Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Digital Biology LLC (“DigitalGut,” “we,” “us,” or “our”) collects, uses, and shares consumer health data through digitalgut.io. It supplements our Privacy Policy and applies to residents of states with consumer-health-data laws, including Washington (My Health My Data Act), Nevada (SB 370), and Connecticut (Connecticut Data Privacy Act). In the event of a conflict regarding consumer health data, this Policy controls for those residents.

1. What is consumer health data

“Consumer health data” is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For DigitalGut, this can include the gut-microbiome test results you upload, the measurements and taxa in them, any health-related notes or questions you provide, and the interpretations, scores, and inferences we generate from that data.

2. What we collect, and from where

We collect consumer health data:

• directly from you — when you create an account, upload or enter test results, ask questions, or contact us; and
• as inferences we create — when our systems compute scores, summaries, and insights from your data.

We may also create aggregated or de-identified data that is not linked to you; that data is not consumer health data.

3. How we use consumer health data

We use consumer health data only to:

• provide the service you requested — generate and display your reports, stories, action plans, and answers;
• maintain, secure, debug, and improve the service;
• provide customer support; and
• comply with our legal obligations.

4. How we share consumer health data

We do not sell your consumer health data. We share it only:

• with service providers / processors — such as cloud hosting and storage and the third-party AI providers that generate your interpretations — who are contractually bound to process it only on our behalf, to keep it confidential and secure, and (for AI providers) not to train on or retain it beyond returning a result;
• with your consent or at your direction — for example, when you choose to share or export a report;
• to comply with law — in response to a valid legal request, or to protect rights, safety, or property; and
• in a business transfer — as part of a merger, acquisition, or sale of assets, subject to this Policy.

5. Your rights

Depending on your state of residence, you have the right to:

• Confirm and access the consumer health data we have collected about you;
• Delete your consumer health data;
• Withdraw consent to our collection and sharing of your consumer health data (Washington and Nevada); and
• Correct inaccurate data and opt out of targeted advertising and certain profiling (Connecticut).

We will not discriminate against you for exercising these rights. Note that deleting your consumer health data or withdrawing consent will typically mean we can no longer provide the parts of the service that depend on it.

6. How to exercise your rights

Submit a request by emailing [email protected]. To protect your data, we will take steps to verify your identity and residency before responding. We aim to acknowledge requests within 10 business days and to respond within 45 days; where reasonably necessary, we may extend that period and will let you know. You may appeal a decision by replying to our response; if your appeal is denied and you are a Connecticut resident, you may contact the Connecticut Attorney General. An authorized agent may submit a request on your behalf with proof of authorization.

7. Changes to this Policy

We may update this Policy from time to time. Changes take effect when posted, with an updated “Last updated” date above. Please review it periodically.

8. Contact

Questions about this Policy or your consumer health data? Contact Digital Biology LLC at [email protected].