Washington's My Health My Data Act asks every service that handles consumer health data to publish a policy of its own, linked from its home page, that says in one place what health data it collects, where from, what for, who it shares it with, and how to exercise your rights (RCW 19.373.020). This is that policy. It applies to everyone who uses Neta, not only to people in Washington, and it adds nothing to the Privacy Notice: it says the same things in the order that law asks for. If the two differ, the Privacy Notice prevails, in the language version its opening says prevails for you.
Who we are. Pablo Gabriel Campos Cordero, an individual, at privacy@tuneta.app (the Privacy Notice, Section 1).
1. The consumer health data we collect
Almost everything Neta holds about you is consumer health data: information about your reproductive and metabolic health that you record yourself. The complete list is Section 2 of the Privacy Notice, under "What you tell us about your cycle and your health". In categories:
- your cycle baseline, your bleeding days and cycle events;
- your daily logs (mood, energy, sleep, stress, symptoms and notes);
- the observations you record for the things you chose to track;
- your question (also while you confirm your email), what Neta proposed to watch for it, and what you are testing;
- your experiments: what you tested, their plan and dates, your question, dose and notes in your own words, your pauses, and what you thought of the result;
- the life changes you report (an illness, travel, a pregnancy and the like), with their dates and your note;
- the dated history of your cycle-baseline answers, and why each thing you track is on your list;
- your medication, your lab results and your remedy reports, as you typed them and, if you turn on ovulation tracking, a progesterone result read as confirming ovulation;
- if you turn on ovulation tracking: that you turned it on, which signals you chose to log (your waking temperature, LH tests and, only with your intimate-health permission, cervical mucus), and each cycle's ovulation status computed from them;
- your hair and intimate-health entries, only if you turned each permission on, and when you turned it on and off. They are kept apart from the rest, never sent to the AI, and never in a summary for your doctor unless you add them to that summary when it is made;
- your pelvic-health day records (pain from 0 to 10, where and how it felt, how much it got in the way of your day, and your note), only if you turned that permission on, and when you turned it on and off. They are never sent to the AI; they go into your summary for your doctor, the day-by-day rows only if you add your full record when you make it;
- your messages to your companion and its replies;
- the short facts, patterns and readings the service derives from the above, including the readings and period forecasts you were shown, kept as shown;
- your steps in Neta (the first time you reached each step, with its time), only if you chose "Help improve Neta with my steps".
We do not collect your precise location, we do not use geofences (RCW 19.373.080), and we read no sensors on your device.
2. Where it comes from
From you, and only from you: what you type or tap in the app. The service then derives patterns, readings and short facts from it, and each derived item records which of your entries it came from. We buy no data and receive none from anyone else about you.
3. What we use it for
- To keep your record and show it back to you as your own patterns and readings.
- To answer you through your companion and to remember what you tell it, only if you gave that separate permission.
- To prepare a summary you can take to a clinician, from your own data, with your recent cycles' ovulation status if you turned on ovulation tracking, and your cervical mucus only if you choose to include it when you make it. If you keep pelvic-health records, they are in it too (the day-by-day rows only if you add your full record). You can also leave your pelvic health out of a copy when you make it: that copy then carries none of your pelvic-health records, your pelvic-pain answers from the daily check-in or your answer about endometriosis or adenomyosis.
- To understand where people stop and fix it, from your steps in Neta, only if you gave that separate permission.
We do not use your health data to advertise to you, to build a profile for anyone else, to train anyone's AI model, or to make automated decisions with legal effects on you. The Privacy Notice, Section 4, is the full list of purposes.
4. Who we share it with
We sell no health data, to anyone, ever (RCW 19.373.070). We share it with no third party acting on its own account, except what you choose to let Google or Apple learn by signing in with them (below). It is processed on our behalf, under contract and on our instructions, by these processors (the Privacy Notice, Section 5):
- Supabase: the database and sign-in;
- Vercel: hosting;
- Anthropic: the AI provider, only if you gave the AI permission, and only what Section 5.1 of the Privacy Notice lists;
- Sentry: error reports, configured to carry no health data.
Resend (emails) and Cloudflare (sign-up protection) receive no health data. Paddle, Apple and Google receive your payment, never your record. We have no affiliates.
Signing in with Google or Apple. If you choose to, that company learns that you have an account with Neta and when you sign in, which on a product like this one can suggest something about your health. It learns it because you pressed its button, after the sentence beside the button told you so; it receives nothing from your record, and it treats what it learns under its own policy (Privacy Notice, Section 5.6). If you never use those buttons, they learn nothing from us.
5. Your consent
We collect your health data only after you tick, on its own and unticked by default, the decision "Keep my health record" (RCW 19.373.030(1)(a)). The decision to let your companion use your record is a second, separate one, and "Help improve Neta with my steps" is a third (RCW 19.373.030), off until you turn it on. No box is pre-ticked, nothing is hidden behind a design that steers you, saying no to the second decision costs you nothing but the companion, and saying no to the third costs you nothing. Inside the app, ovulation tracking, hair and intimate health are each a further switch of their own, off until you turn it on; turning one off stops its questions, and what you recorded stays until you delete it. Pelvic health is one too: off until you turn it on, and what you recorded stays until you delete it.
6. Your rights, and how to exercise them
- Confirm whether we hold your health data, access it and know who we shared it with: download everything from your profile ("Your data"), or write to us.
- Withdraw your consent: under "Your permissions" on your profile, or by writing to us. Withdrawing the first decision is the same request as deleting your account.
- Delete your health data: delete your account from your profile. It is immediate, and we then ask our processors to delete what they still hold.
- Appeal: if we refuse a request, write to privacy@tuneta.app with "appeal" in the subject; we answer within 45 days. If the appeal does not satisfy you, you can contact the Washington State Attorney General (atg.wa.gov).
Write to privacy@tuneta.app from your account's email address. We answer within 45 days (RCW 19.373.040), or sooner where the Privacy Notice, Section 8, gives a shorter deadline for your country. Exercising your rights is free, and we never treat you differently for doing so.
7. Contact
privacy@tuneta.app. See also the Privacy Notice and the Terms and Conditions.
8. Legal basis
Washington My Health My Data Act, RCW 19.373: policy contents, .020(1); consent to collect and to share, .030; rights, deadlines and appeal, .040; no sale without a valid authorization, .070; geofencing, .080.