washington and nevada consumer health data privacy policy

Health data we collect and how we use it

• Health data you record: measurements, vital signs, symptoms, medications, diet and food intake, sleep, reproductive or sexual health information, notes, stream names, and any other health information you choose to record.
• Wearable data: heart rate, heart rate variability, recovery, sleep and other data sent by devices you connect.
• Calculated data: values Traceroute derives from the above.
• Data linked to your record: your account identifier and email address, sign-in records (IP address and time), and usage data (how often you log, view dashboards and share).

We use it to store your record and provide it to you, your AI agent, and people you share it with; to secure the service, investigate incidents and send breach notices; and to improve the service, using usage data only. We do not inspect or analyze the contents of your record.

Sources

• You, directly or through your AI agent.
• Devices you connect.
• Your sign-in provider (Google; Apple when it is offered).
• Traceroute, which calculates derived values and records sign-ins and usage.

Health data we share

• Any health data your AI agent reads or writes.
• The streams, titles and daily values on pages you publish or dashboards you give others access to.

Third parties and affiliates we share it with

• The provider of the AI agent you connect, such as OpenAI for ChatGPT or Anthropic for Claude.
• Anyone with the link to a page you publish, and people you give access.

Traceroute has no affiliates.

Purposes

We collect, use and share consumer health data only to provide the service you ask for: keeping your record and making it available to you, your AI agent and people you share it with. We also use it to secure the service and notify you of breaches, and we use usage data, which never includes your record's contents, to improve the service. We do not sell consumer health data.

How we process it

Your record is stored and displayed, and derived values are calculated from it. We do not inspect, analyze or profile its contents. Data is encrypted in transit, and backups are encrypted at rest. Hosting, network, backup storage and email delivery providers process it on our behalf.

Your rights and how to use them

• Confirm and access: whether we collect, share or sell your consumer health data, a copy of it, and a list of every third party and affiliate it has been shared with or sold to, with an email address or online contact for each.
• Withdraw consent: remove the Traceroute connector from your AI agent, or delete your record.
• Delete: your record is removed from live systems within 24 hours and from backups within 30 days, and we pass the request on to anyone we shared it with, as the law requires.

Make a request through your AI agent or the app, by email to privacy@traceroutehealth.com, or with the contact form. We may verify it through your existing account. We respond within 45 days, and may extend that once by 45 days if we tell you. Requests are free up to twice a year.

If we deny a request, you can appeal by replying to our decision. We answer appeals in writing within 45 days, with our reasons. If we deny an appeal, you can file a complaint with the Washington State Attorney General or the Nevada Attorney General.

Reviewing and correcting your data

You can review your record at any time through your AI agent or the app, and correct any reading. Corrections keep the earlier value in your record's history until the record is deleted.

Changes to this policy

We notify you by email before a material change takes effect. We do not collect additional categories of consumer health data, share it with additional categories of third parties, or use it for additional purposes without telling you first and getting your consent.

Tracking across sites

No third party collects consumer health data about you over time and across websites or online services when you use Traceroute.