LEGAL
DRIFTY CONSUMER HEALTH DATA PRIVACY POLICY
Required by the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act as amended
Version 1.0
Effective Date: September 22, 2026
Last Updated: September 22, 2026
1. WHO THIS APPLIES TO
This policy applies to consumer health data that Drifty, Inc. ("Drifty") collects about: residents of Washington State; consumers whose consumer health data is collected in Washington; residents of Nevada; and residents of Connecticut and other states whose laws regulate consumer health data. It supplements, and where it conflicts it controls over, the Drifty Privacy Policy with respect to consumer health data.
"Consumer health data" means personal information linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, including bodily functions, vital signs, symptoms, measurements, and any information derived or extrapolated from non-health information through an algorithm.
This policy does not apply to employees or contractors acting in their employment capacity, or to data governed by HIPAA, the Common Rule, or other exempt frameworks.
2. THE CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT
| Category | Specific data |
|---|---|
| Sleep measurements | Sleep session start and end times, duration, platform-derived sleep stage estimates, wake events |
| Cardiac and respiratory signals | Heart rate, heart rate variability, and, where your device supplies them, blood oxygen saturation and respiratory rate |
| Bodily movement | Accelerometer and motion signals, body position and repositioning events |
| Acoustic event classifications | On-device classifications of sleep-related sounds (for example, a snore-like or disturbance-like event), each with a timestamp and confidence value. Raw audio is processed in real time on-device, is immediately discarded, and is never stored or transmitted |
| Derived measures and inferences | Personal baselines, composite disturbance confidence scores, multi-night trends, pattern alerts |
| Intervention and response data | Haptic cue delivery events, escalation stage reached, response and override events, alarm and wake-gate events |
| Self-reported information | Sleep goals, morning check-ins, journal entries, symptoms you choose to record |
| Health-related settings | Feature toggles, haptic intensity, sleep window, and other preferences that reveal health-related choices |
We do not collect: precise geolocation; biometric identifiers used to identify you; genetic data; reproductive or sexual health data; gender-affirming care data; diagnoses, prescriptions, or clinical records; payment data for health services; or any consumer health data about anyone under 18.
3. HOW WE COLLECT IT
- From your device sensors, with your permission, during a sleep session that you start or schedule
- From the platform health data store (Apple HealthKit), only for the specific data types you authorize, read on-device
- Directly from you, when you enter goals, check-ins, journal entries, or support messages
- From a third-party wearable or service that you explicitly connect
- Derived by us, when our on-device algorithms compute baselines, scores, trends, and event classifications from the signals above
We do not purchase consumer health data, and we do not obtain it from data brokers.
4. WHY WE COLLECT AND USE IT
| Purpose | Consumer health data used |
|---|---|
| Provide the features you turn on: disturbance detection, haptic repositioning cues, graduated wake sequences, wake-gate alarm | All sensing and derived categories |
| Compute your personal baselines and present retrospective, non-diagnostic insights and trends | Sleep, cardiac, respiratory, motion, event classifications |
| Present non-diagnostic pattern alerts encouraging professional follow-up on persistent multi-night instability | Derived measures |
| Tune haptic intensity, thresholds, and escalation to your responses | Intervention and response data |
| Diagnose technical defects and validate that features work correctly | Event and intervention logs, diagnostics |
| Improve and validate our models, only where you have separately opted in | Contributed data, de-identified wherever feasible |
| Respond to your support requests | Whatever you send us |
| Comply with law and respond to lawful process | Whatever is legally required |
We do not use consumer health data for advertising, marketing to you based on your health status, profiling, insurance, employment, credit, or any decision about your eligibility for anything. We do not use consumer health data obtained from HealthKit for any purpose other than health, fitness, and wellness features you have enabled.
5. WHO WE SHARE IT WITH
| Recipient category | What they receive | Why |
|---|---|---|
| Cloud hosting and storage providers | Only consumer health data that leaves your device because you enabled an optional cloud feature or opted into research contribution, in encrypted form | Storage and processing on our instructions |
| Crash, error, and diagnostic providers | Technical logs; configured to exclude health data fields | Reliability and defect repair |
| Customer support providers | Only what you include in a support message | Answering your request |
| Legal, regulatory, and safety recipients | Only what is legally compelled or necessary to protect rights and safety | Legal compliance |
| Acquirer in a corporate transaction | Subject to Section 9 below | Business continuity |
Every recipient acts as a processor under a written contract that limits it to our documented instructions, prohibits any secondary use, requires confidentiality and security, and requires deletion or return on termination. A current list of the specific affiliates and processors that receive consumer health data is available on request at driftyteam1@gmail.com, and we will provide it within 45 days.
