Effective 21 October 2026 · App Strategist LLC, Virginia, USA
This is a separate policy, kept separate on purpose. Washington’s My Health My Data Act requires a standalone consumer health data policy, distinct from a general privacy policy, and Nevada and Connecticut have comparable rules. It applies to you based on where you are, not where we are, so we publish it for everyone rather than ask.
Our general Privacy Policy covers everything else and does not contradict this one. Where this policy is more specific, this one governs for consumer health data.
Start here, because it changes everything below. BipolarOS stores your record on your own device. If you use it without turning on the Loop or encrypted backup, we collect no consumer health data at all — there is nothing for this policy to describe in your case. The disclosures below apply only to the opt-in features, and they are narrower than most people expect.
Under these statutes “consumer health data” is defined broadly — broadly enough that information merely indicating that someone seeks mental health support can qualify. We treat it that way here, which is why ordinary-looking items appear in this list.
| Category | What it is | Why we have it |
|---|---|---|
| Mental-health-adjacent status | The fact that you hold a bpOS account at all, since bpOS is a bipolar-specific tool | Unavoidable consequence of having an account. We hold no diagnosis, and bpOS never asks for one. |
| Identifiers | Your email address; your phone number if you enable text reminders | To sign you in and to deliver what you asked us to deliver. |
| Support-network information | The first names of your Loop members, your “how to show up” note about each, and their email or phone if they opt in | To render a Loop member’s page to them and deliver a signal you sent. |
| Interaction timestamps | When a check-in was requested or answered; your reminder schedule and time zone | To send the signal and to fire reminders at the right local time. |
| Encrypted record (not yet in service) | Ciphertext we cannot read, plus the time and size of a sync | Backup and multi-device, when that feature ships. It is not running today. |
What is deliberately absent from that table. Your states, your logs, your journal entries, your runbooks, your patterns and your emergency contacts. These are the actual health content in bpOS, and they are never transmitted to us in any arrangement. Loop messages carry a first name, a fixed phrase, a tokenized link and opt-out language — never how you are doing. We hold no diagnosis, no medication, no clinician, no appointment and no symptom.
One source: you, directly, by typing it into bpOS — except for a Loop member’s own email or phone, which that person enters themselves on their own page when they choose to receive notifications. We buy no data, infer nothing about you from outside sources, receive nothing from data brokers, and run no third-party tracking inside the app.
We share only what is needed to deliver something you asked for:
| Category of third party | Specific party | What they receive |
|---|---|---|
| SMS delivery | Twilio Inc. | A recipient phone number and the message body |
| Email delivery | Resend, Inc. | A recipient email address and the message body |
| Hosting | Opalstack LLC | Whatever is stored server-side, as our infrastructure provider |
We have no affiliates, and no corporate parent or subsidiary, with whom any of this is shared. Payments for a Bipolarist subscription are handled by Substack under its own terms; we do not pass consumer health data to Substack, and we never see your payment details.
We have never sold consumer health data and we do not intend to. These statutes require a separate, specific, signed authorization before any such sale — not buried consent. We have never sought one and have no mechanism to collect one. If that ever changed, it would require your explicit authorization, and we would have to say so here first.
We also do not share consumer health data for advertising, do not use it to train models, and do not use it for any purpose other than operating the feature you turned it on for.
Washington’s act specifically prohibits geofences around places that provide in-person health care services. bpOS collects no location data whatsoever — it never asks for location permission, and the app is served with a policy header that disables the browser geolocation API outright. There is no geofence because there is no location.
We will respond within 45 days, and will tell you if we need a single further 45-day extension. There is no charge, and we will not treat you differently for asking.
These rights bind us, not a court. What we can and cannot be made to produce — which differs sharply depending on which features you turned on — is set out plainly in section 7 of the Privacy Policy, including one honest weakness specific to the web version. We would rather you read that before you decide what to turn on.
We will not collect, use, or share consumer health data in a way this policy does not already disclose without updating this page first and obtaining your consent where the law requires it.
info@bipolaros.com · App Strategist LLC, Virginia, USA