Consumer Health Data Privacy Policy
1. Purpose of this policy
This policy describes how SunGuard handles "consumer health data" as defined by the Washington My Health My Data Act and comparable state laws. It applies to Washington residents and to others whose consumer health data may be collected or processed in Washington. It supplements, and does not replace, our general Privacy Policy.
2. SunGuard's privacy-first design
SunGuard is built so that your skin photos and the analysis of them are processed on your device and are never transmitted to us. We do not receive, store, or have access to your images. This structure means the most sensitive information stays in your hands, not ours.
3. Categories of consumer health data
To the extent the following is treated as consumer health data, we identify it here:
- On your device only (not collected by us): images you capture, and skin-related insights derived from them (for example, skin type or sun-sensitivity information). This data remains on your device.
- Data we may handle: information you choose to provide, such as skin-type or sun-sensitivity preferences you enter, and location data used solely to retrieve the local UV index.
We do not collect health data beyond what is necessary to provide the features you request, unless you give us consent.
4. How and why we collect it
We collect the limited data above only to provide the features you ask for: showing your local UV index, and giving you the on-device skin and sun insights that are the purpose of the app. We do not use consumer health data for advertising or profiling unrelated to providing the service.
5. Sources
The data comes directly from you and from your device (for example, the camera and, with your permission, device location).
6. Sharing of consumer health data
We do not sell consumer health data, and we do not share it except with service providers acting on our behalf and only as necessary to provide the app. The categories of recipients are:
- Open-Meteo (UV and weather data provider): receives location coordinates only, to return the local UV index.
- RevenueCat (subscription provider) and the app stores: for managing your subscription (this is generally not health data).
We will not share consumer health data for any purpose that is not necessary to provide a product or service you have requested without first obtaining your separate consent. We do not provide consumer health data to data brokers.
7. Your rights
If you are a Washington resident (or otherwise covered), you have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
- Withdraw consent to our collection and sharing of your consumer health data.
- Delete your consumer health data. Upon a verified request, we will delete the consumer health data we hold and direct our service providers to do the same. (Data stored only on your device is deleted by you, by removing it in the app or deleting the app.)
You will not be discriminated against for exercising these rights.
8. How to exercise your rights
Submit a request to healthprivacy@sunguard.app. We will verify your request and respond within the timeframe required by law (generally 45 days, extendable once where permitted). You may appeal a denial by submitting the appeal to privacy@sunguard.app, you may also contact the Washington Attorney General.
9. Consent and authorization
Where the law requires consent for collection, and separate consent for any sharing that is not necessary to provide a requested feature, we will obtain that consent before the relevant activity, and our consent requests will be clear and unbundled.
10. Data security
We maintain reasonable administrative, technical, and physical safeguards appropriate to the limited consumer health data we handle. Keeping images on your device is itself a core safeguard.
11. Changes
We may update this policy and will post the updated version with a new effective date, linked from our homepage.