Privacy Policy

This Privacy Policy explains how Iris Wellness Inc. (in Japanese, 株式会社 Iris Wellness; “Iris Wellness,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in the English edition of Zutsu Note. Zutsu Note is a free headache diary. The Service includes our iPhone and Android apps and our website (together, the “Service”). Iris Wellness is a company based in Tokyo, Japan.

Because Zutsu Note is about your health, we also publish a Consumer Health Data Privacy Policy. It explains how we handle health information in the way required by the Washington My Health My Data Act and similar laws in Nevada and Connecticut, and it is part of this Privacy Policy. Our Terms of Service also apply.

This policy applies to the English edition, for people who live in the United States, Canada, Australia, or New Zealand. If you use the Japanese edition of Zutsu Note, the Japanese privacy policy applies instead.

1. Who is responsible for your information

Iris Wellness Inc. provides the Service and is responsible for the personal information described in this policy. Our representative director is Hirotaka Maekawa, MD. You can reach us at zutsu-note@iris-wellness.jp. Our full contact details are in section 17.

2. Information we collect

We collect what we need to run Zutsu Note. Most of it is information you choose to enter.

2.1 Information you give us

• Account information. Your name, email address, password, date of birth, and sex. If you choose, your ZIP code or postal code and the clinic and doctor you see. Your password is stored only in hashed (scrambled) form by our sign-in provider. We use your date of birth to check that you are old enough to create an account.
• Diary entries. Whether you had a headache, how strong the pain was, when it started and how long it lasted, where it hurt, other symptoms, aura and other warning signs, the medicines you took, when you took them, and how well they worked, preventive medicines, menstrual periods, sleep, stress, mood, alcohol and caffeine, how headaches affected your work, school, and daily life, and any notes you write.
• Your medicine list. The names, doses, and start and end dates of the medicines you add.
• My info (optional). Background information you choose to add, such as your work or school situation, height and weight, when your headaches began, family history of headaches, other health conditions, allergies, past tests and treatments, menstrual, pregnancy, and hormone status, smoking, alcohol, caffeine, exercise and sleep habits, and who you live with. This also includes your answers about headache care, such as whether you see a doctor for your headaches and whether a doctor has diagnosed them.
• Questionnaires and in-app questions. Your answers to headache questionnaires you choose to complete (for example, MIDAS), and to short questions in the app, such as a few questions about your headache symptoms or whether you have seen a health care provider for headaches in the past 3 months.
• Zutsu Post. Your nickname, profile bio, and profile picture (if you add one), and the posts, replies, images, polls, hashtags, and mentions you write. Also your likes, reposts, bookmarks, and follows, the Zutsu Friends groups you join, the record cards you choose to attach to posts, the posts you report, and the people you block. We also record which posts you view so that we can count views.
• Photos of medicine labels. If you add medicines by taking a photo, the photo you take (see section 5 for how it is processed).
• Messages to us. What you write in the in-app feedback form, in emails to us, or in our business inquiry form.
• Family accounts. If you create an account for a family member, the information you enter for them (see section 12).
• “I have a headache now.” If you tap this button on our public headache map, the state you choose and the time. If you are signed in, we link the tap to your account. To avoid counting the same person twice, we also keep a hashed (scrambled) form of your IP address and a random ID saved in your browser.

