Consumer Health Data Privacy Policy

1. What this policy is for

Some US states have laws about "consumer health data". This means information that is linked, or could be linked, to a person and says something about their physical or mental health. Washington's My Health My Data Act is one of these laws. Nevada and Connecticut have similar laws.

We follow this policy for everyone who uses ThoughtCheck, wherever they live. ThoughtCheck doesn't check where you are.

ThoughtCheck is run by Lunar Web Studio, LLC, doing business as ThoughtCheck. "We", "us" and "our" mean Lunar Web Studio, LLC. This policy adds to our privacy policy. If they differ about consumer health data, this policy applies.

2. What you write in the app

The thoughts, feelings, ratings, check-ins, cards and notes you enter in the ThoughtCheck app are saved only on your device: in the web app, in your browser's storage, and in the iPhone and Android apps, inside the app. ThoughtCheck doesn't send them to us or to anyone else. We have no copy of them, so we don't collect them.

You can delete them yourself in the app, in Settings > Delete everything.

3. Health data we may collect, and where it comes from

Because ThoughtCheck is about thoughts and feelings, the fact that you use it, or asked to hear about it, could say something about your mental health. So we treat these as consumer health data:

• Sign-ups for updates. Your email address, if you sign up for updates on our website. It comes from you.
• ThoughtCheck Plus sign-in. If you turn on Plus with a code or sign in, the email address you type and the code you used. It comes from you. We keep only a scrambled form of your email address and code, when your Plus ends, and a random number for each device you're signed in on.
• Purchases in the phone apps. If you buy Plus in the iPhone or Android app, a record of what you bought and when, linked to a random ID made for ThoughtCheck (not your name or email address). It comes from Apple or Google, through RevenueCat.
• Visits to our website and web app. Our web host's standard server logs: your IP address, your browser type, the page you asked for, and the time. They come from your browser when it loads our pages.
• Emails you send us. Your email address and whatever you write. It comes from you.

The forms for therapists and clinics ask for work details, not health details. Please don't send us client names or anything about anyone's health.

4. Why we collect it and how we use it

• To send you the updates you asked for.
• To email you a number when you sign in, and to turn on ThoughtCheck Plus on your devices.
• To know whether you bought Plus, to restore a purchase, and to keep records for tax and accounting.
• To run our website and keep it secure.
• To reply to you.

We don't use it for anything else. We don't use it for ads, and we don't sell it.

5. Asking for your OK

We ask for your OK before we collect consumer health data, except when we need it to give you something you asked for:

• The form for updates has a box to tick. We don't take your email address without it.
• Signing in to ThoughtCheck Plus has a box to tick. We don't send your email address to our server without it.
• Server logs and purchase records are needed to show you our pages and to sell you Plus, so they are collected when you do those things.

You can take back your OK at any time. Unsubscribe from updates with the link in any email, delete your email from ThoughtCheck in the app's Settings, or email us. When you do, we stop collecting it and delete what we have, unless the law says we must keep it (for example, purchase records for tax).

We never sell consumer health data. If we ever wanted to share it for any reason not listed here, we would ask for your separate OK first.

6. Who we share it with

We share consumer health data only with companies that help us run ThoughtCheck. They may use it only to provide their service to us:

• Netlify, our web host. It runs our website, our server and our forms, and keeps the server logs.
• Resend, our email provider. It sends the sign-in emails for ThoughtCheck Plus.
• RevenueCat, which keeps track of purchases in the phone apps.
• Apple and Google, which handle purchases in their app stores.

We may also share it if the law requires it (such as a valid court order), to protect someone's safety, or to stop fraud or abuse. If Lunar Web Studio, LLC or ThoughtCheck is sold or merged, the new owner would have to follow this policy for the data we already have.

We have no affiliates that receive consumer health data. If a therapist or clinic gave you a code, we don't tell them whether or when you used it, and they can't see your checks through us.

We don't set up "geofences" (virtual boundaries) around places where people get health care, and we don't track where you are.

7. Your rights

You can ask us to:

• tell you whether we collect, share or sell your consumer health data (we never sell it),
• give you a copy of the consumer health data we have about you,
• give you a list of every company we shared it with, with how to contact them,
• take back your OK,
• delete your consumer health data. We also tell the companies we shared it with to delete it.

Email hello@thoughtcheck.app with your request. We may need to check that the request comes from you. We answer within 45 days. If we need more time, we tell you why, and we answer within 45 more days at the most. Asking is free, up to twice a year. We won't treat you differently for asking.

Appeals. If we say no to a request, you can ask us to look at it again. Reply to our answer with the word "Appeal", or email us. We answer within 45 days and explain our decision. If you still disagree, you can contact your state's attorney general. In Washington, that is the Washington State Attorney General's Office (atg.wa.gov/file-complaint).

We don't hold what you write in the app, so we can't show or delete it for you. You can delete it yourself in the app's Settings.

8. How long we keep it, and how we protect it

We keep update sign-ups until you unsubscribe or ask us to delete them. We keep Plus sign-in records while you have Plus, and delete them when you delete your email from ThoughtCheck. We keep purchase records as long as the law requires for tax and accounting. Netlify keeps server logs for a short time.

Our website and apps use HTTPS. We limit who can see form sign-ups and emails, and our server keeps email addresses and codes only in a scrambled form.

9. People under 18

ThoughtCheck is for people 18 and older. The app asks you to tap "I'm 18 or older" before you start. We don't knowingly collect consumer health data from anyone under 18. If you think someone under 18 has sent us information, email us and we'll delete it.

10. Changes and contact

If we change this policy, we'll update the date at the top. If we want to collect or share consumer health data in a new way, we'll ask for your OK first.

Lunar Web Studio, LLC, dba ThoughtCheck
Email: hello@thoughtcheck.app

See also our privacy policy and terms of use.