Consumer Health Data Privacy Policy

1. Consumer health data we collect

• Symptoms you record, how severe they were (0–10), and when they started and ended.
• Your mood and whether you had symptoms on a given day, and any notes you write about how you feel.
• Which symptoms you choose to track, including custom symptom names.
• Pattern summaries Baro calculates from your own entries, shown only to you.
• The approximate area (rounded to about 11 km) linked to a symptom entry. This is not precise location, and Baro never collects precise location.
• Your account details and subscription status, to the extent they show that you use a symptom journal.

2. Why we collect it

Only to provide the features you ask for: keeping your journal, showing it next to the weather, calculating summaries of your own entries, exporting your data and deleting it. We also use it as needed to keep the service secure and to meet legal obligations. We do not use it for advertising and we do not sell it.

3. Where it comes from

From you, when you enter it in the app, and from Baro’s own calculations on what you entered. We do not get consumer health data about you from anyone else.

4. Who receives it

We share consumer health data only with these service providers (processors), under contracts that let them use it only to provide their service to us. We have no affiliates that receive it.

• Supabase, Inc. (supabase.com/privacy) stores all of the categories above, in the United States.
• Resend (resend.com/legal/privacy-policy) receives your email address to send Baro account emails, which shows that you have a Baro account.
• RevenueCat, Inc. (revenuecat.com/privacy) receives a random user ID and your Baro Premium status.
• Apple and Google process your sign-in and any Baro purchase as part of the App Store and Google Play.

None of them receives your symptoms, moods or notes except Supabase, which stores them for us. We do not sell consumer health data, and we would ask for your separate consent before sharing it with anyone not listed here, unless the law requires it.

5. Your rights

• Confirm whether we collect, share or sell your consumer health data.
• Get a copy of it, together with a list of every third party and affiliate it has been shared with and how to contact them.
• Withdraw your consent: stop recording, delete entries by request, or delete your account.
• Have it deleted, including from our service providers. Deletion from Baro’s database is immediate, and backup copies are overwritten within 7 days.
• Appeal if we decline your request.

We will never treat you differently for using these rights.

6. How to make a request

• In the app: Profile → Privacy & Security → Export My Data, or Delete Account.
• By email: write to support@emberdevstudios.com from the email address on your account, with “Consumer health data request” in the subject.

We will confirm the request comes from you and answer within 45 days. If we need more time, we will tell you why, and we may take up to 45 more days where the law allows. If we decline, we will explain why. To appeal, reply with “Consumer health data appeal” in the subject; we will answer in writing within 45 days. If your appeal is denied, you can contact the Washington State Attorney General or the Nevada Attorney General.

7. Other commitments

• We do not use geofences around health care facilities.
• Access to consumer health data at Ember is limited to the people who need it to run and support Baro.
• Baro is for adults aged 18 and over, and we do not knowingly collect consumer health data from anyone younger.

Questions: Ember Development Studios, LLC, DeLand, Florida, USA, support@emberdevstudios.com.