Consumer Health Data Privacy Policy
Last updated: 2026-08-23
This is a standalone policy required by the Washington My Health My Data Act (RCW 19.373) and Nevada SB 370 (NRS 603A.400 et seq.). It applies in addition to our Privacy Policy, and it applies only to "consumer health data" as those laws define it. Where this policy and the Privacy Policy differ as to consumer health data, this policy controls.
Who this covers: residents of Washington and Nevada. We extend the rights described here to residents of any other state with a comparable consumer health data law.
1. What we mean by consumer health data
These laws define "consumer health data" very broadly: personal information linked or reasonably linkable to a consumer that identifies the consumer's past, present, or future physical or mental health status — including health information that is inferred or derived from data that is not itself health data.
Journey Tracker is a photo journaling app. We do not ask you for health information, and the app has no fields for weight, measurements, symptoms, diagnoses, medications, or any other health record. We do not connect to Apple Health or any other health data source.
However, because a photo of yourself over time can reveal or imply something about your physical condition — and because people use Journey Tracker for things like fitness, weight change, pregnancy, hair growth, skin, and recovery from procedures — we treat the photos and notes you choose to upload as consumer health data, and we apply the protections in this policy to them.
2. Categories of consumer health data we collect, and the sources
| Category | Source |
|---|---|
| Photographs of yourself that you choose to upload, and thumbnails generated from them | Directly from you, from your device's photo library or camera |
| Titles, descriptions, and dates you write on a collection or a photo | Directly from you |
| Collection avatars and your profile picture, if you set them | Directly from you |
We do not collect: precise geolocation (we strip GPS metadata from photos during upload), biometric identifiers, health records, insurance information, prescription or medication data, reproductive or sexual health data, genetic data, or data from any third-party health service. We do not derive or infer health information from your photos — we do not analyze their content, and we run no facial recognition, body analysis, machine learning, or other automated interpretation on them.
3. Why we collect it, and how we use it
We collect and process this data for one purpose: to provide the Service you asked for — storing your photos privately, letting you organize them into collections, displaying them back to you, generating side-by-side comparisons and timelines from them, and producing the exports you initiate.
We also process it as strictly necessary to keep the Service secure and working (for example, enforcing per-user access rules and rate limits, and preventing abuse), and to comply with law.
We do not use consumer health data for advertising, profiling, personalization, product research, model training, or any secondary purpose.
4. Who we share it with
We do not sell consumer health data. We have never sold consumer health data, and we will not sell it. A "sale" under these laws includes exchanging data for anything of value, not just money.
We share consumer health data only with the processors that operate the Service on our behalf, under written contracts that limit them to processing it for us:
| Recipient | Category of data | What they do with it |
|---|---|---|
| Amazon Web Services, Inc. | Photos and thumbnails | Encrypted storage and delivery |
| Google LLC (Firebase) | Collection and photo titles, descriptions, dates, and file references | Database (Firestore), cloud functions, authentication, and push notification delivery |
We have no affiliates, and no affiliate has access to consumer health data. NOVEE GROUP LLC is the only entity that controls this data.
We may also disclose consumer health data where we are legally compelled to (for example, in response to a valid subpoena or court order), or where necessary to protect against imminent harm — and, where the law allows and it is safe to do so, we will notify you first.
5. How we protect it
Photos are held in private cloud storage with no public URL. Access is temporary and expires shortly after it is granted, and access rules are enforced on our servers so a signed-in person can reach only their own data. Traffic is encrypted with TLS, stored photos are encrypted at rest, and we verify that requests come from a genuine, unmodified copy of the app. GPS metadata is removed from photos during upload. We keep the specifics of our security configuration confidential.
Journey Tracker is not end-to-end encrypted. To operate the Service and provide support, our systems and our infrastructure providers can technically access stored content; we limit that access to what is necessary. No system is perfectly secure.
6. Consent
We collect and process consumer health data only as necessary to provide the Service you have requested from us — which is the basis on which these laws permit collection without separate consent. Nothing happens until you affirmatively choose to add a photo.
If we ever want to collect or use consumer health data for a purpose beyond providing the Service, we will ask for your separate, opt-in consent first, in clear language, and you will be free to decline without losing access to the Service. We will not obtain consent through a pre-checked box, a bundled agreement, or by treating your continued use of the app as agreement.
We do not sell consumer health data, so we will never ask you for the signed authorization those laws require for a sale.
7. How long we keep it
We keep your photos and notes until you delete them or delete your account. When you do, we remove them from our active systems promptly, and residual copies in backups and storage systems are purged on a rolling basis, ordinarily within 30 days. We may retain limited records beyond that only where the law requires preservation.
8. Your rights
If you are a Washington or Nevada resident (or a resident of another state with a comparable law), you have the right to:
Know and access — confirm whether we are collecting, sharing, or selling your consumer health data, and get a list of all third parties with whom we have shared or to whom we have sold it, including an active contact for each.
Withdraw consent — withdraw consent to our collection and sharing of your consumer health data.
Delete — have your consumer health data deleted from our records, including from our backups and from our processors. We will honor a deletion request by deleting the data and notifying each processor holding it.
You can delete individual photos, whole collections, or your entire account directly in the app at any time — that is the fastest way to exercise the deletion right. You can also email us.
How to make a request: email support@journeytrackerapp.com with the subject line "Consumer Health Data Request" from the email address on your account. We will verify the request against your account and respond within 45 days, and we may extend by another 45 days where reasonably necessary, in which case we will tell you why within the first 45. There is no fee. You may use an authorized agent where the law permits.
If we deny your request, we will explain why and how to appeal. To appeal, reply to our response with "Appeal" in the subject line. We will respond to an appeal within 45 days. If we deny the appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov.
No retaliation. We will not deny you the Service, charge you a different price, or provide a lower quality of service because you exercised any of these rights.
9. Geofencing
We do not use geofencing — around health care facilities or anywhere else. The Service does not collect precise geolocation at all.
10. Changes to this policy
If we materially change our consumer health data practices, we will update this policy and notify you before the change takes effect, and we will obtain your consent where the law requires it. We will not apply material changes to previously collected consumer health data without your consent.
11. Contact
NOVEE GROUP LLC
Email: support@journeytrackerapp.com
© 2026 NOVEE GROUP LLC. All rights reserved.