Scope. This notice supplements the Hues Within Privacy Policy for people in the United States. A Washington resident, or a person whose consumer health data is collected in Washington, should also read the separate Washington Consumer Health Data Privacy Policy. This notice addresses health-data requirements in Connecticut, Nevada, California, and other applicable U.S. law. Rights and exceptions vary by state.
Insights is optional and off until you turn it on. It analyzes your recorded answers on this device, including frequently used tag suggestions. This choice is separate from accepting the Terms and consenting to sensitive-data processing. With Insights off and the required consent in place, you can still record, read History and export recorded information; new reports omit analysis.
Turning Insights off does not delete records or files already created or shared. The choice applies on this device before it is sent to your account. Offline choice records are saved for retry. If the device cannot save the choice, it may not remain off after restarting. Withdrawing sensitive-data consent is a separate choice: check-ins, History, Insights and backup pause until you consent again. Privacy information, support and urgent-support information, Apple subscription management, sign-out, account deletion and the applicable guest-erasure control remain available.
Where information is kept. Your working records stay on your device. With an account and the required sensitive-data consent, Hues Within also backs up saved check-ins, personal details (including an optional birthday), current and past prescriptions, custom questions and tags, and app settings. Settings include tracking and comparison choices, language, reminders, touch feedback, seasonal effects and app lock. Period and medication answers are included in their saved check-ins.
What remains specific to a device. Insights and phase estimates are calculated on your device. Exports are separate copies. A new phone needs its own notification permissions and unlock method; device passcodes and biometric credentials are not backed up. Pending changes retry when synchronization is available. An offline or failed backup is not a confirmed account copy.
Signing out. Signing out keeps your account and backups. Records are cleared from the phone only after their backup is confirmed. Otherwise they remain in this account’s separate storage on the phone for your next sign-in. If local cleanup fails, you remain signed in to retry.
Deleting your account. Account deletion removes active Hues Within backups. Provider recovery copies, limited purchase and Apple sign-in records, and files saved or shared outside the app have separate retention limits below.
Records erasure. Erasing recorded data while keeping an account is currently unavailable.
1. Consumer health and medical information
Depending on applicable law, consumer health or medical information may include:
- mood, emotional wellbeing, symptoms, daily functioning, sleep, movement, activities, self-care, notes, emotions, and custom answers;
- medication or treatment names, doses, schedules, history, changes, and reported use;
- menstrual-cycle records, settings, and calendar-derived estimates;
- age, country, gender identity, and other health-related profile context;
- descriptive patterns, comparisons, summaries, and inferences created from recorded dates;
- account, authentication, entitlement, transaction, device, and security records that may reveal use of a health app;
- support or privacy-rights correspondence; and
- limited public-site request and security logs that may reveal an interest in a health-related service.
2. Purposes and sources
Hues Within uses these categories to store and display records; provide optional medication and cycle features; when Insights is enabled, create descriptive insights and comparisons without diagnosis or causal claims; create reports or share images only when requested; privately back up and restore saved check-ins, personal details, prescriptions, custom questions and tags, and app settings for signed-in users; authenticate accounts; verify and restore Plus access; secure and troubleshoot the service; respond to support and rights requests; and meet legal obligations.
Information comes from you; from Hues Within’s operation on your device and the outputs generated from your entries; from Apple when you choose Apple sign-in or an App Store purchase; from Supabase service events for account and signed-in functions; and from support or rights messages you send.
3. Sharing, sales, targeted advertising, and large-language-model training
Hues Within may provide the minimum information needed to:
- Supabase for authentication, signed-in backup and restoration, deletion reconciliation, entitlements, security, and server functions;
- Apple for Apple sign-in and App Store purchasing, billing, restoration, and entitlement functions you choose;
- Google Workspace for support or privacy-request messages, participants, attachments, and related delivery and security metadata;
- public-site hosting infrastructure for limited request and security logs needed to deliver and protect the website;
- a recipient you select when you save or share an export or image; and
- authorities or professional advisers when lawfully permitted or required, needed to protect rights or safety, or needed to investigate an incident.
