Who We Are and What This Policy Covers
This Consumer Health Data Privacy Policy is provided by Jenevive Health, LLC, a Delaware limited liability company that publishes the Papaya mobile application, and Jenevive Health, Inc., a Delaware corporation that conducts research and data reporting (together, “Jenevive Health,” “we,” “our,” or “us”). The two entities are affiliates under common ownership and jointly operate the Papaya mobile app and the jenevive.health website, including the content, functionality, and services offered through them (collectively, the “Service”). References to “we” in this policy refer to both entities, and the commitments in this policy bind both.
This policy describes how we collect, use, and share consumer health data, and the rights you have with respect to that data, under the Washington My Health My Data Act, Wash. Rev. Code ch. 19.373 (“MHMDA”), and similar laws, including Nevada SB 370 for Nevada residents. It applies to the consumer health data of all users of the Service, wherever located.
This policy supplements our Privacy Policy, which describes our practices for information that is not consumer health data and provides additional detail about the Service, including our research program. This policy is incorporated into the Privacy Policy and, with respect to consumer health data, this policy controls in the event of any conflict. Where the law requires your affirmative consent for a specific collection, sharing, or use of consumer health data, we obtain that consent separately, as described below.
1. What Is Consumer Health Data
“Consumer health data” is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. In our Service, this includes:
- Health conditions, symptoms, diagnoses, and disease activity you record (including that you have or may have hidradenitis suppurativa or another condition the Service supports);
- Treatments, medications, procedures, and interventions you record;
- Journal entries describing your health experiences — structured entries (such as symptom scores and medications with dose and date) may be used for research with your consent; free-text notes remain on your device;
- Survey responses about your health, treatments, and quality of life, if you enroll in a research study;
- Photographs of affected skin areas, whether stored locally on your device through app features or contributed to a research study with your consent;
- Bodily measurements such as height and weight;
2. Sources of Consumer Health Data
We collect consumer health data directly from you, when you enter it into the Papaya app or respond to surveys. We do not purchase consumer health data from third parties, and we do not derive health inferences about you from non-health data.
3. Why We Collect and Use Consumer Health Data
We collect and use consumer health data for the following purposes:
- To provide the products and services you request: symptom and treatment tracking, journaling, reminders, cloud backup and synchronization of your data (an optional feature you activate by linking an account), and generating reports you choose to share with your healthcare provider. Certain data — including free-text journal notes and photographs you take in the app for your own tracking — remains on your device and is not transmitted to our servers.
- With your separate, affirmative consent, for research. If you enable the “Research Participation” setting in the app, you consent to our use of the structured health information you record in the app — such as symptom scores, treatment records, and tracking data — for research, in de-identified form. If you additionally enroll in a specific research study, that study collects the survey responses, and (with a further separate consent) photographs, described in that study's informed consent. Research participation is described in detail in our Privacy Policy and in each study's informed consent.
- To comply with legal obligations.
We collect only the consumer health data necessary for these purposes. We do not use consumer health data for advertising.
4. How We Share Consumer Health Data
- Service providers / processors. We use processors that handle data on our behalf under contract: Amazon Web Services (cloud hosting and authentication infrastructure), Google (cloud hosting, authentication, firebase analytics, crashlytics), Apple (authentication, app analytics), OneSignal (app notificaitons, in-app messages), Tremendous (study compensation). Processors may use consumer health data only to provide services to us.
- Affiliates. Jenevive Health, LLC (publisher of the Papaya app) and Jenevive Health, Inc. (which conducts research and data reporting) are affiliated entities that jointly operate the Service as “we” under this policy. Consumer health data may be shared between these two entities for the purposes described in Section 3, and both entities are bound by this policy. We do not share consumer health data with any other affiliate.
- Third parties. We do not share consumer health data with third parties except (a) with your consent, (b) as required by law or legal process, or (c) in de-identified form, in which case the data is no longer consumer health data because it cannot reasonably be linked to you and recipients are contractually prohibited from re-identification. De-identified research data may be licensed to third parties such as pharmaceutical and biotechnology companies, academic and research institutions, and healthcare organizations, as described in our Privacy Policy and in the research informed consents.
- No sale. We do not sell consumer health data. We will never sell your consumer health data without first obtaining a separate, signed authorization that meets the requirements of applicable law.
5. Your Rights
Subject to applicable law, you have the right to:
- Know and access. Confirm whether we are collecting, sharing, or selling consumer health data about you, and access that data, including a list of the third parties and affiliates with whom we have shared it and an active email address or other online mechanism to contact those third parties.
- Withdraw consent. Withdraw any consent you previously gave for the collection or sharing of your consumer health data — for example, by disabling the “Research Participation” setting in the Papaya app, which stops all future research use of your app data and all study data collection, or by contacting us using the methods in Section 6.
- Delete. Request deletion of your consumer health data. If you make a verified deletion request, we will delete the consumer health data we hold about you — including identifiable account information and the records associating your account with any research participant identifier — from our records, including from archives and backups, within the timeframes allowed by law, and we will notify our processors of your request. Deleting the association records permanently severs the link between you and any research data you previously contributed: neither we nor anyone else can thereafter identify which records in the research dataset were yours, and no further data can ever be attributed to you. The remaining research data is de-identified and cannot be connected to you; data already included in distributed de-identified datasets or published analyses cannot be recalled. Data that resides only on your device (free-text notes, locally stored photos, and locally generated reports) is under your direct control and can be deleted by you at any time within the app.
- Non-discrimination. We will not discriminate against you for exercising any of these rights.
6. How to Exercise Your Rights
You or your authorized agent may exercise these rights by:
- Emailing privacy@jenevive.health;
- Using the in-app controls described above;
- Writing to: Jenevive Health, PO BOX, Kirkland, WA 98083.
We will verify your request using information associated with your account and respond within 45 days of receipt. If we require more time (up to 45 additional days where reasonably necessary), we will inform you of the reason and the extension period in writing.
7. Appeals
If we decline to act on your request, you may appeal by replying to our response or emailing privacy@jenevive.health with the subject line “Appeal.” We will respond to your appeal within the time required by law. If your appeal is unsuccessful and you are a Washington resident, you may contact the Washington State Attorney General at www.atg.wa.gov/file-complaint.
8. Changes to This Policy
We will post any changes to this policy on this page, with the effective date identified at the top. Before we collect, use, or share consumer health data for any purpose not disclosed in this policy at the time of collection, we will provide notice and, where required by law, obtain your consent.