Consumer Health Data Privacy Policy

Effective date: July 6, 2026

This Consumer Health Data Privacy Policy explains how GutPattern (operated by GutPattern) handles consumer health data. It supplements our main Privacy Policy; where this policy addresses consumer health data specifically, it applies. It exists to support state consumer-health-data laws, including Nevada (SB 370), Washington’s My Health My Data Act (MHMDA), and Connecticut’s Data Privacy Act.

GutPattern is not a HIPAA-covered entity. The information you share is governed by this policy and our main Privacy Policy, not by HIPAA.

What we mean by “consumer health data”

Consumer health data is information that identifies your past, present, or future physical or mental health status. On GutPattern this includes the symptoms, conditions, treatments, supplements, diagnoses, outcomes, and health narratives you choose to share, along with related details in your profile (such as sex or age) and any inferences drawn from them.

The consumer health data we collect

Health stories and contributions — symptoms, conditions, treatments, timelines, outcomes, comments, and updates you post.
Profile health details — optional demographic fields you provide.
Consent records — your opt-in choices for anonymous GutPattern insights, de-identified data licensing, and practitioner matching, and when you made them.

We collect this data directly from you when you create an account, write or update a story, or set your preferences. We do not buy consumer health data about you from third parties.

How and why we use it

To display your story and show relevant patterns and stories on the site.
To structure your submitted text into symptoms, treatments, and outcomes.
Where you opt in, to improve anonymous GutPattern insights and build de-identified licensed datasets.
Where you opt in, to enable practitioner matching.
To operate, secure, and support the Service.

We use consumer health data for these purposes only with your consent, and only as described here and in our Privacy Policy.

Service providers / processors that help us run GutPattern (hosting, database and authentication, email delivery, automated text processing, and analytics). They act on our instructions under contract and may not use your data for their own purposes.
Practitioners or providers, only if you opt in to practitioner matching and only the details needed for them to follow up with you.
Outside organizations, only in de-identified form, and only where you have opted in to licensing.

We do not sell consumer health data that identifies you. The only situation where identifiable health information leaves GutPattern is the practitioner matching you specifically request. We will not sell consumer health data without the valid authorization required by applicable law.

Collecting and sharing your consumer health data beyond what’s necessary to run the Service is opt-in.
You provide affirmative consent when you enable anonymous insights, de-identified data licensing, or practitioner matching.
You can withdraw consent at any time in your account settings or through Contact. Withdrawing consent stops future collection or sharing for that purpose; it doesn’t undo processing already carried out, and copies already included in de-identified licensed datasets may not be retrievable.

Your rights

Depending on your state, you have the right to:

Confirm whether we are collecting, sharing, or selling your consumer health data, and access it.
Withdraw consent to collection or sharing.
Delete your consumer health data. When you delete a story or your account, we remove it from public display and from future licensed datasets.
Not be discriminated against for exercising these rights.
Appeal a decision we make about your request.

To exercise a right, use the Contact page. We’ll verify your identity and respond within the timeframe the law requires. You may authorize someone to make a request on your behalf.

Retention

We keep consumer health data for as long as your account is active or as needed to provide the Service, then delete or de-identify it within a reasonable period, except where the law requires us to retain certain records. De-identified licensed data may be retained.

Security

We apply reasonable administrative, technical, and organizational safeguards, including access controls and encryption in transit. If a breach affects your consumer health data, we will notify you and the relevant authorities as required by law.

Changes to this policy

We may update this policy as GutPattern grows. When we make material changes, we’ll update the effective date above and, where appropriate, notify account holders.

Contact

Questions, or want to exercise a right over your consumer health data? Reach us through the Contact page.