Hues Within has no corporate affiliates. It does not sell consumer health or medical information, use it for targeted advertising, share it with data brokers, employers, or insurers, or permit third-party advertising or analytics companies to collect it over time across unrelated sites or services. Hues Within does not collect, use, or sell personal data to train large language models, and it does not use private records to train, fine-tune, evaluate, prompt, or otherwise supply an artificial-intelligence model.
4. Consent and withdrawal
Hues Within requests separate affirmative consent for sensitive-data processing. The consent identifies the categories and purposes and is not bundled into the Terms. Where law requires a distinct sharing or sale authorization, Hues Within will obtain it before that activity. Hues Within does not sell health information.
You may withdraw consent through the consent control in the app’s Settings or by contacting the Privacy Lead. For a Connecticut consumer, processing covered by the withdrawal will stop as soon as practicable and no later than 15 days after receipt, subject to legally permitted processing. Withdrawal is not retroactive and is separate from deletion.
5. Rights
Depending on your state and subject to legal exceptions, you may have the right to confirm processing; access information, including eligible inferences; correct inaccuracies; delete information; receive eligible data in a portable format; obtain a list of relevant third parties; withdraw consent; direct Hues Within to stop collecting, sharing, or selling covered health data; opt out of covered sale, targeted advertising, or significant-effect profiling; and appeal a refusal.
Hues Within does not use personal data to make legal or similarly significant decisions about healthcare, employment, insurance, credit, housing, education, or access to essential services.
6. Submit a request
Email hello@hueswithin.com with the subject “U.S. consumer health data request.” Include your name, account email if any, your state, the right you want to exercise, a clear description, and the email where you want the response. Do not send journal entries, medication details, passwords, or unnecessary health information. Hues Within may verify through the signed-in account, account email, a one-time code, or another proportionate step. You do not need to create a new account.
Records kept only on your device are not accessible to Hues Within. Use the in-app export, individual-deletion, or erase controls for records Hues Within never receives.
7. Response, deletion, and fees
For Connecticut and Nevada requests, Hues Within will respond within 45 days as measured by the applicable law and may extend once by 45 days when reasonably necessary, with timely notice and the reason. Requests are free at least twice in any 12-month period. Where a request is manifestly unfounded, excessive, or repetitive, Hues Within may charge a reasonable fee or decline to act only as the applicable law permits.
For a verified Nevada deletion request, Hues Within will delete covered data from active records and networks within 30 days after authentication and notify the affiliates, processors, contractors, and other third parties required by law. Archived or backup information will be deleted as required, no later than the applicable statutory period. The separate Washington policy states Washington’s shorter backup requirement.
8. Appeal
If Hues Within declines to act, the response will explain why and how to appeal. Email hello@hueswithin.com with the subject “U.S. consumer health data appeal” and include the date of the original request and decision and a short explanation. Do not include health details unless necessary. Hues Within will respond in writing within 45 days with its decision and reasons. If the appeal is denied, the response will explain how to contact the attorney general in your state, including the Connecticut Attorney General or Nevada Attorney General, as applicable.
9. California confidentiality
California law may treat individually identifiable information from a mental-health or reproductive-health digital service as medical information for specified confidentiality purposes. Hues Within maintains that information confidentially and will not disclose it except as authorized by you or as otherwise permitted or required by applicable law. If a California medical-information authorization is required, Hues Within will use the separate form and content required by California law rather than treating general Terms or Privacy acceptance as authorization.
10. Security incidents
If suspected unauthorized access, acquisition, or disclosure occurs, Hues Within will assess it under applicable state breach laws and the Federal Trade Commission’s Health Breach Notification Rule where it applies. Hues Within will notify affected people, regulators, and others within the periods and by the methods required by applicable law.
11. Changes
This notice states its most recent update above. A material change will be posted here with a new effective date and communicated through an in-app notice before it is applied; Hues Within may also email signed-in users when appropriate. Hues Within will provide an opportunity to withdraw consent before applying a material change retroactively. New health-data categories, purposes, or recipients will be disclosed and any required consent will be obtained.
12. Contact
Cynthia Salinas Treviño is the Privacy Lead for Hues Within. Email: hello@hueswithin.com. Legal domicile: Manuel Alanis 6, Col. Lomas del Hipico, 64989 Monterrey, Nuevo León, Mexico.