Effective date: [date] · Last updated: [date]

Scope

This policy explains how Nexify Labs Pty Ltd (“Daylune”, “we”) handles consumer health data under the Washington My Health My Data Act, Nevada SB 370, and similar US state consumer-health-data laws (e.g. Connecticut, Maryland). It supplements our main Privacy Policy. If there’s any conflict about consumer health data, this policy controls for residents of those states.

What counts as consumer health data

“Consumer health data” is information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status. For Daylune, this includes your mood ratings, wellbeing metrics (sleep, energy, focus, exercise, social, nutrition), tracked activities, important days, entry dates, and any optional free-text notes you choose to write.

Categories of consumer health data we collect

• Mood ratings and custom mood labels.

• Wellbeing metrics: sleep, energy, focus, exercise, social, nutrition.

• Activities and important days you log.

• Entry dates and timing.

• Optional free-text notes (only if you choose to write them).

Where we collect it from

Directly from you, when you create entries in the app. We do not buy consumer health data, and we do not collect it from data brokers or other outside sources.

Why we collect and use it

• To provide the core journaling, calendar, and statistics features you request.

• To generate Smart Insights (patterns and correlations from your numeric data).

• Only if you separately opt in, to generate AI insights from numeric data only (never your free-text notes).

• To secure your account and provide support.

We do not use your consumer health data for advertising, and we do not profile you for marketing.

Consent: how we collect and share

• We collect your consumer health data only with your affirmative, opt-in consent, and only what’s needed to provide the features you use.

• We obtain separate consent before sharing your consumer health data with anyone beyond the service providers (processors) listed below.

• We never sell consumer health data, and we will not do so. (Selling would require a separate, signed authorization, which we do not seek.)

• You can withdraw consent at any time — see “Your rights” below.

Who we share it with

We share consumer health data only with service providers (processors) acting on our instructions under contract, strictly to run Daylune:

• Supabase / Lovable Cloud — secure cloud database and hosting.

• Anthropic — AI provider for the opt-in AI insights feature (numeric data only; only if you opt in; does not train its models on this data).

We do not share consumer health data with advertisers, data brokers, or affiliates for their own purposes. We may disclose it only where required by law or strictly necessary to protect safety, rights, or service security.

No geofencing

We do not use a geofence to identify or track you near any health facility, to collect consumer health data, or to send you messages related to your health.

Security

We protect consumer health data with encryption in transit and at rest, per-user access controls (row-level security), restricted personnel access, and contractual confidentiality with our processors.

Your rights

For consumer health data, you may:

• Confirm whether we collect, share, or sell it (we don’t sell it).

• Access the consumer health data we hold about you.

• Withdraw consent to our collection and/or sharing of it.

• Delete it — including by deleting your account in More → Delete account, which permanently erases your entries and profile from our live database.

• Request a list of the third parties and affiliates with whom we’ve shared your consumer health data.

• Appeal if we deny a request.

To make a request, email [privacy@yourdomain]. We respond within 45 days and may extend once by a further 45 days where reasonably necessary, with notice. We will not deny you goods or services for exercising these rights.

Changes

We’ll post changes here and update the date, and notify you of material changes affecting your consumer health data.

Contact

[privacy@yourdomain] — Nexify Labs Pty Ltd, [postal address], Brisbane, Queensland, Australia.