Exposure Radar

Legal

Consumer Health Data Privacy Policy

Effective September 30, 2026

How Exposure Radar handles consumer health data, as required by Washington’s My Health My Data Act, Nevada’s consumer health data law (Senate Bill 370) and Connecticut’s consumer health data rules. It covers the Exposure Radar iPhone app, called “Exposure” on your Home Screen, and its Family & Friends relay. Exposure Radar is published by Allison Bowman, an individual developer (“I”, “me”). The Privacy Policy covers everything else.

Summary

  • The app processes consumer health data on your iPhone. I don’t receive it, with one exception.
  • The exception is Family & Friends. If you choose to share, your scores are encrypted on your iPhone and stored on a relay I run, hosted by Cloudflare, only so they can reach the people you invite. I receive them only in encrypted form that I can’t read.
  • To work, some features send location data to Apple and to the U.S. Federal Communications Commission (FCC). The details are below.
  • I don’t sell consumer health data. The app doesn’t use geofences around health care facilities.
  • You can see and delete your data, and stop its collection, using the app and iOS Settings. You can email me with questions or appeals.

What counts as consumer health data

Consumer health data is personal information that identifies, or could reasonably be linked to, your past, present or future physical or mental health. Washington’s law defines it broadly. It includes vital signs and other bodily measurements, precise location that could show you’re seeking health care, and inferences about your health drawn from other data.

Washington’s law also defines “collect” broadly. It includes data an app processes on your own device, even if that data never reaches the developer. So the next section lists everything the app processes, even though most of it stays on your iPhone.

Data the app collects, and why

  • Vital signs and body measurements

    What
    Resting heart rate, heart rate variability, respiratory rate, sleeping wrist temperature, blood oxygen, sleep and steps, read from Apple Health.
    Why
    To compare each signal with your own baseline and calculate immune readiness and readiness.

  • Health inferences

    What
    Your daily exposure index, 7-day exposure, immune readiness, readiness, status words, headlines and strain signals.
    Why
    To show you estimates of your exposure and of how your body is doing, to send reminders and alerts, and, if you choose, to share your scores with people you invite.

  • Location that could show a health care visit

    What
    The places you visit, with arrival and departure times. If you visit a clinic, hospital or pharmacy, your location history will show it, and the app may label the place “Healthcare”.
    Why
    To calculate exposure. Health care settings count as higher-exposure places.

  • Calendar events you plan

    What
    The app reads upcoming events on your iPhone to suggest ones to plan for. It keeps the title, dates and location only for the events you choose. If an event describes a health matter, such as a medical appointment, that’s consumer health data too.
    Why
    To plan a low-exposure window before the event and remind you when it starts.

  • Details you add

    What
    For example, noting that you wore a mask at a place, or changing a place’s type.
    Why
    To make your exposure estimate more accurate.

  • Scores other people share with you

    What
    If someone invites you through Family & Friends, their shared scores.
    Why
    To show you how they’re doing.

  • Support emails

    What
    Whatever you choose to include when you email me, which might include health details.
    Why
    To answer you and handle your request.

The app also uses information that isn’t about your body, such as the number of Bluetooth devices nearby, the weather and local wastewater levels. Combined with your visits, these feed the exposure estimate.

The app uses consumer health data only to provide the features you use. It’s never used for advertising or data mining.

Where it comes from

  • You: what you enter or choose in the app, such as a mask, a place type, the events you plan and your display name.
  • Your iPhone: iOS Location Services, Bluetooth and your calendars.
  • Apple Health, which can include data from your Apple Watch and from other apps and devices you’ve connected to Health.
  • The app’s own calculations on your iPhone, which produce your scores and strain signals.
  • Outside services that add context: Apple Maps (place names and types), Apple Weather (temperature and humidity), the FCC (county) and the U.S. Centers for Disease Control and Prevention, or CDC (wastewater levels).
  • Other people who share their scores with you through Family & Friends.
  • Emails you send me, if you include health details.

What’s shared

The app shares consumer health data only as needed for a feature you’re using:

  • Location of places you visit

    What
    Precise coordinates, which could be those of a health care facility.
    With
    Apple (Apple Maps), to look up the place’s name and type.

  • Approximate location

    What
    The location of places you visit, rounded to about 1 km. It points to an area, not a specific place.
    With
    Apple (Apple Weather), for temperature and humidity, and the FCC, to find the county.

  • Locations of events you plan

    What
    If a planned event has an address but no map location, the address. The event’s location, rounded to about 1 km.
    With
    Apple (Apple Maps), to find the address, and the FCC, to find the county.

  • Family & Friends status

    What
    Only if you choose to share: your display name, readiness, 7-day exposure, immune readiness, a status word, whether you have a strain signal, a short headline, and the last 30 days of those scores.
    With
    Cloudflare, my service provider, which stores it only in encrypted form; and anyone who has your invite link, who can decrypt and read it.

