Consumer Health Data Privacy Policy

Effective date: November 11, 2026. Last updated: November 10, 2026.

This policy explains how Staxyz, Inc. handles consumer health data under Washington's My Health My Data Act and Nevada's consumer health data law.

Consumer health data we collect

• What you take and when: compounds, doses, schedules, skipped doses, supplies, lots and certificate files. Your Stack is also used, at your request, to show, on your device, which lab tests cover the markers listed for your Stack.
• Symptoms, check-ins and measurements you log.
• Lab results and files you import, and the text of entries you import that your device can't match.
• Images you choose to send from the importer.
• Food and meal entries. If you scan a barcode, the barcode number is sent to a public food database to look up the product.
• Apple Health daily summaries, if you turn on sync: weight, resting heart rate, heart rate variability, sleep, steps, dietary energy, active energy, protein, carbs, fat, fiber and water.
• Text transcribed from your voice on your device (no audio). What you say to Siri to log a dose is handled on your device and isn't sent to Natt's AI.
• What you ask Natt.
• Profile details: birthday, height and sex.
• Health information you choose to post in the community, such as what you take or how you feel.
• Inferences: a safety mark if a post suggests a risk of self-harm.
• Your invite request (email and any social handle), because it shows you are seeking a health service.

Why we collect it and how we use it

• To keep your log and show it back to you, and to sync and restore it across your devices.
• If you use Share My, to show the items you pick to the member you choose.
• To answer your Natt questions.
• To help match entries you import.
• To screen community posts before they appear and to show you the posts you ask to see.
• To show you support resources.
• To show which lab tests cover the markers listed for your Stack when you ask us to ("Match tests to my Stack").
• If you turn on Help improve Staxyz, what you log may also be used to build the de-identified, combined totals behind Community Stacks. A stack is shown only when at least 25 members log it, with no member's identity attached.
• To send your invite and account emails, and to keep Staxyz secure.

Where it comes from

• You: what you type, say, scan, photograph, import or post.
• Apple Health, if you turn on sync.
• The AI assistant you connect, if you use Connect Staxyz to my AI: the doses, skips and symptoms it adds to your log, and the protocol and Stack changes it suggests that you confirm.
• Inferred from what you post (the self-harm safety mark).

Consumer health data we share

• What you type or say to Natt, your display name, and the protocols, doses, supply, adherence, injection sites, lot and certificate results, symptoms, measurements, lab results and (if turned on) Apple Health details Natt needs to answer. Check-ins are not sent.
• The text of community posts and replies, and every message you send to Natt, for screening.
• The barcode number, when you scan a product, with a public food database, to look up the product.
• The data you choose to share, if you use Connect Staxyz to my AI, with the AI assistant you connect.
• If you use Share My, the items you pick (your schedule, which days you logged and, if you turn it on, amounts), with the member you choose, until you stop sharing.
• The text of imported entries your device can't match, and images you choose to send from the importer.
• Your synced records, with our database and hosting provider.
• The health information you choose to post in the community, with other members. Photos you post are stored privately and shown only to signed-in members. A link to a posted photo works for up to an hour.

Who receives it

• Our AI service provider. It receives what you type or say to Natt, your display name, and the protocols, doses, supply, adherence, injection sites, lot and certificate results, symptoms, measurements, lab results and (if turned on) Apple Health details Natt needs, only to answer you, under a contract that limits its use. It may not train its models on it. Check-ins are not sent.
• Our content moderation provider, which screens the text of community posts and every message you send to Natt, and helps match entries you import and images you choose to send from the importer, only to provide those services, under a contract that limits its use. It may not train its models on it.
• Our workplace software provider, which stores invite requests (your email and any social handle) for us, only to run the invite list, under a contract that limits its use. The account is held by Staxyz, Inc. under the provider's data processing addendum.
• Our database and hosting provider, which stores your account and records for us, under a contract that limits its use.
• Our email provider, which sends your invite and account emails, under a contract that limits its use.
• Other Staxyz members, for what you post in the community.
• A Staxyz member you choose with Share My, for the items you pick.
• A public food database, which receives the barcode number when you scan a product, to look up the product.
• The AI assistant you connect, if you use Connect Staxyz to my AI, for the data you choose to share.
• Affiliates: none. Staxyz has no affiliates.

We do not sell consumer health data.

Your rights

You can ask us to confirm whether we collect, share or sell your consumer health data; get a copy, along with a list of every third party and affiliate we shared it with and how to contact them; withdraw your consent; and delete it.

Ask in the app (Settings) or by email at support@staxyz.com. You don't need an account. If you have one, we'll ask you to sign in. If not, we'll confirm by email. Someone you authorize may ask for you, with your signed permission.

We'll answer within 45 days. We may extend once by 45 days and will tell you why. We delete within 30 days of confirming it's you, and we tell our service providers and others we shared with to delete it too. Backup copies are deleted within 7 days after that. Requests are free up to twice a year, and we won't treat you differently for asking.

If we say no, you can appeal by replying or emailing support@staxyz.com with "Appeal". We'll answer in writing within 45 days. If we still say no, we'll tell you how to complain to your state Attorney General (Washington: atg.wa.gov/file-complaint; we'll give the Nevada contact in our response).

How you can change your data

Edit or delete entries in the app at any time.

Changes to this policy

We'll post updates here and tell you by email or in the app before a material change. We won't use your data in a new way without asking.

Tracking

No other company collects your consumer health data across websites or apps through Staxyz.