Consumer Health Data Privacy Policy
Last updated October 1, 2026
Some of what Raeya collects is "consumer health data" under Washington's My Health My Data Act and similar laws in Nevada and Connecticut. This policy explains what that data is, how we use it, and your rights over it. It applies to everyone who uses Raeya, wherever they live, and works together with our Privacy Policy.
1. The health data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Sleep | When you slept, sleep stages, sleep efficiency, daily sleep score | Your Oura Ring, through Oura, if you connect it |
| Heart and recovery | Heart rate and heart rate variability (HRV) during sleep, daily readiness score | Oura, if you connect it |
| Activity and rest | Workouts (type, time, intensity, calories, distance) and sessions such as meditation, breathing or naps, with any mood you tagged in Oura | Oura, if you connect it |
| Mood | The mood rating you give your day | You, in the app |
| Precise location | Places you spend 5 minutes or more, which could show a visit to a health care provider | Your iPhone, if you turn location on |
If you let Raeya for Mac record window titles, a title can mention a health topic, such as the name of a health website you have open. We don't look through titles for health information. You can turn titles off or exclude apps at any time.
We don't infer health conditions from any of this data, and we don't set up virtual boundaries (geofences) around health care facilities.
Confirm that treating location and incidental window-title content this way is enough, and whether either needs its own consent wording.
2. Why we collect it
Only to show it to you, on your timeline and in your daily reflection, so you can see how sleep and mood relate to how you spend your time. We don't use it for advertising, and we never use it to decide anything about you, such as for credit, insurance or employment.
3. Your consent
We ask before collecting any of it, on a separate screen for health and wellbeing data and another for location. Raeya works without them. You can withdraw consent at any time on iPhone in Settings → Data Permissions, and we'll stop collecting that data. Disconnecting Oura also stops new Oura data.
We don't share consumer health data with third parties. If that ever changes, we'll ask for your separate consent first. We will never sell it.
Washington MHMDA: is one consent screen for health data (Oura and mood) enough for collection, given there is no sharing? The in-app consent screen currently lists sleep, sleep stages, heart rate, HRV and mood; the app also stores Oura readiness, workouts and sessions, so the screen should list those too before this policy goes live.
4. Who can access it
- You.
- Supabase, our database provider, which stores it on our behalf as a processor and may not use it for anything else.
- The people who run Raeya, only to keep the service working, to fix a problem you report, or when the law requires it.
Raeya has no affiliates, and we don't share consumer health data with any other third party.
5. Your rights
- Know and access. Ask whether we have your health data, get a copy of it, and get the list of every company that processes it (above).
- Delete. Delete your account in the app (Settings → Delete Account), or email us. Deleting removes your health data from our database, which is also our processor's copy, and backup copies are deleted automatically after a short time.
- Withdraw consent at any time in Settings → Data Permissions.
- Appeal if we turn down a request.
To make a request, email hello@raeya.app from the email address you use with Raeya (or tell us which address it is). We'll answer within 45 days. If we need more time, up to 45 more days, we'll tell you why within the first 45. Requests are free.
To appeal a decision, reply to our answer with "Appeal" in the subject. We'll review it and tell you in writing what we decided and why within 45 days. If you're still not satisfied, you can contact your state's attorney general, for example in Washington, Nevada or Connecticut.
Confirm response deadlines, identity checks and the appeal process meet Washington, Nevada and Connecticut requirements, and link each attorney general's complaint page.
6. How we protect it
Health data gets the same protections as everything else in your account: encryption in transit and at rest, database rules that keep each account separate, and access limited to the people who run Raeya. See How we protect it in the Privacy Policy.
7. Changes
We'll post any change here and update the date at the top. Before we collect a new kind of health data or use it in a new way, we'll ask for your consent.
8. Contact
Email hello@raeya.app with any question or request about your health data.