Consumer Health Data Privacy Notice
Last updated 1 August 2026
Washington's My Health My Data Act requires a notice like this one, kept separate from our general Privacy Policy, covering exactly what we do with data that reveals something about your health. Rather than build one version for Washington and a different standard for everyone else, we give every Nularo user, in every state, the same disclosures and the same rights described here.
This page is a supplement to our Privacy Policy, not a replacement for it. Where they overlap, this page has the specific detail; the main policy has everything else, including how purchases and notifications work.
What counts as "consumer health data" here
The legal definition is broad: any data linked to you that reveals something about your physical or mental health, including data a computer inferred from other information. Under that definition, this is what Nularo has:
- Sleep, movement, and heart data read from Apple Health: sleep analysis, steps, workouts, resting heart rate, heart rate variability.
- A mood label ("glowing," "judgy," "wrecked," "suspicious"), computed on your device from the data above.
- A "Creature Age," computed on your device from your habits compared against published public health guidelines.
- What you type yourself: journal notes, hydration counts, a bedtime pledge, and any "confessions" you choose to log (caffeine, alcohol, screens, a late meal, a nap).
Where it comes from
Everything above comes from one of two places: Apple Health, read only with your explicit permission granted in Apple's own permission screen, or your own typed input inside the app. We do not buy, license, or receive health data about you from any outside source.
Why we collect it
To run the app: to react to how you slept and moved, to calculate your Creature Age, and, if you create an account, to let your history and journal survive a reinstall or a new phone.
Who we share it with
We never sell consumer health data, to anyone, for any amount. We never share it for advertising or marketing. The only two places any of it goes:
- Supabase, our backend and database provider, which stores your account, your verdict archive, and your journal entries under our instructions and under contract. Supabase does not use this data for its own purposes.
- Google, through the paid tier of its Gemini API, which receives a small set of numbers once a day (a mood label, minutes slept, step count, resting heart rate) to write one sentence. Google's terms for that paid tier state it is not used to train Google's models and is retained only briefly, to detect abuse of the API. Google never receives your name, your typed journal entries, or your raw Apple Health history, only that single day's numbers.
Neither company receives anything for its own marketing or advertising.
Your rights over this data
- Confirm and access: ask us whether we are processing your consumer health data and see what we have, by emailing us.
- Withdraw consent: revoke Nularo's access to Apple Health at any time in the Health app, and stop typing things into your journal. We stop collecting whatever you cut off, immediately.
- Delete it: delete your account from inside the app (Account → Delete account) for an immediate, permanent deletion, or email us if you can't use the app, which takes up to 30 days. Either way, everything backed up to your account is erased for good. What is already on your phone is removed when you delete the app itself.
- Appeal: if you think we got a request above wrong, email us and we will respond within 30 days.
To use any of these rights, email sidewndrstudios@gmail.com from the address on your account. There is no charge, and we will not ask you to create a new account to submit a request.
Geofencing
We do not collect your location, and we have never used geofencing (detecting when someone is physically near a clinic, hospital, or other health facility) for any purpose. Washington law specifically bans this practice; we simply do not do it, for anyone.