Consumer Health Data Privacy Policy

Effective date: September 30, 2026

Chart35 is designed so fertility observations stay on your device unless you choose encrypted Sync, provider sharing, or to import a paper chart from a photo. We do not sell consumer health data, use it for advertising, or use geofencing around health-care facilities. This policy supplements the Chart35 Privacy Policy.

1. Consumer health data we collect

Category	Source	Why we use it
Fertility observations, cycle dates, pattern settings, intercourse flags, and notes	You enter this on your device	Local charting. If you choose Sync, the device encrypts it before upload; the server cannot read the content.
Derived chart information such as cycle boundaries and peak-day marks	Calculated on your device from your entries	Display and analyze your chart locally; include it in an encrypted backup if you choose Sync.
Filtered provider-share chart	You expressly create a share link	Show the selected read-only chart to anyone holding the time-limited link. Free-text notes are excluded; charted intercourse indicators remain in the share.
A photo of a paper chart and the reading made from it	You choose a photo to import and tap “Send photo to OpenAI”	Turn your paper chart into proposed observations you review. The device crops out the name and practitioner header and strips metadata first. The photo goes through our server to OpenAI, which reads it; our server does not store the photo or the reading. The reading is a proposal: you review it before anything is saved to your chart.
Account and encrypted-sync metadata	You provide account details; our server records sync time/status	Authentication, encrypted backup, multi-device continuity, security, export, and deletion.
Billing relationship and subscription status, which may reveal an association with a fertility app	You select a plan; Stripe returns customer/subscription status; Google Play supplies a one-use token for an eligible US Android external link	Start and manage Chart35 Sync, prevent duplicate subscriptions, enforce entitlement, send required notices, maintain consent evidence, and make required Play external-transaction/refund reports.
App/site usage signals	Your browser, only after analytics opt-in	Aggregate product improvement. Collected by Umami, which we host ourselves; no third party receives them, and no chart entry or user ID is sent.

2. How consumer health data is shared

We share only what is necessary for a function you request:

Stripe: name, email, billing address, payment details, selected plan, a Chart35 account reference, and subscription status. Stripe does not receive fertility observations or the encrypted chart blob.
Google Play: for an eligible US Android link-out, a one-use Play token plus app package, non-PII transaction IDs, transaction/refund amounts and times, currency, US tax-region code, and recurring/test status. Chart35 does not send Google Play your email, billing address, payment method, observations, or encrypted chart in this reporting flow.
OpenAI: only if you import a paper chart from a photo, the cropped, metadata-stripped photo, sent through our server without your account identity. OpenAI reads it and returns the reading. It does not train on it and may keep it for up to 30 days for abuse monitoring. See the Privacy Policy, Section 4.1.
Resend: email address, first name, and transactional account or billing email content.
Analytics is no longer shared with anyone. Site and app usage signals were previously sent to Google Analytics after opt-in. They are now collected by Umami, which runs on our own server, so opting in no longer discloses anything to a third party. No chart fields or Chart35 account identifier are collected either way.
A recipient you choose: the filtered chart encrypted for a provider-share link you generate. Anyone with the complete link can view it until revocation or expiry.
Government or legal recipients: only when we reasonably believe disclosure is legally required. We evaluate requests for proper scope, object when appropriate, and can provide only the limited data we possess. We cannot decrypt end-to-end encrypted chart content.

We do not sell consumer health data, share it for cross-context behavioral advertising, combine it with data-broker profiles, or permit a processor to use it for an unrelated purpose.

3. Your choices and rights

Subject to applicable law, you may ask us to:

confirm whether we collect or share your consumer health data;
access the data we can associate with you and obtain a portable export;
delete consumer health data from our systems and instruct processors as required;
withdraw consent for future collection or sharing; or
review a denial of one of these requests.

You can export local chart data, revoke sharing, and delete your account in Chart35 Settings. You may also email jacob@stephens.page with the subject “Consumer Health Data Request.” We may verify that you control the relevant account. We will respond within the period required by applicable law. If we deny a request, our response will explain why and how to appeal by replying with “Appeal.” You may contact the Washington State Attorney General if an appeal is denied.

4. Consent

Charting locally does not send observations to us. Creating an account and choosing Sync causes the device to upload end-to-end encrypted data. Creating a provider-share link is a separate action. Importing a paper chart from a photo is another: nothing is sent until you tap “Send photo to OpenAI”, and the first time on a device the App explains what is sent, to whom, and what is kept before anything leaves it. Before Stripe Checkout, Chart35 presents a separate unchecked consent describing automatic renewal, the billing information sent to Stripe, and the limited Google Play reporting used for eligible Android link-outs. You may withdraw future consent, but withdrawal does not affect processing already completed or records we must retain by law or Play program obligations.

5. Security and retention

Synced chart content is encrypted on your device with AES-256-GCM before upload. Transport uses HTTPS. Passwords are hashed. Billing webhook signatures are verified, and Chart35 stores compact event references rather than full Stripe payloads. Raw Google Play reporting tokens are deleted after a successful initial report. Chart35 keeps no chart photo or reading; OpenAI may keep them for up to 30 days for abuse monitoring. Account-linked health and entitlement records are deleted with the account. Stripe, Google Play, and legally required consent/transaction records may be retained for the periods described in the Privacy Policy.

6. Changes and contact

We will post material changes before collecting, using, or sharing additional categories of consumer health data and will obtain affirmative consent when required. Questions and requests: jacob@stephens.page.