Consumer Health Data Privacy Policy

A standalone policy for the health data ProAct collects -- separate from our general Privacy Policy, as required by Washington's My Health My Data Act and similar state laws.

Effective date: September 6, 2026

Who This Policy Covers

This policy is published by ColetonCodes LLC ("we," "us") for the ProAct iOS app and proactmigraine.com. It describes only our practices around consumer health data -- the category of sensitive data regulated by Washington's My Health My Data Act (RCW 19.373) and comparable laws such as Nevada's SB 370. Our general Privacy Policy covers everything else (device data, subscription data, and how the site as a whole works); this page is the detailed, health-specific companion to it.

Although this policy is written to satisfy Washington and Nevada-style consumer-health laws specifically, we apply the same practices to all users, in every US state, as a matter of policy -- not just where a specific statute requires it.

Consumer Health Data We Collect

We collect the following categories of consumer health data, directly from you or from Apple HealthKit with your device permission:

Direct entryAttack Logs

  • Timestamps, pain intensity, and pain character (e.g., throbbing, sharp)
  • Pain locations, symptoms, medications taken, and identified triggers
  • Relief methods used and your notes

Direct entryGuided-Routine Execution Records

  • When you complete a guided relief routine: pain intensity before and after, how much of the routine you completed (adherence), and your rating of it

From Apple HealthKitAggregated Health Metrics

  • Heart rate variability (HRV), resting heart rate, and sleep duration/quality -- collected as aggregated summaries, with your permission via the iOS HealthKit prompt
Raw samples never leave your phone. We never receive your raw HealthKit sensor readings -- only the aggregated summaries above, sent to generate a prediction and not retained afterward (see our Privacy Policy for how prediction requests are processed).

Generated by our AIMigraine Risk Estimates

  • The output of our prediction model -- a risk level (e.g., low, moderate, elevated, high) generated from the data above

Sources of This Data

  • You: everything you type or select in the app -- attack logs, routine ratings, notes
  • Apple HealthKit: aggregated heart-rate and sleep summaries, only after you grant the iOS HealthKit permission prompt

We do not purchase, license, or otherwise obtain consumer health data from any other source.

Why We Collect and Use It

Risk Estimates

Generate your migraine risk estimate, up to 48 hours ahead.

Pattern Reports

Identify patterns in your triggers, symptoms, and what relief methods help you.

Guided Routines

Recommend and track relief routines and how well they work for you.

The App, and Nothing Else

We use consumer health data only to provide the features you asked for. We do not use it for advertising, and we do not build advertising or marketing profiles from it.

We do not sell consumer health data. We never have, and we never will -- not for money, and not for any other kind of valuable consideration.

Who We Share It With

We share consumer health data only with the service providers strictly necessary to run ProAct, and only for the purpose of providing our service to you -- never for their own purposes, and never for advertising.

RecipientRoleWhat They Receive
SupabaseDatabase hostingStores attack logs, routine records, and risk estimates on our behalf
Anthropic (Claude)AI risk-estimate generationAggregated health metrics, processed transiently to generate one prediction -- Anthropic does not train on or retain this data
VercelApplication hostingInfrastructure provider for our servers -- passes data through, does not use it
PostHogUsage analyticsEvent metadata tied to your anonymous device ID, including a coarse severity category (mild/moderate/severe) and a risk-level category -- never symptoms, medications, triggers, or notes
SentryError trackingError reports only -- our error-reporting configuration filters known health-data fields before anything is sent
MetaAd measurementSubscription conversion events only (e.g., a trial started) -- never any consumer health data

We do not otherwise disclose consumer health data to any third party, and we do not disclose it to any affiliate for a purpose unrelated to providing ProAct to you.

Your Rights

  • Access: export all your data, including consumer health data, from Settings in the app at any time.
  • Deletion: request account deletion from Settings in the app. After a 7-day cooling-off period (during which you can cancel the request), we permanently delete your attack logs and guided-routine records from our systems outright -- we do not keep an anonymized or archived copy.
  • Withdraw consent: revoke ProAct's HealthKit permission at any time in iOS Settings > Privacy & Security > Health, and/or simply stop entering data in the app. Withdrawing consent does not affect data we already processed before you withdrew it.
  • Appeal: if we deny a request you've made under this policy, you can appeal (see below).

How to Exercise These Rights

Access and deletion are self-service in the app (Settings). For anything else, or if the in-app flow does not work for you, email support@proactmigraine.com. We will respond within 30 days.

Appeals

If we deny a request, we will tell you why and how to appeal. To appeal, email support@proactmigraine.com with "Appeal" in the subject line. We are a small, solo-operated team, so we cannot promise a decision by a different individual within a separate team -- but every appeal gets a genuine second look, with fresh eyes, from someone reviewing the original decision again rather than simply restating it. We will respond in writing within 30 days of receiving your appeal. If we still deny your request, we will tell you that you may contact the Washington State Attorney General's office to file a complaint.

Which Laws This Policy Is Written For

This policy is written to meet the standalone-policy and content requirements of Washington's My Health My Data Act (RCW 19.373) and similar consumer-health-data laws in other states, such as Nevada's SB 370. As noted above, we extend the same practices to every ProAct user in the United States, regardless of which state's law would otherwise apply to you.

Changes to This Policy

We may update this policy as our service evolves. For material changes, we'll notify you through the app before they take effect. Your continued use after changes means you accept the updated policy.

Contact Us