Consumer Health Data Notice
This notice supplements the Privacy Notice for Washington residents and anyone whose applicable United States law gives similar consumer-health-data rights.
What this notice covers
“Consumer health data” can include personal information that identifies a person's physical or mental health status, symptoms, diagnoses, treatment, medication, reproductive or sexual health, gender-affirming care, biometric information, or an inference about health. Ordinary study notes can fall within that definition when they are about an identifiable person.
Foky does not intentionally collect health records, data from a health provider or wearable, precise location, biometric templates, or information about visits to a health facility. Device-only content is processed locally unless you choose a feature that sends it from the device.
Categories and sources
- health-related text or selected PDF pages that you put in a deck, card, note, prompt, support message, report, or shared deck;
- health-related content another Foky user sends to you through a deck share or expressly includes in a report;
- an AI output or study item that may infer or restate health information from material you chose to send; and
- the account identifier, request metadata, and security records needed to provide and protect the requested feature.
Why Foky processes it
Foky processes this information only as reasonably necessary to:
- provide local study functions you choose;
- sync study content after you separately enable study sync;
- make an adult-only Anthropic request after the per-use disclosure and confirmation;
- share a deck with the accepted Friend you select;
- respond to support, a rights request, or a report you submit; or
- secure Foky, investigate abuse, protect a person, or comply with law.
Foky does not use consumer health data for advertising, profiling, or an unrelated purpose. It does not sell consumer health data or use a geofence around a health-care facility.
Who may receive it
Hany Jiang has no affiliates. Depending on the feature you deliberately use, the following processors or recipients may receive the minimum relevant information:
- Supabase, for authenticated study sync, storage, server functions, and security;
- Anthropic, for the specific adult-only AI input and output you confirm;
- an accepted Foky Friend you select, for a deck share or independent deck import;
- Cloudflare Email Routing and iCloud Mail, if you put the information in an email to Foky; and
- a court, regulator, law-enforcement or emergency recipient when reasonably necessary and permitted or required by law.
Foky does not intentionally send study or health content to Apple, Google, RevenueCat, Cloudflare's legal-site hosting, or Resend report alerts. Those providers may process the separate operational information described in the main Privacy Notice.
Your choices and rights
Use Settings → Privacy & Data or email [email protected] to ask whether Foky holds consumer health data about you, access it, obtain a list of recipients, withdraw a choice, correct it, export it, or delete it. You do not need to create a new account to make a request. Foky may authenticate an existing account or verify control of its email.
Study-sync withdrawal queues deletion of synced study content. Account deletion requests deletion from active Foky systems and applicable processors. At launch, encrypted database backups are configured to rotate within 30 days; Foky will not accept United States production accounts until that setting and the relevant provider terms have been verified. A recipient-owned imported deck or copy you separately exported is outside Foky's control. If Foky refuses or only partly fulfils a request, the response will state the reason and how to appeal by replying to [email protected]. Foky will not unlawfully discriminate against you for exercising a right.
Retention and changes
Health-related content follows the retention rule for the feature containing it in the main Privacy Notice. Withdrawing study sync queues deletion of the synced copy, but does not delete the only local copy on your device. Local study content remains until you delete it, bind a different account, perform a full reset or account deletion, remove the app's data, or remove it through a feature that expressly says it deletes local content. An adult AI request follows the AI rule; support and case records follow their stated case periods. Foky will not collect, use, or disclose a new category for a new purpose without updating the applicable notice and obtaining any consent the law requires.
Contact
Hany Jiang, developer, operator, and Privacy Officer for Foky
Toronto, Ontario, Canada
[email protected]
This notice describes Foky's launch commitments. Foky does not provide health care, and this notice is not a legal opinion about whether a particular law applies.