Consumer Health Data Privacy Policy

This policy covers consumer health data, as Washington's My Health My Data Act (RCW 19.373) defines it. It applies to everyone who uses Readout. The general privacy policy covers the rest of what the app holds.

Who is responsible

Summit Creative Tech LLC publishes Readout and decides the purpose and means of collecting this data. Contact: hello@summitcreativetech.com.

Consent

Readout collects health data with your consent. You give it when you create an account and accept the terms of use. Apple Health access is a separate permission you grant in the app, and photo backup is a separate setting you turn on. You can withdraw any of them at any time. How to do that is below.

What health data Readout collects

• Doses. Compound, amount, route, site, date and time, and doses you skipped.
• Protocols. The compounds you plan to take, their schedules, and their start and end dates.
• Outcomes and side effects. What you record about how you feel, including severity and notes.
• Blood work. Markers, values, units and draw dates you enter.
• Vials and stock. Concentrations, reconstitution details, expiry, and certificates of analysis.
• Progress photos. Photos you take or import in the app.
• Apple Health readings. Weight, body composition, resting heart rate, heart rate, heart rate variability, blood oxygen, VO2 max and sleep.
• Notes and settings. Free text you write, and the app settings that describe your record.

Why Readout collects it

App functionality. The data is your record: the app shows it back to you, charts it, syncs it to your account, and restores it on a new device. It is used for nothing else.

Where it comes from

• You. Everything you type, photograph or dictate in the app.
• Apple Health, on your device. With your permission, Readout reads the readings listed above from Apple Health. They are read on the device and never leave it. With a separate permission, Readout writes weight, body fat and side effects you log back to Apple Health.
• Your voice. The device turns your speech into text. Audio is never uploaded.

Where it is stored

Readout stores your health data on your device. While you are signed in, it also syncs it to your Readout account, hosted by Supabase on Postgres and file storage in the us-east-1 region of the United States. Progress photos are uploaded only when Backup is on in the Photos screen. Every table uses row-level security, so only the signed-in owner of a row can read or change it. A private bucket holds photos under the same rule. Apple Health readings are not synced.

What is shared, and with whom

No category of your health data is sold, and none is shared with anyone for their own use. Two companies process data on Summit Creative Tech LLC's behalf, under contract:

• Supabase, Inc. Hosts your account and the data listed above. It processes the data to run the service and for nothing else.
• Apple Inc. Processes your subscription payment through the App Store. Apple receives no health data. Readout receives whether your subscription is active.

Summit Creative Tech LLC has no affiliates. There are no advertising networks, analytics providers or data brokers, because the app contains no analytics SDK and no advertising.

How long it is kept

Your account keeps your data until you delete the account. Your device keeps its copy until you delete it in the app or delete the app.

Your rights

• Confirm and access. Everything Readout holds about you is visible in the app. Settings, Export your data writes it out as CSV or PDF.
• The list of who it goes to. The two processors named above are the whole list.
• Withdraw consent. Health access is revoked in the iOS Settings app, under Privacy and Security, Health. Photo backup is turned off in the Photos screen. Sync stops when you sign out. Withdrawing consent to all collection means deleting your account.
• Delete. Settings, Account and data, Delete everything. This removes your rows and photos from your account and from the device, and deletes the account itself. It cannot be undone.

To exercise any of these another way, write to hello@summitcreativetech.com. A request is answered within 45 days. If a request is refused, the reason is given, and you may appeal by replying to that address. An appeal is answered within 45 days. You can also complain to the Washington State Attorney General at atg.wa.gov/file-complaint.

Changes to this policy

When this policy changes, the effective date at the top changes with it. The current version is always at this address.

Contact

Summit Creative Tech LLC
hello@summitcreativetech.com