Consumer Health Data Privacy Policy

This policy explains how Flynn Kavanaugh, operating as Dewpoint, handles consumer health data when you use the Dewpoint website or iOS app. It supplements our Privacy Policy and addresses rights under Washington’s My Health My Data Act, Nevada SB 370, and Connecticut’s consumer health data protections where applicable.

1. What we collect and why

We collect the following information you choose to provide to offer the app:

• Skin quiz answers and results (including skin type, sensitivity status, sensitivity triggers, primary and secondary concerns, breakout type, routine depth, sunscreen habit, and confidence), to score and explain your result, generate step-by-step routine guidance, and personalize ingredient and product suggestions.
• Products, morning and evening routine steps, and shelf entries (including custom product names, opened-on dates, period-after-opening months, printed expiry dates, and notes), to organize your skincare and check the ingredient data we hold for conflicts and time-of-day cautions.
• Your allergy and sensitivity avoid list (ingredients, products, or text terms marked as avoid or sensitive, plus notes), stored only if you switch it on in Settings, to flag matching products and filter recommendations.
• Daily calendar logs (morning and evening completion, completed routine items, skipped routine steps, one or more daily skin-look states such as Clear, Breaking out, Oily, Dry, or Irritated, and custom or preset tags such as Period, Travel, High stress, Poor sleep, New product, or weather), to show your habits, consistency streaks, and patterns over time.
• Progress photos and notes, to let you record and review changes over time. Before upload, photos are resized and re-encoded as JPEG on your device, which strips embedded camera metadata such as EXIF GPS location and device details.

The optional Pregnancy flag in Settings (which highlights products containing ingredients the American Academy of Dermatology lists to avoid during pregnancy) is stored only on your device in local storage and is never sent to our servers or saved to your account.

You are the only source of this information. Results and flags come from your answers and our ingredient catalogue. Before signup, quiz progress and a pending result stay in your browser or device storage. At signup (and when policies are updated), we ask separately for your affirmative consent to store and use your skin and health information to run the app.

2. Sharing and service providers

We do not sell consumer health data or share it for advertising. The app uses Lovable Cloud (Supabase) to store account data and private progress photos and to provide authentication. These providers act as processors for us to run the app.

We do not put quiz answers, allergy lists, daily logs, progress photos, or notes in account emails or push notifications (whether Web Push on the website or local device notifications in the iOS app), and we never send your stored health information to Amazon or any other retailer. We share health data only with service providers acting for us, unless you choose to share a result link or streak summary.

If you choose to share a result link (/r/<slug>), anyone with that link can see only your skin type, sensitivity status, and concerns. They cannot see your full quiz answers, breakout type, allergy list, routine, progress photos, or notes through that link.

3. Your consent and rights

You can withdraw consent at any time by emailing privacy@dewpointapp.com. You can also turn off and delete your allergy list in Settings, or stop using the app and delete your entire account on the Account page. Withdrawing consent does not change the lawfulness of processing before withdrawal.

You can download a JSON copy of your data (including 60-minute links to your progress photos) or delete your account directly on the Account page, or email privacy@dewpointapp.com. Account deletion immediately removes active account records across all user tables and deletes your progress photos from storage; rolling database backups held by Lovable Cloud / Supabase expire automatically within up to 30 days (or you can email privacy@dewpointapp.com to request backup removal).

We respond to rights requests within 45 days. To appeal a decision, reply to our decision email at privacy@dewpointapp.com. We do not discriminate against you for exercising your rights.

4. No sale, AI training, or geofencing

We never sell consumer health data, we never use your progress photos or health data to train AI or machine-learning models, and we never use geofencing to identify or track people seeking health services or to send health-related messages or advertisements.

5. Contact

For questions, consent withdrawal, rights requests, or appeals, email privacy@dewpointapp.com.

Flynn Kavanaugh, operating as Dewpoint

120 S Salisbury St, Unit 11, West Lafayette, IN 47906