2.2 Information from your device

• Approximate location (only if you allow it). When you allow location access, the app rounds your device’s location to about 1 km (about 0.6 miles) before sending it to us, so we never receive your precise location. We use it to show the weather and air pressure forecast where you are, to add weather information to diary entries you save (we store the rounded location with that entry), to decide when to send pressure alerts, and to find which state you are in for Zutsu Post and the headache map. For pressure alerts we keep only the most recent rounded location and the time we received it, and we replace it each time a new one arrives. If it is more than 7 days old, we use your ZIP code or postal code instead.
• ZIP code or postal code. If you enter one, we use it for forecasts and pressure alerts when we don’t have a recent location, and in the United States to find your state. We look up Canadian, Australian, and New Zealand postal codes on our own servers, so they are not sent to our weather data provider.
• Health data from Apple Health or Health Connect (only if you allow it). In our iPhone and Android apps you can import step counts, sleep (including sleep stages, when available, and the times you slept), resting heart rate, and heart rate variability. We also store the name of the app that recorded the data and the type of device (for example, watch or phone), but not the name of your device. You choose which types to allow in your phone’s settings.
• Device and technical information. Your device type, operating system, app version, browser type, language and time zone, IP address, and the tokens needed to send you push notifications. Our hosting, network, and database providers record IP addresses and similar technical details in their logs for security.
• Usage information. Which features you use, which in-app messages you see, tap, or close, whether you have allowed location access, when you sign in, and error reports when something goes wrong.
• How you found us. If you arrive from another website or from a link with campaign tags, we save that information (for example, the referring website and the first page you visited) in a cookie for up to 30 days, and store it with your account if you sign up. The app may also ask you how you heard about Zutsu Note.

2.3 Information from others

• Your clinic. If you link a clinic, its staff can add information to your account, such as visit dates, your next appointment, diagnoses, assessment results, and changes to your medicine list.
• A parent or guardian who creates or manages your account through family accounts.
• Weather services that give us weather and air pressure data for your area.

2.4 Information we create

• Statistics and charts calculated from your entries, such as your number of headache days and medication days each month.
• Weather and air pressure data added to your diary entries.
• When you post in Zutsu Post with your state shown, the air pressure trend in that state at that time. We store this but do not show it.
• A history of changes to your diary entries and to some account information (what changed and when). We keep it so your records stay accurate. You do not see this history in the app, and it is deleted when you delete your account.

2.5 Clinic accounts

If you register Zutsu Note for a clinic, we collect your name, email address, and password, information about your clinic and its staff, and any information you choose to publish in our clinic directory.

3. How we use information

We use personal information to:

• provide the Service: keep your diary, calculate statistics, draw charts, let you save your records as a file, and run your account;
• show weather and air pressure forecasts, add weather to your charts and diary, and send the pressure alerts you turn on;
• show health data you import next to your headache records;
• read medicine names from photos you choose to take;
• share your records with clinics you link, and show you the information they add;
• run Zutsu Post: show posts, send notifications about replies and other activity, check posts for abuse and for suicide or self-harm content, handle reports, and keep people who block each other apart;
• show our public headache map, which counts, by state, how many people have a headache right now, using “I have a headache now” taps and diary entries from people in the United States who use the English edition. The map shows totals only, never individuals;
• send notifications and emails you ask for or that relate to your account, such as pressure alerts, diary and appointment reminders, password resets, and confirmation that your account was deleted;
• run Maple, Maple points, and other in-app game features;
• support family accounts;
• answer your messages and requests;
• keep the Service safe and secure, prevent spam and misuse, and enforce our Terms;
• show ads in our iPhone and Android apps (see section 6);
• if you agree, use your records for headache research after removing anything that identifies you (see section 8);
• understand how the Service is used, and fix and improve it; and
• comply with the law and protect our legal rights.

We do not:

• sell your diary entries, medicines, or other health information;
• send your health information to advertising companies, or use it to choose the ads you see;
• use your health information to decide what promotions or marketing to send you; or
• analyze your records to calculate your personal chance of getting a headache, or to diagnose you.

4. How we share information

4.1 Clinics you choose to link

Linking a clinic is your choice. You link a clinic yourself, by scanning its QR code or by choosing it in the app.

A linked clinic can see your name, date of birth, and sex, your diary entries (including your notes), your medicines and how well they worked, your questionnaire scores, the information in My info, and anything the clinic adds. Clinic staff can add information to your account and can download your records, for example as a spreadsheet. Health data imported from Apple Health or Health Connect and your Zutsu Post activity are not shown to clinics.

