent
- Audit logging: all access to health data in our cloud environment is logged with timestamp and accessor identity
- Breach notification: we will notify affected users without unreasonable delay in the event of a breach involving consumer health data, as required by applicable law
- Vendor due diligence: all third-party processors are contractually required to implement equivalent security protections for health data
8. Geofencing Prohibition
NeuroAmaze does not use geofencing technology to identify or infer your health status based on your physical location. We do not:
- Collect or use precise location data to infer visits to health facilities, pharmacies, or mental health providers
- Create geofences around healthcare-related locations
- Share location data with third parties for health-related targeting
The app does not request access to your device's location at any point.
9. Consent & Withdrawal
We obtain your explicit, informed consent before collecting consumer health data. At onboarding, we present clear, plain-language consent for:
- Core health data processing (mood, symptoms, sleep) — required to use the Service
- AI-powered wellness insights — optional, cloud AI requires separate consent
- Caregiver data sharing — requires explicit per-caregiver consent each time
- iCloud backup — optional, requires separate consent
You can view, manage, and revoke all consents at any time in Settings → Privacy → Consent Management. Revoking consent will stop future processing but does not affect data already collected.
We do not use dark patterns, pre-ticked boxes, or consent bundling. Each consent is voluntary and separable.
10. Contact & Appeals
If you are dissatisfied with our response to a rights request, you may:
- Appeal to us by replying to our response email within 30 days — we will conduct a secondary review
- Washington residents: file a complaint with the Washington State Attorney General's Office
- EU/UK residents: contact your local data protection authority