Consumer Health Data Privacy Policy

This policy explains how Todd Lahman LLC, which makes Puff Pacer, handles consumer health data under Washington's My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (NRS 603A). It applies to anyone whose consumer health data we receive. Our Privacy Policy covers everything else.

The short version

The data in the Puff Pacer App stays on your device, and we never receive it. The only consumer health data we receive is what you choose to tell us when you write to us. We use it only to answer you, we never sell it, and you can ask us to delete it at any time.

What we collect, and why

• Messages you send us. When you write through the support or contact form on this website, or by email, we receive your name, your email address, and your message. If your message mentions your nicotine use, your plan, nicotine replacement products, your mood, or other health details, that is consumer health data. We use it only to read and answer your message and to fix any problem you report.
• Nothing from the App. Your logs, plan, check-ins, mood, selfies, and any Apple Health or Health Connect readings are processed on your device. On iPhone, iPad, and Mac they stay there; on Android, an optional backup goes only to your own Google Drive app storage, which we cannot read. None of it reaches us unless you paste or attach it in a message to us.
• Purchases. Apple or Google processes your purchase under its own privacy policy. We receive order and sales records from them, never the data in the App.
• This website. Vercel Web Analytics counts page views anonymously, without tracking cookies, and doesn't identify you. We don't use it to infer anything about your health.

Where it comes from

Only from you: what you type into our forms or send us by email. We don't buy data, and we don't collect it from other sources.

What we share, and with whom

We don't sell consumer health data, and we don't share it for advertising. Your message (with your name and email address) is handled for us by these service providers, only so it can reach us and be answered:

• Website hosting and form processing: Vercel Inc. (US)
• Email delivery: Twilio SendGrid (US)
• Email inbox: Google (Gmail, US)
• Spam protection on the forms: Cloudflare (Turnstile, US), which checks that a person is sending and never receives your message

We have no affiliates that receive it. We would disclose it to anyone else only if the law required us to.

Your consent

The support and contact forms ask you to agree, before you send, that we may use any health details you include only to answer you. You can withdraw that consent at any time; we then delete your messages.

How long we keep it

Only as long as we need to answer you. You can ask us to delete it sooner, at any time.

Your rights

You can ask us to:

• confirm whether we collect, share, or sell your consumer health data, and give you a copy of it;
• give you the list of every third party and affiliate we have shared it with, and how to contact them;
• correct it;
• delete it (we also tell the service providers above to delete it); and
• stop using it, by withdrawing your consent.

Send your request through our contact form, starting the message with “Health data request”, from the email address you used when you wrote to us, so we can tell the request is yours. If we can't confirm that, we may ask you for more information before we act. Requests are free, up to twice a year. We answer within 45 days; if we need more time, we will tell you why within those 45 days and take at most 45 more.

Appeals

If we turn down your request, reply to our answer with “Appeal”. We will tell you in writing, within 45 days, what we decided and why.

Other things we never do

We don't sell consumer health data, use it for advertising, or set up geofences around places that provide health care.

Changes to this policy

If we change this policy, we update the date at the top. Before a material change takes effect, we describe it on this page.

Contact

Todd Lahman LLC, through our contact form.