Consumer Health Data Privacy Notice

1. Scope

This notice supplements our Privacy Policy. It applies to “consumer health data,” meaning personal information that is linked or reasonably linkable to a person and identifies or permits an inference about that person’s past, present, or future physical or mental health status.

AuDHD Stuff provides a self-directed educational screening and assessment-preparation tool. It is not a diagnostic or health-care service. Even when HIPAA does not apply, consumer health privacy laws may provide protections and rights described here.

2. Consumer health data we collect and why

• Screening responses and results: frequency selections, skipped or uncertain responses, and summaries related to ADHD- or autism-associated experiences. We use these to show the free result and let you choose what to do next.
• Detailed assessment responses: self-reported experiences, developmental history, timeline, functional impact, goals, support needs, helpful conditions, and wording edits. We use these to create and maintain the detailed report you request.
• Derived report content: non-diagnostic groupings, summaries, visual patterns, AI-assisted wording when selected, and edit history. We use these to present, revise, export, and download your report.
• Health-data choices and consent records: whether you chose private saving or optional AI processing and the version of the disclosure shown. We use these to honor your choices and document compliance.
• Account linkage: the account identifier used to keep saved health data private and accessible only to the signed-in owner. We use it for access control, export, and deletion.

We collect this information directly from you. Report content and summaries are derived only from information you provide. We do not import medical records, wearable-device data, pharmacy data, precise location, or information from data brokers.

Guest screening responses stay in your browser and are not collected into our application database. If you leave the assessment for email sign-in before checkout, a temporary browser-only copy preserves your progress for up to one hour and is removed when restored. We collect detailed health data into a private account only after you affirmatively choose saving or when necessary to deliver a paid feature you requested with the disclosure shown at that point.

3. Consumer health data we share

We do not sell consumer health data. We do not share it for advertising, profiling across unrelated services, data-broker activity, or employment, insurance, credit, housing, or law-enforcement decision-making.

We disclose the following categories only as necessary to provide the Service you request:

• Supabase: saved detailed-assessment responses, reports, revisions, consent records, and account linkage for authentication, database hosting, access control, and backups.
• Vercel: requests needed to run the web application and limited operational/security data. Our application is designed not to place assessment response content in ordinary hosting logs.
• Google Analytics: limited technical information and visits to public pages for aggregate traffic measurement. We do not send assessment answers, results, reports, account information, payment details, or profile identifiers to Google Analytics.
• OpenAI, only if you opt in: completed detailed-assessment responses needed to generate clearer report wording and the generated output. We exclude free-screening answers, router answers, email address, payment details, and internal account IDs.
• Professional advisers, incident responders, or authorities: only when reasonably necessary to protect users or the Service, respond to a security incident, establish or defend legal claims, or comply with valid legal obligations.

Stripe and Zoho Mail are not intended to receive consumer health data. Stripe processes payment and entitlement information without assessment content. Zoho Mail processes sign-in email without assessment content.

Specific affiliates receiving consumer health data: none at this time. If that changes, we will update this notice and obtain consent when required.

4. Your consumer health data rights

Subject to applicable law, you may:

• Confirm whether we collect, share, or sell your consumer health data.
• Access your consumer health data and receive a list of third parties and affiliates with whom it was shared.
• Withdraw consent from future collection or sharing.
• Delete consumer health data, including by requesting deletion be passed to relevant processors and other recipients when required.
• Appeal our refusal to act on a request.
• Exercise these rights without unlawful discrimination.

Signed-in users can download a private account archive, delete a saved assessment, or delete the account from the account area. You may also email info@audhdstuff.com. You do not need to create a new account to submit a request. We may request information reasonably necessary to authenticate you and protect the data from unauthorized access.

To appeal, reply to our decision with “Privacy appeal” in the subject line and explain why you believe it should be reconsidered. The appeal will be reviewed by someone not responsible for the initial decision when practicable. Our response will explain any further regulator or attorney-general contact available to you.

5. Withdrawing consent and deletion timing

You can avoid private collection by using the guest screening without saving. You can decline optional AI processing and still receive the complete non-AI detailed report. Withdrawing AI consent stops future submissions but cannot recall a request already sent.

When an in-app deletion succeeds, the active database copy is deleted. Saved assessments also automatically expire 90 days after the last successful save. Restricted provider backups may retain deleted records for up to 7 days before expiry; those backups are not available through the Service. OpenAI may retain prior opted-in requests for abuse monitoring for up to 30 days under the current provider configuration.

When applicable law requires us to notify processors or other recipients of a deletion request, we will do so. We may deny or limit a request only where permitted by law and will explain the basis and appeal process.

6. Changes to health-data practices

We will not collect, use, or share a new category of consumer health data, or use existing consumer health data for a materially new purpose, without first updating this notice and obtaining affirmative consent where required. Any authorization to sell consumer health data would have to be separate and distinct; the Service does not sell consumer health data.

7. Contact

Privacy requests, withdrawals, and appeals: info@audhdstuff.com

Operator: AGI Logic LLC, doing business as AuDHD Stuff
28716 Gilchrist Drive
Willowick, OH 44095
United States