Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Iris Wellness Inc. (in Japanese, 株式会社 Iris Wellness; “we,” “us,” or “our”) collects, uses, and shares consumer health data in the US English edition of Zutsu Note, our free headache diary app and website (the “Service”).

It is written to meet the Washington My Health My Data Act, Nevada’s consumer health data privacy law, and Connecticut’s consumer health data law. We follow it for all users of the US edition, wherever they live. The one difference is ads: our iPhone and Android apps show ads from Google only to people outside Washington, Nevada, and Connecticut (see section 6). It is part of our Privacy Policy, which has more detail about our practices. Our Terms of Service also apply.

“Consumer health data” means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In Zutsu Note, almost everything you record is consumer health data.

1. Consumer health data we collect

• Headache diary: headache days, pain level, when headaches start and how long they last, where they hurt, symptoms, aura and other warning signs, and your notes.
• Medicines: the medicines you take, their doses and dates, when you took them and how well they worked, preventive medicines, and photos of medicine labels you choose to take (we read the medicine names and don’t store the photo).
• Menstrual and reproductive health: menstrual periods you record, and the menstrual, pregnancy, and hormone status you add in My info.
• Daily life and well-being: sleep, stress, mood, alcohol and caffeine, and how headaches affect your work, school, and daily activities.
• Background health information: height and weight, other health conditions, allergies, family history of headaches, past tests and treatments, smoking, exercise, and sleep habits, and similar information you add in My info.
• Questionnaires and in-app questions: your answers to headache questionnaires (for example, MIDAS) and to short questions about your symptoms and your headache care.
• Health care information: the clinic and doctor you see, whether you are seeing a doctor for your headaches, whether a doctor has diagnosed them, and information a linked clinic adds, such as visit dates, your next appointment, diagnoses, assessment results, and changes to your medicines.
• Data from Apple Health or Health Connect (only if you allow it): steps, sleep, resting heart rate, and heart rate variability.
• Zutsu Post: health information you choose to include in posts, replies, record cards, and your profile, and the Zutsu Friends groups you join (for example, a group for a headache type or a trigger).
• “I have a headache now” taps: the state you choose and the time.
• Location linked to your health records: when location access is on, the approximate location (rounded to about 1 km, or 0.6 miles) saved with diary entries, and your latest approximate location, which we use for pressure alerts. We do not collect your precise location.
• Information we derive: statistics and charts calculated from the information above, such as headache days and medication days each month.

2. Why we collect it and how we use it

• To provide the features you use: your diary, statistics, charts, and file exports; weather and air pressure information and pressure alerts; health sync; reading medicine names from photos; sharing with clinics you link; Zutsu Post; the headache map; reminders; family accounts; and Maple.
• To keep the Service and its users safe: checking Zutsu Post content for abuse and for suicide or self-harm content, handling reports, and preventing misuse and security problems.
• To answer your requests and give you support.
• To improve Zutsu Note: understanding how features are used and fixing problems, using aggregated or de-identified information wherever we can.
• To show public totals on the headache map, which shows by state how many people have a headache right now and never shows individuals.
• For headache research, only if you agree (see section 5): we first remove your name, contact details, ZIP code, date of birth (keeping only your age and sex), clinic and doctor names, and the full text of your notes, and give the data a random ID number. We use this de-identified data for academic research and publications about headache treatment and for evaluating the safety and effectiveness of headache medicines, and we may provide it to other researchers and companies, including for commercial purposes. We require anyone who receives it not to try to re-identify it.
• To comply with the law and protect our legal rights.

We do not use consumer health data for advertising or marketing, and we do not use it to calculate your personal chance of getting a headache or to diagnose you.

3. Where we get it

• From you, when you enter it in the Service.
• From your device and the apps you connect, if you allow it: Apple Health or Health Connect, your device’s approximate location, and photos you choose to take.
• From a clinic you link, which can add information to your account.
• From a parent or guardian who manages your account through family accounts.
• From our own calculations based on the information above.

4. What we share and who receives it

• Clinics you choose to link (health care practices with a Zutsu Note account): your name, date of birth, and sex, diary entries (including notes), medicines and how well they worked, questionnaire scores, My info, and health care information. This lets your clinic see your records and support your care. Data from Apple Health or Health Connect and your Zutsu Post activity are not shared with clinics.
• Other Zutsu Note users: only the health information you choose to post in Zutsu Post, such as posts, record cards, and the Zutsu Friends groups you join.
• People who use your linked family accounts: everything in the linked accounts.
• Government agencies or others, only when the law requires it or when it is needed to protect someone’s life, health, or safety.
• A buyer or successor, if we are involved in a merger or acquisition. They must protect the data as described in this policy.