You can unlink a clinic at any time in Account. After you unlink, the clinic can no longer see your records in Zutsu Note. Information the clinic has already copied into its own records or downloaded is under the clinic’s control, and we can’t delete it. To ask about that information, contact the clinic directly.

We don’t recommend any clinic, and we aren’t responsible for the care a clinic provides or for how it handles the information it keeps.

4.2 Other Zutsu Note users

What you post in Zutsu Post can be seen by other people signed in to Zutsu Note. This includes your nickname, profile bio and picture, posts, replies, images, polls, record cards, the Zutsu Friends groups you join (they appear on your profile), and activity such as likes and reposts. Your real name and email address are never shown. Zutsu Post can’t be seen on the public web without signing in.

Your state is shown next to your nickname on your posts, and your posts appear in lists of posts from your state, unless you turn this off in your Zutsu Post profile. Your city and exact location are never shown. A record card shows a summary of that day’s diary entry, such as the pain level and how long a headache lasted. It does not show medicine names.

4.3 Linked family accounts

If you link accounts as family accounts, anyone signed in to one of the linked accounts can switch to the others and see and change their information. Link only the accounts of people you trust. You can unlink accounts at any time.

4.4 Service providers

We use other companies to help us run the Service. They process personal information on our behalf and only to provide their services to us. The main ones are listed in section 5. Google AdMob and the ad networks that serve ads through it, which show the ads in our apps, may also use the information they receive for their own advertising purposes, as described in section 6.

4.5 Legal requirements and safety

We may disclose information if we believe in good faith that the law requires it, for example to respond to a court order or other valid legal process, or if it is necessary to protect someone’s life, health, or safety, or the rights, property, or security of our users, the public, or Iris Wellness. When the law allows, we will try to tell you before we disclose your information in response to a request from a government agency.

4.6 Business transfers

If Iris Wellness is involved in a merger, acquisition, or sale of all or part of its business, your information may be transferred as part of that deal. The new owner must continue to protect it as described in this policy, and we will tell you before your information becomes subject to a different privacy policy.

4.7 With your consent

We may share information in other ways if you ask us to or agree to it.

5. Service providers we use

• Supabase (database and sign-in). Your account information and records are stored on Amazon Web Services servers in the Tokyo region, Japan.
• Vercel (hosting the app and website, United States).
• Cloudflare (network security, delivery, and measuring website performance).
• Resend (sending emails).
• Apple Push Notification service, Google Firebase Cloud Messaging, and your web browser’s push service (delivering push notifications). They receive a device token and the notification we send.
• Google, through the Gemini API, for three tasks: reading medicine names from photos you take; checking Zutsu Post posts, replies, poll options, nicknames, profile bios, and images in posts for abuse and for suicide or self-harm content before they are published; and helping us draft replies to feedback you send us, which involves sending your message and the name on your account. We send only the content needed for each task, never your diary. A photo is sent as you took it. Pharmacy labels often show your name, your doctor, and your pharmacy, so cover anything you don’t want to send before you take the photo. We don’t store the photo after the medicine names are read. Under Google’s terms for the paid Gemini API, Google does not use this content to improve its products, but it may keep it for a limited time to detect misuse.
• Open-Meteo (weather data). It receives only rounded coordinates or a US ZIP code, never your name or account details.
• Sentry (error monitoring). Error reports include technical details and a random user ID. Before reports are sent, we remove fields that may contain personal or health information.
• RevenueCat (managing app store purchases). Our iPhone and Android apps connect to RevenueCat using a random user ID, not your name or email address, to check purchase status.
• Google Analytics (statistics about visits to our public web pages; see section 6).
• Google AdMob (ads in our iPhone and Android apps; see section 6). Ads may also come from ad networks that work through AdMob, such as Pangle.
• Google Maps (maps on clinic pages). Google receives your IP address and browser information when a map loads.

Payments. The Service is free. If we offer an optional paid feature or a way to support us and you choose to pay, Stripe (on the web) or Apple or Google (in the apps) processes the payment. We don’t receive or store your full card number.

