Version 1 • Effective July 7, 2026
Introduction
This Consumer Health Data Privacy Policy is provided by Insightflow, LLC (600 1st Ave Ste 102 # 2235, Seattle, WA 98104-2287, United States), operator of the SourdoughLife app ("we", "our", or "us"), under the Washington My Health My Data Act (RCW 19.373). It describes how we handle "consumer health data" as that law defines it. It supplements our main Privacy Policy and our AI Features & Data Use Policy; where those documents describe other data, this policy governs consumer health data specifically.
Categories of Consumer Health Data We Collect
We collect only the health, dietary, allergy, or medical information you voluntarily include in AI prompts, photos, notes, and conversations when you use our AI features (bread photo review and the schedule assistant).
We collect no other consumer health data. We do not use sensors, we do not collect biometric or location data, and we do not infer or derive any health data from other information.
How We Use It
We use this data for a single purpose: to generate the AI feedback you asked for — a review of your bread or a proposed baking schedule and answers to your baking questions. We do not use it to train AI models, for advertising, or for any other purpose.
Sources
We collect this data only from one source: directly from you, as you enter it in the app.
How We Collect It — Your Consent
We collect this data only after you give prior, opt-in consent through a separate in-app AI consent prompt, which is distinct from your general use of the app. The prompt tells you what data is involved, why it is used, and who processes it. We do not send any of your content to our AI processors until you have granted that consent. You can withdraw your consent at any time in Settings → AI Features.
Sharing and Recipients
We do not share or sell consumer health data.
To provide the AI features you request, we disclose your content only to processors that act on our behalf under contract: Anthropic, OpenAI, and Amazon Web Services (AWS). Under the My Health My Data Act these companies are processors, not third parties we "share" data with — they may process your data only to provide the feature and only as our contracts instruct. No affiliates receive your consumer health data.
The My Health My Data Act prohibits the sale of consumer health data without your separate, signed authorization. We do not sell consumer health data and will never ask you to authorize a sale.
Your Rights
Under RCW 19.373.040, you have the right to:
- Confirm and access the consumer health data we collect, including a list of the processors named above with whom your data has been disclosed.
- Withdraw consent to our collection of your consumer health data.
- Delete your consumer health data. When you delete content or your account, we remove it from our active systems promptly (in rare technical-failure cases, residual copies are removed by periodic maintenance); our processors are contractually required to delete it under our data-processing agreements; and it clears from our backups, which are overwritten within our 35-day backup cycle.
You can exercise these rights in the app — in Settings → AI Features, through account deletion, or through data export — or by emailing us at admin@insightflow.life. We will respond without undue delay and within 45 days; where reasonably necessary, we may extend this once by an additional 45 days and will notify you if we do.
If we decline your request, you may appeal by emailing admin@insightflow.life with the subject line "Appeal." We will inform you in writing of our decision within 45 days. If your appeal is denied, you may contact the Washington State Attorney General to submit a complaint at www.atg.wa.gov/file-complaint.
Contacting Us
If you have questions about this policy, you may email admin@insightflow.life