We do not share consumer health data with advertisers, data brokers, analytics networks that combine it with other datasets, insurers, or employers.
6. WE DO NOT SELL CONSUMER HEALTH DATA
Drifty does not sell consumer health data, and has never done so. Under Washington law, selling consumer health data requires a separate, signed, specific valid authorization from you, which is distinct from consent. We do not seek such authorizations. If Drifty ever proposes to sell consumer health data, we will first obtain a valid authorization that: identifies the specific data, names the purchaser, describes the purpose, states that the data may be subject to redisclosure, sets an expiration date no more than one year out, and tells you how to revoke. You would be under no obligation to sign, and we would not condition the Services on signing.
7. NO GEOFENCING
Drifty does not implement, and will not implement, a geofence around any healthcare facility, sleep clinic, hospital, pharmacy, or other health service location for any purpose, including identifying consumers, tracking them, collecting consumer health data, or sending notifications, advertisements, or messages related to consumer health data. The App does not collect precise geolocation at all.
8. YOUR RIGHTS OVER CONSUMER HEALTH DATA
You have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom we have shared it, together with an active email or other contact for each.
- Withdraw consent to our collection and sharing of your consumer health data, at any time, for any category.
- Delete your consumer health data. On receipt of a verified deletion request, we will delete it from all of our systems, including archived and backup systems, and will notify all processors, affiliates, contractors, and other third parties to which we have provided it, directing them to delete it as well. We will confirm completion to you.
- Not be discriminated against for exercising any of these rights.
- Appeal a denial.
How to exercise them
- In the App: Settings, then Privacy, to revoke permissions, disable features, export data, or delete your account and data.
- By email: driftyteam1@gmail.com with the subject "Consumer Health Data Request."
We will respond within 45 days of receipt, extendable once by 45 days where reasonably necessary, with notice to you within the initial 45-day period. Requests are free (up to twice per year per consumer). We verify requests by confirming control of the account email and may request additional matching information for deletion requests. An authorized agent may act for you with written authorization.
Appeals. If we deny a request, our response will explain why and how to appeal. Send appeals to driftyteam1@gmail.com with the subject "Consumer Health Data Appeal." We will decide within 45 days and, if we deny the appeal, provide a method to contact the Washington Attorney General (or your state attorney general) to submit a complaint.
Note on device-local data. Most consumer health data never leaves your device. Deleting the App, or using the in-App delete function, removes local event logs and baselines. Data in the platform health store (Apple Health) is controlled by you through platform settings and is not deleted by Drifty.
9. RETENTION AND SECURITY
- Raw audio: not retained, discarded in real time
- On-device event logs and baselines: retained on your device until you delete them
- Server-side consumer health data (only if you enabled an optional cloud feature or research contribution): retained until you withdraw consent or request deletion, and then removed from production within 30 days and from backups within 90 days
- Access is restricted to the minimum number of employees and contractors for whom access is necessary to provide the Services, each bound by confidentiality obligations and subject to role-based access controls, multi-factor authentication, and audit logging
- Consumer health data is encrypted in transit and at rest
Corporate transactions. If Drifty is acquired, merged, or sells assets, any successor will be contractually bound to honor this policy for consumer health data collected before the transaction, and we will notify you in advance and provide an opportunity to delete your data before the transfer completes.
10. CHANGES AND CONTACT
We will not collect, use, or share any category of consumer health data, or use it for any purpose, not disclosed in this policy. If we intend to do so, we will update this policy, notify you, and obtain your prior consent where required.
Drifty, Inc.
TO BE COMPLETED: registered business address
driftyteam1@gmail.com
Drifty is a general wellness product. It does not diagnose, treat, cure, or prevent any disease or condition, and it is not a substitute for professional medical advice. If you have concerns about your sleep or breathing, talk to a qualified healthcare provider.