Consumer Health Data Privacy Policy
Last updated September 25, 2026
This policy supplements our Privacy Policy. It describes how peaflow handles "consumer health data" as defined by Washington's My Health My Data Act (RCW 19.373), Nevada's SB 370, Connecticut's consumer health data provisions and similar state laws. It applies to everyone who uses peaflow, wherever they live.
Consumer health data we collect
- Medications: names, strengths, forms, directions and refill details you enter or scan.
- Schedules: when each medication is meant to be taken and the reminder windows you set.
- Dose confirmations: whether and when each scheduled dose was confirmed, and the adherence summaries built from them.
- Notes and optional label photos you choose to keep with a medication.
We collect this directly from you, or from members of your care circle who enter it on your behalf. Medication labels are read on the iPhone with on-device text recognition; label photos are never uploaded unless you choose to keep one.
We do not collect precise location, biometric data, or information from other apps or health services.
Why we collect it
Only to provide the service you asked for:
- building the medication schedule and sending reminders;
- recording dose confirmations and telling your care circle when a dose isn't confirmed;
- showing adherence history and producing the doctor PDF you request;
- refill reminders.
We never use consumer health data for advertising, never sell it, and never put medication names in analytics.
Who we share it with
- Your care circle: only the people you (or the circle owner) invite can see a person's medications, schedules and confirmations.
- Our processors, who handle data only on our instructions: Supabase (database and storage, US us-east-1), RevenueCat (subscription status), Expo (push notification delivery), PostHog (product analytics without medication names), Sentry (crash reports) and Cloudflare (website hosting and form protection).
- When the law requires it, for example a valid court order. We'll tell you unless we're legally prohibited.
We do not sell consumer health data, and we do not share it with anyone else.
Consent
We ask for your consent in the app before collecting consumer health data. When you add medications for someone else, you confirm you have their permission. You can withdraw consent at any time; doing so means deleting the data, since peaflow can't work without it.
Your rights
- Access: confirm whether we hold your consumer health data, get a copy, and get the list of processors and third parties it was shared with.
- Delete: have your consumer health data deleted, including from our processors. Account deletion hides everything immediately and permanently deletes it within 30 days.
- Withdraw consent: stop further collection and use at any time.
- Appeal: if we decline a request, you can appeal by replying to our decision. If the appeal is denied, you may contact your state Attorney General.
We will not discriminate against you for using these rights.
How to use your rights
- In the app: Settings → Account → Delete account removes everything. You can also edit or delete individual medications and people at any time.
- By email: write to support@peaflow.com with the subject "Health data request" and tell us what you'd like. We'll verify the request comes from the account holder (usually by replying from your account email) and respond within 45 days, extendable once by 45 days when reasonably necessary; we'll tell you if we need the extension.
- An authorized agent may make a request for you with your signed permission.
Contact
peaflow · support@peaflow.com