Consumer health data

Privacy policy

DRAFT — not yet reviewed by an attorney. This page describes what WLFL-SC actually collects and does today, written to be accurate and specific rather than generic boilerplate. It has not been reviewed by counsel and should be before real participant data is collected. Washington's My Health My Data Act likely applies to this program; this policy is written with that in mind but is not a substitute for legal review.

What we are

WLFL-SC is an independent tool used by staff and participants of a weight-management program to place and track meal-replacement orders. It is not affiliated with or endorsed by PeaceHealth or HMR, and it is not a healthcare provider. We choose to treat the data described below with the same seriousness we would if we were, because some of it — specifically, starting body weight — falls within Washington's broad legal definition of consumer health data even though we are not a HIPAA-covered entity.

What we collect, and why

Field	Purpose
Name, email	Sign-in, order identification, receipts and other order emails
Cell phone (optional)	Staff contact about a pick-up only. We never send text messages.
Program start date, class day, phase, coach	Program context for staff; phase controls which items you can order
Starting weight (optional, consumer health data)	Staff context only. Stored encrypted, separately from your other profile fields, and is never displayed on your order form, receipts, or history reports. Collected only with your explicit, separate consent at the point you enter it.
Orders and order history	The actual purpose of the app — placing and fulfilling orders

Consent

Your starting weight is only collected if you type a value into your profile and check the consent checkbox next to it, which links to this page. We do not require it to use the app — it currently has no effect on your order form, and is stored purely so staff have context if you choose to share it. You can decline to provide it.

Your rights

Correct: edit your own profile at any time from your profile page.
Export: download a complete copy of your profile and order history as JSON, from your profile page, at any time.
Delete: request account deletion from your profile page. After a 7-day grace period (during which you can cancel), your profile information and starting weight are permanently erased, and your auth login is deleted. Your past orders are kept but anonymized — the items and prices stay on record for our inventory and financial history, with no link back to you.

Retention

Data	Retention
Active account	Life of the account
Orders (anonymized after deletion)	3 years
Admin activity log	2 years
Email delivery log	90 days
Database backups	30 days, encrypted

A note about backups

Deleting your account erases your data from the live database as described above. Database backups age out on their own 30-day schedule and are not individually edited when an account is deleted — so a trace of your data may exist in a backup for up to 30 days after deletion, accessible only in the event of a disaster-recovery restore. We think it's more honest to say this plainly than to imply instant erasure everywhere.

What we don't do

No third-party analytics, advertising, or session-replay tools, on this or any page.
No selling or sharing of your data with anyone outside of running this program.
No text messages — your phone number is for staff phone contact only.

Questions

Contact program staff directly with any questions about this policy or your data.