6. Cookies, analytics, and tracking

• Necessary cookies and local storage. We use cookies and similar storage to keep you signed in, remember your language, country, and settings, record how you arrived at our website (for up to 30 days), and store preferences and recent forecasts on your device. If someone enters a date of birth under 13 when trying to sign up, we save a cookie on that device for one day to prevent repeated attempts with a different date.
• Google Analytics on public pages only. We use Google Analytics on our public web pages, such as the home page, guides, and pressure forecast pages, to count visits and see which pages are used. It does not run inside the signed-in app (your diary, Account, or Zutsu Post) or on the sign-in and sign-up screens. We have turned off Google signals and ad personalization. Google Analytics uses cookies and receives your IP address and information about your browser. You can block these cookies in your browser settings or install Google’s opt-out browser add-on.
• Ads in our apps. To keep Zutsu Note free, our iPhone and Android apps show banner ads from Google AdMob, and video ads that you can choose to watch for Maple rewards. To show and measure ads and to prevent fraud, Google and the ad networks that serve ads through it receive your device’s advertising identifier (on iPhone, only if you allow tracking), your IP address, information about your device and the app, and the fact that the ad appears in Zutsu Note. They may use the advertising identifier to show you ads based on your interests. We never send your diary entries, medicines, symptoms, or other health records to them, and we don’t use your health information to choose ads. You can turn off interest-based ads on your device: on iPhone, in Settings > Privacy & Security > Tracking; on Android, by deleting your advertising ID in your device’s Google or privacy settings. We don’t show these ads to children under the minimum age to create an account (13, or 14 in Canada), or to people we believe are in Washington, Nevada, or Connecticut, based on the ZIP code you enter, your recent location, or where you connect from. Our website does not show ads from other companies.
• No session recording. The English edition does not use session recording or heatmap tools.
• Do Not Track and Global Privacy Control. Our website does not show ads from other companies, and it does not change how it works when it receives a Do Not Track or Global Privacy Control signal. Some state laws may treat the app ads described above as “selling” or “sharing” personal information, or as “targeted advertising.” You can turn off interest-based ads in your device settings as described above.

7. Health information and HIPAA

• We treat your diary entries, medicines, and other health information as sensitive information.
• When you create an account in the English edition, we ask for your consent to collect and use your consumer health data. That consent is separate from accepting our Terms and this policy. Our Consumer Health Data Privacy Policy explains the details.
• We use data from Apple Health and Health Connect only to show it with your headache records and to provide and improve the health features of Zutsu Note. We never use it for advertising or marketing, never sell it, and share it only with the service providers that store and run the Service for us. It is not shown to your clinic.
• Iris Wellness is not acting as a “covered entity” or “business associate” under the Health Insurance Portability and Accountability Act (HIPAA) when it provides this consumer app, so HIPAA does not generally apply to the information you keep in Zutsu Note. Other laws do apply, including state health privacy laws and the Federal Trade Commission’s Health Breach Notification Rule. When you choose to share your records with a clinic, the clinic’s own legal obligations, which may include HIPAA, apply to the information the clinic receives and keeps.
• We don’t monitor your data for medical problems. If something in your records worries you, talk to your doctor.

8. Research and de-identified information

Research is optional. After you sign up, we ask whether you agree to let us use your records for headache research. If you don’t agree, nothing else changes, and you can still use every feature. If you agree, we remove your name, email address, address, ZIP code or postal code, phone number, the names of your clinic and doctor, your date of birth (we keep only your age and sex), and the full text of your notes, and we give the research data a random ID number instead. We use this de-identified data for academic research and publications about headache treatment and for evaluating the safety and effectiveness of headache medicines, and we may provide it to other researchers and companies, including for commercial purposes. It includes your headache records, symptoms, medicines, and air pressure, the background information you add in My info, whether and how you see a doctor, and, if health sync is on, sleep, step, and heart rate data. You can withdraw your consent at any time in Account.

