Consumer Health Data Privacy Policy

Scope & Purpose

This Consumer Health Data Privacy Policy is published in compliance with the Washington My Health My Data Act (RCW 19.373) and similar state consumer health data privacy laws. It supplements our general Privacy Policy with specific disclosures about how we collect, use, share, and protect your consumer health data.

This policy applies to all users of the saviMon mobile application operated by TachyonHQ, LLC, regardless of your state of residence.

saviMon is not a medical device. It is designed for informational and personal tracking purposes only. It does not diagnose, treat, cure, or prevent any disease or medical condition.

Health Data Categories

Under the Washington MHMDA, "consumer health data" means personal information that identifies a consumer's past, present, or future physical or mental health status. saviMon collects the following categories of consumer health data:

Category	Data Collected	How Collected
Medical Conditions	Health conditions you add to your profile (e.g., Type 2 Diabetes, Hypertension, Celiac Disease)	You enter these voluntarily
Prescription Medications	Drugs and supplements you track, including NDC codes, dosage, and dosing schedule	You scan barcodes or search and add
Allergen Profile	Allergens you identify (e.g., peanuts, milk, wheat) with severity level (anaphylactic, intolerance, or preference)	You enter these voluntarily
Nutrition & Meal Data	Meal photos, food logs, calorie and macronutrient intake, micronutrient totals	You log meals via photo, search, chat, or manual entry
Body Measurements	Weight (daily entries in kilograms)	You enter manually or sync from HealthKit/Health Connect
Blood Glucose Readings	Glucose values (mg/dL) with timestamps and data source (CGM, manual)	Read from Apple HealthKit or Google Health Connect (with your permission), or entered manually
Physical Activity	Step count, active calories burned	Read from Apple HealthKit or Google Health Connect (with your permission)
Drug Interaction Results	Interaction alerts generated when your medications, supplements, foods, and conditions are cross-referenced	Generated automatically based on data you provide

Why We Collect Consumer Health Data

We collect consumer health data solely to provide the saviMon application's core features:

Interaction Checking — Cross-reference your medications, supplements, foods, and conditions to generate interaction alerts
Allergen Alerts — Check scanned products and logged meals against your allergen profile
Nutrition Tracking — Display calorie, macronutrient, and micronutrient totals and trends
Condition-Aware Targets — Personalize nutrient warnings based on your medical conditions (e.g., sodium limits for hypertension)
Glucose Tracking — Display glucose trends, meal-glucose correlation, and food impact rankings
Weight Tracking — Display weight trends over time
Health Summary Export — Generate a PDF summary of your tracked health data for your personal records

We do NOT use consumer health data for:

Advertising, ad targeting, or marketing to you or third parties
Selling or renting to any third party
Profiling for commercial purposes
Training artificial intelligence models (OpenAI's API data usage policy prohibits training on API data)
Any purpose unrelated to providing the saviMon application

Categories of Third Parties

saviMon shares limited data with the following categories of third parties, solely to provide the application's features:

Third Party	Data Shared	Purpose	Health Data Shared?
OpenAI	Meal photos (images) and chat message text	Nutritional analysis of meal photos; AI assistant responses	No — photos contain food images only; no conditions, medications, allergens, or personal identifiers are sent
Open Food Facts	UPC barcode numbers	Product lookup for scanned barcodes	No
FDA openFDA API	Drug names and ingredient names	Adverse event report lookup	No — only generic drug/ingredient names, not user identity
Cloudflare	IP address, CAPTCHA token	Bot protection on authentication endpoints	No
Apple / Google	Purchase receipts for subscription validation	Verify subscription status	No

We do not sell consumer health data. We do not share consumer health data with data brokers, advertisers, analytics services, or any other third parties not listed above.

We do not use analytics SDKs (such as Google Analytics, Firebase Analytics, Mixpanel, Amplitude, or Facebook Pixel) in the saviMon application. No tracking pixels, cookies, or behavioral advertising tools are present.

Consumer Rights Under the Washington MHMDA

If you are a Washington state resident, or a resident of any state with similar consumer health data privacy laws, you have the following rights:

Right to Know — You may request confirmation of whether we collect or share your consumer health data, and the specific categories collected
Right to Access — You may request a copy of your consumer health data. You can export a health summary PDF from within the app, or contact us for a complete data export
Right to Withdraw Consent — You may withdraw consent for collection of specific categories of health data at any time by removing that data from the app (e.g., deleting medical conditions, removing medications, disabling HealthKit sync)
Right to Delete — You may request deletion of your consumer health data. You can delete individual data items in the app, or delete your entire account (Settings > Delete Account) which permanently removes all data from our servers
Right to Non-Discrimination — We will not discriminate against you for exercising any of these rights. Core safety features (interaction checking, allergen alerts) remain free regardless of your privacy choices

How to Exercise Your Rights

You may exercise your rights in the following ways:

In-App: Remove individual health data items (conditions, medications, allergens, meals, weight entries, glucose readings) at any time through the app's interface
Account Deletion: Settings > Delete Account sends a confirmation email. Upon confirmation, all data is permanently deleted from our servers, including all stored images, cached data, and database records
By Email: Contact support@tachyonhq.ai with subject line "Health Data Privacy Request" for any rights request. We will respond within 30 calendar days.

We will verify your identity before processing a request by confirming your email address associated with your saviMon account.

How We Obtain Consent

saviMon obtains your consent before collecting consumer health data through the following mechanisms:

Account Creation: By creating a saviMon account, you consent to the collection of account and profile information as described in this policy
Voluntary Data Entry: You voluntarily add medical conditions, medications, allergens, meals, weight entries, and glucose readings. You control what data you provide and may remove it at any time
HealthKit / Health Connect Permission: Before reading any health data (steps, calories, glucose) from your device's health platform, the app explicitly requests your permission through the operating system's standard permission dialog. You may revoke this permission at any time in your device settings
AI Feature Consent: Before your first use of AI-powered features (meal photo analysis, MAX chat), a one-time consent alert explains that meal photos or chat text will be processed by OpenAI. You must acknowledge before proceeding
Health Disclaimer: Upon first login, a health disclaimer explains that saviMon is for informational purposes only. You must acknowledge before using the app

You may withdraw consent for any category of health data at any time by removing that data from the app or contacting us.

How We Protect Consumer Health Data

Encryption in Transit: All data transmitted between the app and our servers uses HTTPS/TLS encryption
Access Controls: Consumer health data is accessible only to the authenticated user who created it. No other user can view your health data
Password Security: Passwords are hashed using bcrypt and never stored in plaintext
Secure Device Storage: Authentication tokens are stored in platform-native encrypted storage (iOS Keychain, Android Keystore). Health-sensitive fields (conditions, medications, allergens) are not cached locally on the device
Account Lockout: Progressive lockout after failed login attempts prevents unauthorized access
No Third-Party Analytics: No analytics SDKs or advertising trackers are present in the application, eliminating a common vector for inadvertent health data leakage

Geofencing

saviMon does not use geofencing technology to collect consumer health data. We do not collect health data based on your proximity to any healthcare facility, pharmacy, or other health-related location.

Children's Health Data

saviMon is not intended for use by children under the age of 13. We enforce an age gate at registration that prevents account creation for individuals under 13. We do not knowingly collect consumer health data from children under 13.

Changes to This Policy

We may update this Consumer Health Data Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and notify you within the app. Your continued use of saviMon after changes take effect constitutes acceptance of the revised policy.

saviMon