Consumer Health Data Privacy Policy

Effective date: May 11, 2026

Last updated: May 11, 2026

This policy explains how we handle the optional pregnancy stage field on the signup form at tellsophie.com. The field is the only consumer health data the marketing website collects.

This policy applies in addition to our Privacy Policy. Where the two conflict on consumer health data, this policy governs.

What this policy covers

The marketing website asks one optional question that is treated as consumer health data under several state laws:

What stage of pregnancy or parenthood are you in?

You can complete signup without answering. This policy applies whenever you do answer.

What "consumer health data" means

Consumer health data is information that identifies a person's past, present, or future physical or mental health status. The relevant laws are:

• Washington's My Health My Data Act (House Bill 1155, 2023), codified at Revised Code of Washington Chapter 19.373.
• Connecticut's consumer health data provisions, added to the Connecticut Data Privacy Act by Public Act 23-56 (effective October 1, 2023), codified within Connecticut General Statutes Chapter 743dd.
• Nevada Senate Bill 370 (2023), the Consumer Health Data Privacy Law, codified at Nevada Revised Statutes Chapter 603A (sections 603A.400–603A.470), effective March 31, 2024.

Pregnancy stage qualifies as consumer health data under all three.

Why we collect it

To inform our work on the iOS application's launch sequence and the prompts the application will generate for users at different life stages. We use it as aggregate signal across the list, not as a profile of you specifically.

We do not contact you differently based on your answer. We do not "sell" consumer health data as that term is defined in RCW 19.373.030, and we do not "share" it for cross-context behavioral advertising. We do not transfer this data to anyone outside the service providers listed in our Privacy Policy. We do not use it for advertising of any kind. We do not use it to make any decision specific to you.

Authorized persons

The following internal roles are authorized to access consumer health data:

• The founder.
• Engineers performing migrations or troubleshooting that requires database access.

Production database access is restricted by Supabase role-based access controls and recorded in Supabase's audit logs. No vendor, contractor, or third party has access to consumer health data outside the service providers listed in the Privacy Policy. Each of those providers is bound by a written data processing agreement that prohibits use of the data for any purpose other than providing the service to us.

How we protect it

• Encrypted at rest using the Advanced Encryption Standard at 256-bit key length (AES-256).
• Encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3).
• Access is limited to the authorized persons listed above and is recorded in Supabase audit logs.
• Stored in the United States only.

Your rights specifically as to consumer health data

You can:

• Confirm whether we have any consumer health data about you.
• Get a list of who we've shared it with. We do not share it with anyone outside our listed service providers, but you have the right to ask.
• Have it deleted. This includes from any backups, within the deletion timelines in our backup retention.
• Withdraw consent. If you provided pregnancy stage and want to revoke that consent, we will delete the field from your record without affecting your signup status. Email privacy@tellsophie.com.

Washington residents have the right to appeal a denial of any of the above rights. The appeal goes to privacy@tellsophie.com with the subject line "Appeal." If we deny the appeal, the Washington Attorney General's office can be contacted at https://www.atg.wa.gov/file-complaint.

Effective consent

By submitting the optional pregnancy stage field, you consent to the collection and the limited use described in this policy. This consent is separate from, and not a condition of, your signup. You can withdraw it at any time. Withdrawal removes the field from your record but does not remove you from the signup list.

Because we do not sell or share consumer health data, we do not seek a separate written authorization of the kind described in RCW 19.373.040. Your consent under this policy is to collection and the limited internal use described above. If we ever propose to sell or share consumer health data, we would seek your explicit written authorization first and would update this policy before the change took effect.

Geographic application

This policy applies to all users who provide pregnancy stage information, regardless of state of residence. The legal protections under Washington, Connecticut, and Nevada law apply specifically to residents of those states. We apply the same policy to everyone.

Changes to this policy

If we change this policy in a way that affects how we treat consumer health data we already have, we will email everyone on file before the change takes effect, give you the opportunity to withdraw consent, and proceed only with affirmative re-consent.

Contact

privacy@tellsophie.com.