We may combine information from many users into statistics that do not identify anyone, for example the number of people using Zutsu Note or the totals on the headache map. We use these statistics to run and improve the Service and to describe it publicly. When we de-identify information, we take reasonable measures to make sure it can’t be linked to you, and we don’t try to re-identify it. When we share de-identified information, we require the recipient not to try to re-identify it either. We share de-identified data about individual users only for people who agreed to research.

9. How long we keep information

• We keep your information while you have an account, unless you delete it sooner (for example, by deleting a diary entry or your imported health data).
• Location. For pressure alerts we keep only your most recent rounded location, and we replace it each time. It is erased if you switch your forecast to your ZIP code or postal code or delete your account. Rounded locations saved with diary entries stay with those entries.
• Medicine label photos are not stored after the medicine names are read.
• Zutsu Post. When you delete a post, it disappears from Zutsu Post right away, but we keep the text and images until you delete your account so that we can review reports and keep the community safe. Posts that our checks hold back are kept the same way. You can ask us to delete them sooner (see section 14).
• Unfinished sign-ups. If an email address is never confirmed, the sign-up is deleted after 30 days.
• When you delete your account, we immediately delete your account and the information connected to it, including your diary entries and their change history, medicines, My info, imported health data, Zutsu Post profile, posts and images, notifications, clinic links, and family account links. After that, we keep only: a deletion record without your name or email address (when you signed up, how many days you used Zutsu Note, how many diary entries you had, how you found us, which clinic you had linked, if any, and any reason or comment you gave for leaving); feedback you sent us and your “I have a headache now” taps, with the link to your account removed; a de-identified copy of your records for research, if you had agreed to research and not withdrawn (see section 8); and information we must keep by law.
• Backups and logs. Copies may remain in our service providers’ backups and logs until they expire on their regular schedules. We don’t restore deleted accounts from backups. If we ever have to restore a backup to recover from a system failure, we will delete again any accounts that had already been deleted.
• Information a clinic has copied or downloaded is kept under the clinic’s control.

10. How we protect information

• Information is encrypted in transit (HTTPS) and stored encrypted in our database.
• Our app and database limit each account to its own information. Only authorized people at Iris Wellness can access our systems, and administrative access requires additional sign-in protection, such as passkeys.
• We remove personal and health information from error reports, and we don’t use session recording tools.
• No system is perfectly secure. Please use a strong password that you don’t use anywhere else, and tell us right away if you think someone else has used your account.
• If a security breach affects your information, we will notify you and the authorities as required by law, including the Federal Trade Commission’s Health Breach Notification Rule and state breach notification laws in the United States, and the breach notification laws of Canada, Australia, and New Zealand described in section 15.

11. International transfers

Iris Wellness is based in Japan, and your information is stored in Japan. Some of our service providers process information in the United States and other countries. The privacy laws of these countries may differ from the laws where you live. Wherever your information is processed, we protect it as described in this policy. As a Japanese company, we also follow Japan’s Act on the Protection of Personal Information.

12. Children and teens

• You must be at least 13 years old to create your own account (14 if you live in Canada). In the English edition, if the date of birth entered at sign-up shows that a person is under the minimum age, the sign-up stops and we don’t save the information entered.
• We do not knowingly collect personal information directly from children under 13. If we learn that we have, we will delete it. If you think a child under 13 has given us personal information, please contact us.
• A parent or legal guardian may create and manage a family account for their child, including a child under 13, and keep the child’s headache diary. The parent or guardian provides the information and is responsible for the account. A child under 13 must not sign in to or use the account on their own, including Zutsu Post. A parent or guardian can review, change, or delete the child’s information at any time by switching to the child’s account, or by contacting us.
• If you are 13 to 17, please use Zutsu Note with your parent’s or guardian’s permission. Be careful about sharing personal details in Zutsu Post, where other users can see your posts.
• If you live in Australia, you must be at least 16 years old to post or reply in Zutsu Post.