Family & Friends is the only case in which the app sends consumer health data to me. I receive it only in encrypted form that I can’t read, only when you choose to share, and only to deliver it to the people you invite.

Your iPhone encrypts it with AES-256-GCM, using a random key created on your phone. The key is only in the invite link, in the part after the “#”, which browsers and apps never send to a server. The relay stores only the encrypted data, a random share ID, a hash of the secret token your phone uses to update it, and the time of the last update.

Your places, your raw Health data and your calendar events are never shared with the people you invite. The CDC receives only a county or state code, which isn’t consumer health data.

Who receives it

These are all the categories of third parties that receive consumer health data from the app:

  • Service provider (processor): Cloudflare, Inc., which hosts the Family & Friends relay and this website. It stores shared status only in encrypted form it can’t read.
  • Technology platform: Apple Inc., for Apple Maps and Apple Weather lookups, handled under Apple’s Privacy Policy.
  • Government data service: the U.S. Federal Communications Commission, for county lookups from rounded locations.
  • People you choose: anyone who has your Family & Friends invite link.

Affiliates: none. I have no affiliates, and I don’t share consumer health data with anyone not listed here.

Your rights

You have these rights under Washington law, and similar rights under Nevada and Connecticut law. The in-app tools below work for everyone, wherever you live. There’s no charge, and you won’t be treated differently for using your rights.

Confirm and access

Everything the app has about you is shown in the app: your places and daily exposure on the Exposure tab, your vitals compared with your baseline on the Immune tab, your planned events on the Plan tab, and what you share in Settings → Family & Friends. Every category of third party that receives consumer health data is listed in Who receives it.

If you’d like me to confirm what I hold, email me. Apart from anything you’ve told me by email, the only consumer health data I hold is Family & Friends data, in encrypted form that I can’t read or link to you.

Delete

  • Everything: in the app, go to Settings → Delete all data. This deletes the app’s data from your iPhone and deletes your shared status from the relay right away.
  • Places only: Settings → Clear location history.
  • Shared status only: stop sharing in Settings → Family & Friends. It’s deleted from the relay right away, and the people you invited lose access.
  • Deleting the app removes its data from your iPhone. If you were sharing and didn’t stop first, your encrypted status is deleted from the relay automatically once it hasn’t been updated for 60 days.

Because I can’t link shared data to your name or email, I can’t find it and delete it for you by email. The in-app tools delete it immediately. Lookups already sent to Apple Maps and Apple Weather are handled by Apple under its privacy policy. The app never writes to Apple Health, so deleting app data doesn’t change your Health data. You manage that in the Health app.

Withdraw consent

  • In iOS Settings, go to Privacy & Security, then Location Services, Bluetooth, Health or Calendars, and turn off access for Exposure. For notifications, go to Settings → Notifications → Exposure.
  • In the app, stop sharing in Settings → Family & Friends.

The app then stops collecting that data. To remove what it already has, use the delete options above.

How to make a request

Use the in-app tools above, or email support@human-memory.ai. I respond within 45 days.

How to appeal

If I decline your request, or you disagree with how I handled it, you can appeal. Email support@human-memory.ai with “Appeal” in the subject line. I’ll reply in writing within 45 days and explain what I did or didn’t do, and why.

If your appeal is denied, you can file a complaint with your state attorney general:

No sale

I don’t sell consumer health data, and the app doesn’t either. It isn’t shared for advertising. The app has no ads, analytics or tracking code.

No geofencing

The app doesn’t set up geofences, meaning virtual boundaries, around health care facilities. I don’t use location to identify or track people seeking health care, or to send them messages or ads about it.

The app does log the places you visit, which can include a clinic or pharmacy. That history is stored on your iPhone and used only to estimate your exposure.

Nevada and Connecticut

Everything above applies to Nevada and Connecticut residents too. In addition:

  • Reviewing and changing your data (Nevada): in the app, you can review your places, change a place’s type, mark a place as home, note that you wore a mask, and delete places. Health data comes from Apple Health, so you correct it there.
  • Tracking over time (Nevada): no third party collects consumer health data about your activity over time, or across other apps and websites, through Exposure Radar.
  • Your rights (Connecticut): you can see, correct and delete your data in the app, because that’s where it is. I don’t hold readable data to send you a copy of. I don’t sell data or use it for targeted advertising or profiling, so there’s nothing to opt out of. You can appeal as described above.
  • Geofencing and sale: both states restrict geofencing near health care facilities and selling consumer health data. The app does neither.

Changes to this policy

If I change how the app collects, uses or shares consumer health data, I’ll update this policy and its effective date, and tell you in the app before the change takes effect. I’ll ask for your consent before collecting or sharing consumer health data in a new way or for a new purpose.

Contact

Allison Bowman
support@human-memory.ai