Consumer Health Data Privacy Policy

What is consumer health data?

Consumer health data includes any personal information that is linked to or reasonably linkable to an identified or identifiable consumer and that identifies their past, present, or future physical or mental health status. For ODyn, this includes:

• Intraocular pressure (IOP) readings
• SpO2 measurements and perfusion index
• Glaucoma diagnosis, family history, related conditions
• Prescribed medications and drop applications
• Spike events, visual anomaly observations, diary entries
• Product scans and dietary trigger associations
• Demographic data when combined with health data

How we collect consumer health data

We collect consumer health data directly from you when you use the platform — when you log an IOP reading, scan a product label, enter a health metric, or update your profile. We do not acquire consumer health data from third parties.

How we use consumer health data

We use your consumer health data only for the following purposes:

• To provide the ODyn service to you — displaying your readings, detecting spikes, correlating scans with IOP events.
• To build the aggregate correlation engine — anonymized versions of your contributions join the community dataset to identify trigger patterns.
• To communicate with you about your account and data.

We may process submitted data using automated systems, including machine learning models, solely to extract and structure information (e.g., ingredient parsing from label images). These systems operate under contractual and technical controls and do not use your data to train general-purpose models.

We do not sell your consumer health data

ODyn does not sell identifiable consumer health data to third parties. We do not share identifiable consumer health data with advertisers, data brokers, or pharmaceutical companies.

We do not “sell” or “share” identifiable consumer health data as those terms are defined under applicable consumer privacy laws, including for cross-context behavioral advertising.

If our approach to identifiable consumer health data ever changes — including any scenario that would constitute a “sale” under the My Health My Data Act — we will obtain your explicit, revocable opt-in consent first. Consent will not be inferred from continued use or passive acceptance of the platform.

Service providers listed in our general Privacy Policy process data on our behalf under contractual restrictions and cannot use your data for their own purposes.

Once data is aggregated and de-identified using technical and organizational safeguards designed to remove direct and indirect identifiers, it is no longer reasonably linkable to an individual. Aggregate signal produced this way is not “consumer health data” under MHMDA and may contribute to research partnerships or published findings.

Your consumer health data rights

• Right to confirm and access — Confirm whether we process your consumer health data, and access a copy of it. Use the Export function in your Account page.
• Right to delete — Request deletion of your consumer health data. Use the Delete Account function in your Account page. Note: data that has been genuinely anonymized and added to the aggregate community dataset cannot be un-anonymized or selectively removed, but is no longer linked to you.
• Right to withdraw consent — Withdraw consent at any time by canceling your subscription or deleting your account.
• Right to appeal — If we decline any request, you may appeal via our privacy request form. Washington residents may also contact the Washington State Attorney General.

AI assistant (optional)

ODyn offers an optional conversational assistant. It is separately opt-in: we do not share any consumer health data with it unless you explicitly enable it and send a message. When you do, we assemble a de-identified slice of your data (recent readings, spikes, health metrics, experiments, and your conversation) and send it to a third-party AI language provider to generate a response.

Your identity is stripped and free text is scrubbed of identifying details before anything leaves ODyn. The provider processes this context under a business-associate agreement, transiently, and does not use it to train models. You can withhold or withdraw this consent at any time by not enabling, or by discontinuing use of, the assistant — the rest of ODyn continues to work either way. The assistant is informational and educational and is not a substitute for professional medical care.

Consent

By creating an account and completing onboarding, you provide explicit consent for the collection and processing of your consumer health data as described in this policy. This includes sensitive health-related information you choose to provide. You may withdraw consent at any time.

Retention

Your identifiable consumer health data is retained while your account is active. After account deletion, identifiable data is removed immediately. Anonymized aggregate data may persist in the community dataset indefinitely but cannot be linked back to you.

Contact

For questions, requests, or appeals, use our privacy request form