Service providers (processors). These companies process consumer health data for us under contract, only to provide their services to us:

• Supabase, with Amazon Web Services (Tokyo region, Japan): stores all the categories listed in section 1.
• Vercel and Cloudflare: host the Service and carry information between your device and our database.
• Google (Gemini API): photos of medicine labels, Zutsu Post content that is being checked, and feedback messages we reply to.
• Apple, Google, and web browser push services: the text of push notifications, which may mention health topics such as a pressure alert or a reminder to log your headaches.
• Resend: the emails we send you, which may include reminders about your appointments.
• Sentry: error reports, with personal and health information removed before they are sent.
• Open-Meteo: only rounded coordinates or a ZIP code to look up weather, without any health information or account details.

Affiliates. We do not share consumer health data with any affiliated company.

5. Your consent

• Collecting: When you create an account in the US edition, we ask for your consent to collect and use your consumer health data as described in this policy. This consent is separate from accepting our Terms and Privacy Policy. When a parent or guardian creates a family account for a child, the parent or guardian gives this consent for the child.
• Sharing with a clinic: We share your consumer health data with a clinic only after you choose to link that clinic. Linking is your consent to share the information described in section 4 with that clinic.
• Device data: We read Apple Health or Health Connect data and your device’s location only after you give permission in your device’s settings.
• Research: After you sign up, we ask separately whether you agree to let us use your data for headache research. It is optional, and saying no doesn’t change anything else. If you agree, we use the data only after de-identifying it, as described in section 2. If you delete your account without withdrawing this consent, the de-identified research data stays. You can withdraw this consent at any time in Account, under Research data sharing.
• Withdrawing consent: You can withdraw consent at any time. Unlink a clinic to stop sharing with it. Turn off health data or location access in your device settings. Delete imported health data under Health sync in Account. Or email us. Because Zutsu Note can’t work without your health data, withdrawing your consent to all collection means closing your account and deleting your data, except anything we must keep by law. You can delete your account yourself in Account.

6. What we don’t do

• We do not sell consumer health data.
• We do not use consumer health data for advertising. Our iPhone and Android apps show ads from Google, but not to people in Washington, Nevada, or Connecticut, and we never send diary entries or other health records to advertising companies (see section 6 of our Privacy Policy).
• We do not use geofences. We don’t set up virtual boundaries around health care facilities, or anywhere else, to identify or track you, collect data from you, or send you notifications or ads. Pressure alerts are based on weather changes at your approximate location, not on your location in relation to any place.
• For people in Washington, Nevada, and Connecticut, no third party collects consumer health data about your online activities over time and across different websites or online services through Zutsu Note: we don’t show them ads, and Google Analytics runs only on our public web pages, not in the signed-in app, with Google signals and ad personalization turned off.

7. Your rights

• Confirm and access: ask whether we collect or share your consumer health data, get a copy of it, and get a list of the third parties we have shared it with (such as clinics you linked), with a way to contact them. We don’t sell it to anyone, and we don’t share it with affiliates.
• Delete: ask us to delete your consumer health data. We delete it from our systems and tell our service providers and the third parties we have shared it with (such as clinics you linked) about your request. Copies in backup systems are removed when those backups expire, and no later than 6 months after we verify your request. If we ever restore a backup, we will delete your data again. You can also delete your account yourself in Account.
• Withdraw consent: see section 5.
• Review and correct: see and edit your information in the app, or ask us to correct it.
• Get a portable copy: in the Stats tab, use “Save all logs” to save your diary as an Excel or CSV file, or ask us for a copy.

How to make a request. Email zutsu-note@iris-wellness.jp with “Consumer health data request” in the subject line, from the email address on your account if you have one, and tell us what you would like us to do. You don’t need to create an account to make a request. We may ask you to sign in or to give us a little more information so that we can verify that the request comes from you. We use that information only to verify the request.

Timing and cost. We respond within 45 days of receiving your request. If we need more time, we will tell you why within those 45 days and may take up to 45 more days. Requests are free. We will not treat you differently for using your rights.

Appeals. If we decline your request, you can appeal by replying to our decision with the word “Appeal” and telling us why. We will respond in writing within 45 days and explain what we did or did not do, and why. If we deny your appeal, you can file a complaint with your state attorney general, for example the Washington State Attorney General, the Connecticut Attorney General, or the Nevada Attorney General.

8. How we protect consumer health data

We protect consumer health data with encryption, access controls, and the other measures described in section 10 of our Privacy Policy. Only people who need access to run the Service can access consumer health data, and they must keep it confidential.

9. How long we keep it

We keep consumer health data while you have an account and delete it when you delete your account, as described in section 9 of our Privacy Policy.

10. HIPAA

Iris Wellness is not acting as a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA) when it provides this consumer app. When you choose to share your records with a clinic, the clinic’s own legal obligations, which may include HIPAA, apply to the information the clinic receives and keeps.

11. Changes to this policy

We will post any changes here with a new effective date. If we make material changes, we will tell you in the app or by email before they take effect, and we will ask for your consent before we collect, use, or share consumer health data in a new way.

12. Contact us

If you have questions about this policy or your consumer health data, please contact us.