13. Your choices

• Notifications. Turn push notifications and email notifications on or off in Account, or in your device settings. We still send emails that are necessary for your account, such as password reset emails and confirmation that your account was deleted.
• Location. Turn off location access in your device settings at any time, or switch the forecast to your ZIP code or postal code, which also erases the location we stored for pressure alerts.
• Apple Health and Health Connect. Change which data Zutsu Note can read in your phone’s settings. To delete data you have already imported while keeping your account, use “Delete imported data” under Health sync in Account.
• Zutsu Post. Turn off showing your state in your Zutsu Post profile, delete your posts, block other users, and choose which Zutsu Post notifications you get.
• Clinic sharing. Unlink a clinic at any time in Account.
• Family accounts. Unlink family accounts at any time in Account.
• Your information. Edit or delete diary entries, and update My info and your profile in Account.
• Save a copy. In the Stats tab, use “Save all logs” to save your diary as an Excel or CSV file.
• Delete your account. In Account, choose “Delete account.” You will need your password.

14. Your privacy rights

Depending on where you live, the law may give you the right to:

• know what personal information we have about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• get your information in a portable format;
• withdraw consent you have given, including consent to collect or share consumer health data;
• opt out of the sale of your personal information, targeted advertising, and certain kinds of profiling (see section 6 for the ads in our apps; we don’t profile you); and
• not be treated differently for using these rights.

We offer these rights to everyone who uses the English edition, wherever you live.

How to make a request. You can do many things yourself in the app (see section 13). For anything else, email zutsu-note@iris-wellness.jp from the email address on your account and tell us what you would like us to do. We will respond within 45 days. If we need more time, we will tell you why within those 45 days, and we may take up to 45 more days. We don’t charge for requests.

Verifying your identity. To protect your information, we confirm that a request comes from you, for example by checking that it was sent from the email address on your account or by asking you to sign in. If we need a little more information to verify you, we will ask, and we will use it only for that purpose.

Authorized agents. Where your state’s law allows it, you can ask someone else to make a request for you. We may ask for proof that they are authorized and may confirm the request directly with you.

Appeals. If we decline your request, you can appeal by replying to our decision with the word “Appeal” and telling us why. We will respond in writing within 45 days and explain our decision. If we deny your appeal, you can contact your state attorney general, for example the Washington State Attorney General or the Connecticut Attorney General.

California. We don’t share personal information with other companies for their own direct marketing. If you are under 18 and live in California, you can delete posts you made in Zutsu Post, and they will no longer be visible to other users.

Nevada. We do not sell personal information.

15. If you live in Canada, Australia, or New Zealand

We store your information in Japan, and some of our service providers process it in the United States and other countries (section 5). By using the English edition, you understand that your information is handled outside your country as described in section 11. You can use the rights in section 14 wherever you live. You also have these rights and choices:

• Canada. We handle your information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you live in Quebec, the Act respecting the protection of personal information in the private sector. You can ask to see and correct your information and withdraw your consent at any time, and we will respond within 30 days. The person in charge of protecting personal information at Iris Wellness is our representative director, Hirotaka Maekawa, who you can reach at zutsu-note@iris-wellness.jp. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information. We will report breaches that create a real risk of significant harm, as the law requires.
• Australia. We handle your information under the Privacy Act 1988 and the Australian Privacy Principles, including when we disclose it to the overseas service providers in section 5. You can ask to see and correct your information. If you have a complaint, contact us first and we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner. We will notify you and the Commissioner of an eligible data breach under the Notifiable Data Breaches scheme.
• New Zealand. We handle your information under the Privacy Act 2020 and its Information Privacy Principles, including when we disclose it outside New Zealand. You can ask to see and correct your information. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner. We will notify you and the Commissioner of a privacy breach that has caused or is likely to cause serious harm.

16. Changes to this policy

We may update this policy. We will post the new version here with a new effective date. If we make material changes, we will tell you in the app or by email at least 30 days before they take effect. If a change would let us collect, use, or share consumer health data in a new way, we will ask for your consent first.

17. Contact us

If you have questions about this policy or your information, please contact us.