Consumer Health Data Privacy Policy
Last updated: October 20, 2026
This is a separate policy about one specific kind of information: consumer health data. It sits alongside the main Privacy Policy rather than replacing it, because Washington’s My Health My Data Act and Nevada’s equivalent law both ask for this to be its own document with its own link. If the two ever disagree, this page governs consumer health data and the Privacy Policy governs everything else.
What counts as consumer health data here
Buhata is a life tracker, not a medical app, and it holds no diagnosis, no clinical record and no information from any healthcare provider. The information below is what a person types into Buhata about their own body and habits, and it is treated as consumer health data because these laws define that term broadly:
- Weight, where you log it.
- Water intake, where you track it.
- Mood, as one word for the day, where you pick it.
- Workouts, as a schedule: which workouts you planned for which days, and a tick when a planned one is done. There are no workout details and no notes.
- Anything you choose to write into a note, list or journal entry that describes your health, if you put it there.
Buhata keeps none of the first four until you agree. The first time you open the weight, water, mood or workout screen, the app says what is kept, who sees it and where it lives, and asks for your explicit consent. It records the date and the version of that wording against your account and includes the record in your data export. You can withdraw in Settings at any time, which deletes those entries from every device and from your account.
Buhata has no menstrual, fertility, pregnancy or reproductive health tracking of any kind. It has no symptom log, no medication tracker, and no diagnosis field. We do not infer a health condition from anything you enter, and we do not build health profiles.
How it is collected
Only from you, and only when you enter it. Buhata does not read health data from Apple Health, Google Fit, a wearable, or any other app, and it does not buy or receive health data from anybody. If a field is blank it is because you left it blank, and leaving it blank costs you nothing else in the product.
Why we hold it
To show it back to you. That is the entire purpose. A weight log exists so you can see the line, and a water count exists so you can see the streak. We do not use it to advertise, to score you, to train any model, or to make any decision about you.
Who we share it with
Nobody, for their own purposes. Buhata doesn’t use consumer health data for advertising, and it doesn’t disclose it to any third party to use for itself.
Two narrow exceptions, both of which are processing on our behalf rather than sharing: the hosting and database providers that run Buhata store it as part of storing your account, under contracts that forbid them from using it for anything else; and if you share a list or a space with someone yourself, they see what you put in it, because that is what sharing means. Money, health and journal entries stay private to you on every plan and are never included in a shared space.
Selling consumer health data takes a separate authorization signed by the person it’s about, apart from this policy and the Terms. Under Washington’s law the authorization has to say what would be sold, who would buy it and why, and the date it runs out, a year after signing at most, and it can be revoked at any time. Nevada’s law asks for a signed authorization too. Sharing it with a third party for their own purposes takes your consent first, asked for on its own. Buhata hasn’t asked anybody for either.
If Buhata LLC merges with another company, is bought, or sells all or part of its business, consumer health data can pass to whoever takes the business on only under this policy, and the Privacy Policy says how you’d be told about anything different.
How long it is kept
In your account, until you delete it or delete the account, whichever comes first. Deleting your account erases it at once, Restore Points included, and no anonymized residue is kept for analysis. One copy outlives the account, inside the encrypted backups of our whole database, which nobody can sign in to and which are never used to restore one account.
Your rights over it
- To know what consumer health data we hold about you, which you can see in the app at any time because it is the same screen you entered it on.
- To withdraw consent to collection, which you do by stopping entering it, and by deleting what is already there.
- To delete it, either entry by entry in the app, or entirely by deleting your account from inside the app or from the account deletion page.
- To have that deletion reach our providers, which it does for our live database and your Restore Points the moment you delete your account. The encrypted backups of our whole database still hold a copy, which is never used to bring your account back.
- To appeal if we refuse a request, by writing to the address below. We will answer in writing and tell you how to escalate to your state attorney general.
We will answer a request within 45 days, and will tell you before that if we need longer. Exercising any of these rights costs nothing and does not change what the product does for you.
Who to contact
Health data requests: [email protected]. Put “health data” in the subject line so it is routed correctly.
Buhata LLC, United States. Our full postal address is in the Terms.
You may also complain to the Washington State Attorney General, the Nevada Attorney General, or your own state’s attorney general, and you do not need to come to us first.