Consumer Health Data Privacy Policy
Draft for legal review.
This policy supplements our Privacy Policy and explains how Miguel Ridruejo Mendoza (“Otilie”) handles “consumer health data” as defined by the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 (NRS 603A) and the Connecticut Data Privacy Act.
Consumer health data we collect
- Skin measurements: estimated scores for redness, blemishes, texture, dark spots, fine lines and under-eyes, and the light conditions of each scan.
- Skin profile: your goals, skin type, how often your skin reacts to new products, ingredients you avoid and your age range.
- Routine and products: the products you use, when you use them, and whether an experiment with a product worked.
- Life events you log: for example stress, poor sleep, sun, travel, a breakout or your period.
- AI coach conversations (when available), which may describe your skin or health.
Not collected: your face photos and the face outline used to line up scans. They're processed and stored on your device and are never sent to us or to anyone we work with; only if you turn on Keep a copy in iCloud Backup are they also in your own iCloud Backup, which Apple stores for you and we never receive. We don't collect precise location and don't use geofencing.
Where it comes from
From you, through the app. Scores are computed on your device from your scans.
Why we use it
Only to provide the features you use: showing your progress, building your routine, judging experiments, backing up and syncing your data to your account, and (if you turn it on) answering your questions in the AI coach. We don't use it for advertising, marketing or to train AI models.
Consent
Consumer health data stays on your device unless you give separate, specific consent: one to store it in your account, and another to use the AI coach. You can withdraw either at any time in the app (Profile → Privacy & data). Separately, you can choose to keep a copy of the app's data in your own iCloud Backup (off unless you turn it on, same place); Apple stores it for you and we never receive it.
Who we share it with
We don't sell consumer health data. We share it only with service providers that process it on our behalf to run Otilie, under contracts that limit them to that purpose: Supabase (database), RevenueCat (subscription status only) and, if you use the coach, Anthropic (AI replies). See the full list in our Privacy Policy. We may also disclose it when required by law.
Your rights
You can confirm whether we process your consumer health data, access it, get a list of the third parties and affiliates it was shared with, withdraw consent, and have it deleted — including from backups. Most of this is available in the app (Export my data, Delete all my data). You can also email privacy@otilie.app. We respond within 45 days (extendable once by 45 days when reasonably necessary, with notice).
Appeals. If we decline your request, you can appeal by replying to our decision or writing to privacy@otilie.app with “Appeal” in the subject. We'll answer within 45 days. If you're not satisfied, you can contact the Washington Attorney General at atg.wa.gov (or your state's Attorney General).