Consumer Health Data Privacy Policy

Last updated October 29, 2026.

This policy covers consumer health data: information that identifies or could reasonably be linked to you and describes your past, present or future physical or mental health. It applies to everyone, including residents of Washington and Nevada. Our general Privacy Policy covers everything else.

We never sell your consumer health data, and we never use it for advertising.

The consumer health data we collect

Health conditions, symptoms, diagnoses and treatment, including how a treatment is working.
Medicines and supplements, and answers about whether you’re taking them and any side effects.
Measurements: blood pressure, weight, height, waist, and the activity and sleep your devices record.
Lab results, vaccines and screening dates, from reports you upload, what you enter, or your patient portal if you connect it.
Family health history, and genetic test results you add (the genes tested and any changes found). We don’t accept raw DNA files.
Answers to the yearly mood check and alcohol check, sleep questions, and whether you’re pregnant or planning a pregnancy.
Notes and questions you write, which may describe your health.
Inferences we draw from the above: your score, risk estimates, and which next steps apply to you.
The same kinds of information about family members whose profiles you manage.

Where it comes from

From you, from the family members who share a profile with you, from the patient portal you connect (read-only, with your authorization there), from the lab when you order a test through us, and from the devices you connect (Oura, Whoop, Fitbit or Pixel Watch through Google, Withings). We don’t buy health data and we don’t collect it from other sources.

Why we collect and use it

To calculate scores, show next steps and their sources, send the reminders and check-ins you choose, and answer the questions you ask in the app.
To read the reports you upload and the history you type, using an AI service provider.
To keep the service secure, fix problems, and meet legal duties.
For health research, only if you opt in separately, after removing your name and contact details.

We collect and use it only with your consent, given at sign-up separately from our Terms, or as needed to provide what you ask for. We don’t use it for advertising, we don’t sell it, and we don’t use location to track anyone.

Who receives it

We share consumer health data only:

With service providers that process it for us under contract, only to run the service: Vercel (hosting), Neon (database), Anthropic (AI that reads reports and answers questions; it doesn’t use your data to train its models), Resend (email), Twilio (texts, if you turn them on; texts never name private topics), and Stripe (payments; it receives your name, email and the amount, not test names or other health data).
With people you choose, with your separate consent: another account you share your profile with, or a doctor you send a read-only link.
With research partners, only if you opt in to research, and only with your name, contact details and other direct identifiers removed. We’ll name each partner here before any data is shared with them. Today there are none.
Not with labs you go to on your own. When you choose a partner lab through Get my labs, we send you to its site. We don’t send it your health information; it handles your order and results under its own terms.
When the law requires it, such as a valid court order. If anyone asks us for your information, including a subpoena or warrant, we’ll tell you before we respond, unless the law forbids it, so you can object. We’ll challenge requests that are overbroad or that seek reproductive or other sensitive health information where the law allows, and we’ll disclose only what we’re legally required to.

We have no affiliates that receive consumer health data.

Your rights

Know and access: confirm whether we collect, share or sell your consumer health data, get a copy, and get a list of every third party and affiliate it was shared with or sold to, with how to contact them. (We don’t sell it.)
Withdraw consent to collection or sharing at any time, in Settings.
Delete your consumer health data, from Settings or by asking us. Deleting removes it from our database right away. We then ask each service provider and third party that received it to delete their copies, as our contracts with them require, and database backups roll off within 30 days. A lab that ran a test you ordered may have to keep its own record by law.
Correct anything that’s wrong, in the app or by asking us.

You don’t need an account to make a request: email hello@checkupscore.com with “Health data request” in the subject. We’ll confirm it’s you, then respond within 45 days. If we need more time, we’ll tell you within those 45 days and finish within 45 more. Requests are free, up to twice a year.

Appeals

If we decline any part of a request, you can appeal by replying to our answer or emailing hello@checkupscore.com with “Appeal” in the subject. We’ll respond in writing within 45 days, explaining what we did and why. If we deny the appeal, you can contact your state attorney general: in Washington, atg.wa.gov/file-complaint; in Nevada, ag.nv.gov.

Changes

If we want to collect a new kind of consumer health data, use it for a new purpose, or share it with a new kind of recipient, we’ll update this policy first and ask for your consent before doing it. We’ll never apply a change to data we already have without it.

Contact

Questions about this page, your data or your account? Email hello@checkupscore.com. A person reads every message.