Consumer Health Data Privacy Policy
This policy is for people in Washington, Nevada, Connecticut and other US states with laws that protect consumer health data, such as Washington’s My Health My Data Act. It adds to our Privacy Policy, which describes everything Ruva handles. Where this page is more specific about health data, it applies.
“Consumer health data” means personal information that identifies, or could reasonably be linked to, your past, present or future physical or mental health. For Ruva, that includes information about your periods, symptoms, sexual activity, contraception, pregnancy, fertility and medicines.
What we collect, and what we don’t
Most of what you log in Ruva never reaches us. It’s stored in a database on your phone, and we can’t see it. We only collect consumer health data when you choose to use one of these optional features:
| Feature | Consumer health data we collect | Source |
|---|---|---|
| Sync between your devices | A copy of your Ruva record, as for a cloud backup, and a marker with the date and type of each entry you delete | You, from each signed-in device while Ruva is open on it, after you turn sync on |
| Cloud backup | A copy of your Ruva record: profile, period days, symptoms, moods, notes, tests, temperature, weight, contraception and pill setup, pregnancy and birth dates, medicines, reminders, and care contacts if you choose | You, from your phone, when you tap Back up now |
| Partner sharing | Up to six summary lines you choose, such as your cycle day, the approximate start of your next period, your fertile window or, if you turn it on, your pregnancy week | You, from your phone |
| Community | Anything about your health that you write in a post or reply | You |
Health Connect and Apple Health data stays on your phone. Values Ruva imports from them become part of your Ruva record and are included in sync and in a cloud backup if you use them.
We keep the synced copy until you turn sync off or delete your account, and a cloud backup until you replace or delete it, delete your account, or sync replaces it. Signing out doesn’t delete either of them.
We don’t collect precise location, biometric data or any data from other sources, and we don’t draw inferences about your health. The app’s usage analytics (Google Analytics for Firebase) never include consumer health data. Screens whose names could reveal something about your health, and what you do in Moving gently, are only counted as anonymous daily totals in our own database, which can’t be linked to you. Both are described in our Privacy Policy.
Why we collect it
Only to provide the feature you asked for: to keep your devices in sync, to store and restore your backup, to show your summary to the people you give your partner code to, and to show your posts to the community. We also use community posts and reports to moderate the community and keep it safe.
We collect and use consumer health data only with your consent, which you give when you turn on a feature after reading what it sends. We don’t use it for advertising, and we don’t use it for any other purpose without asking you first.
Who receives it
- Our processor: Google, through Firebase Authentication and Cloud Firestore, which stores the data on our behalf and under our instructions.
- The people you choose: anyone you give your partner code to, and the readers of anything you post in the community.
- Nobody else. We don’t sell consumer health data, we don’t share it with third parties or affiliates for their own purposes, and we don’t use geofences around health care facilities.
If the law ever requires us to disclose consumer health data, we’ll follow the approach in our Privacy Policy.
Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data (we never sell it)
- access it, including a list of every third party and affiliate we’ve shared it with and how to contact them
- withdraw your consent
- have it deleted, including from our processor’s systems
You can do much of this in the app: download your data, turn sync off (which deletes the synced copy), stop sharing, delete posts, or delete your account, which also deletes the synced copy, your cloud backup, partner summary, community posts and sign-in account. Account and data deletion has the steps. For anything else, email hello@myruva.co. We’ll respond within 45 days. If we need more time, we’ll tell you why, and the total won’t exceed 90 days. We won’t charge you, and we won’t treat you differently for using these rights.
Appeals
If we decline your request, you can appeal by replying to our decision within 45 days. We’ll respond to the appeal in writing within 45 days and explain our reasons. If your appeal is denied, you can contact your state attorney general, for example the Washington State Attorney General’s Office.
Contact
Zuro Ansa Tech LLP
Email: hello@myruva.co