Consumer Health Data Notice

Last updated October 8, 2026

This notice explains how myStuf, LLC ("myStuf", "we") handles consumer health data in myStuf, the myStuf lite apps (including medStuf), yourStuf and myStuf Online. It's written for Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data rules and similar laws, but the promises in it apply to everyone who uses myStuf. It adds to our Privacy Policy, which covers everything else.

In short: you put health information into myStuf yourself, we use it only to keep it for you and the people you share it with, we never sell it, and you can delete it at any time.

The health data we collect

We only have the health information you or the people sharing with you choose to enter. Depending on what you use, that can include:

medical records: conditions, allergies, surgeries, immunizations, family history and notes;
doctor and care visits, test results and the doctors and care locations you list;
medications, doses, schedules, refills and the reminders for them;
glucose readings and related notes;
health-related photos, documents and voice recordings you attach, such as an insurance card or a lab report;
health details about people you care for, such as a child or a parent;
health questions you ask Ask, the AI assistant, if you've turned it on.

We don't collect health data from sensors, fitness trackers, other apps or your location, and we don't infer health information from anything else you do.

Where it comes from

Directly from you, or from someone who shares a collection with you. When you look up a medication by name, the name is sent to the U.S. FDA's openFDA service and the public label details it returns are added to your record. That lookup sends only the medication name, never who you are.

Why we collect it and how we use it

To store it, sync it to your devices and myStuf Online, and back it up.
To show it to you and the people you choose to share it with.
To remind you of medications, appointments and other things that are due.
To answer your questions in Ask, only if you've turned Ask on and haven't left health collections out of it.
To keep the service secure and fix problems.

We don't use health data for advertising, marketing, research, profiling or training AI models, and we never will without asking you first.

Your consent

We collect and use health data only as needed to provide the features you choose to use. Anything else would need your separate, clear consent first. You can withdraw consent at any time by deleting the information, leaving it out of Ask, turning Ask off or deleting your account.

Who we share it with

People you choose. When you share a collection, the people you invite can see it, or edit it if you allow that. You can stop sharing at any time.
Your company, for yourStuf. Admins of a company's yourStuf can see and manage that company's collections, including any health information in them.
Service providers that process it only on our instructions, under contracts that forbid any other use:
- Render hosts our servers and database, where health information is encrypted.
- Cloudflare stores encrypted photos, files and backups.
- Anthropic answers Ask questions, and receives health details only if you've let Ask use them.
The law. Only if we're legally required to, as described in our Privacy Policy.

We have no affiliates that receive health data. We do not sell consumer health data, and we never will.

How we protect it

Health information is encrypted with AES-256 on your phone, encrypted on the way with HTTPS, and encrypted at rest on our servers, in storage and in backups. Only a few people can get into our servers, and they don't open your records. You can also lock the app and lock individual collections. See how we protect your data.

If someone gets into your health information without permission, we'll tell you within 60 days at most, and notify the FTC and state authorities where the law requires.

Your rights

You have the right to:

confirm whether we collect, share or sell your health data, and see it (you can see all of it in the app or on the web);
get a list of everyone we've shared it with, with their contact details;
withdraw your consent;
delete it. Delete any record yourself, or delete your whole account in the app or at Delete your account. It's erased from our servers, storage and backups within 30 days, and we tell our service providers to delete it too.

To make a request, email mystufapp@gmail.com from the address on your account. We'll confirm it's you and answer within 45 days. If we need more time, we'll tell you why, and it'll never be more than 45 more days. Making a request costs nothing, and we won't treat you differently for it.

Appeals. If we turn down your request, reply to our answer with "Appeal" in the subject and we'll answer within 45 days. If we still turn it down, you can complain to your state's Attorney General: Washington residents at atg.wa.gov/file-complaint, and Nevada residents at ag.nv.gov.

Not medical advice, and not HIPAA

myStuf is a personal record keeper. It isn't a medical device, and nothing in it, including Ask's answers, is medical advice. myStuf isn't a health care provider, health plan or their business associate, so HIPAA doesn't apply to it. This notice and our Privacy Policy describe how we protect your health information instead.

Changes and contact

If we change this notice in a meaningful way, we'll update the date at the top and tell account holders before the change applies. We won't use health data in a new way without your consent.

Questions: mystufapp@gmail.com. myStuf, LLC, Gwinnett County, Georgia, USA.