Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice applies only to consumer health data that may be subject to Washington's My Health My Data Act or similar laws. Idunn AI is a farm operations app and is not intended to diagnose, treat, track, infer, or sell consumer health status.

Users should not enter medical, disability, injury, biometric, genetic, reproductive, mental health, or health-status information unless it is necessary for an authorized business purpose and the user has authority to enter it.

This notice is provided because agricultural operations may sometimes enter safety, injury, exposure, accommodation, PPE, incident, or worker notes that could be treated as health-related depending on context. The app is not designed to collect consumer health data as a core purpose.

Two points shape how this notice applies. First, to the extent the My Health My Data Act applies, collection and sharing that are necessary to provide a product or service requested by the user or organization do not require separate consent under the Act, and Idunn AI does not collect or share consumer health data beyond what is necessary to provide the requested feature. Second, the Act protects consumers and may not apply to information about an individual acting in an employment context; much of what an agricultural operation enters about its own workers may fall outside the Act for that reason. Idunn AI nonetheless applies this notice to describe how it handles such information.

If users choose to enter it, consumer health data may include worker safety notes, injury or incident descriptions, illness-related notes, PPE or exposure notes, accommodations or restriction notes, photos, audio, signatures, or other uploaded records that identify or could reasonably identify a person's physical or mental health status.

Consumer health data may also include pesticide-handler exposure information — such as the handler-hour totals, exposure-category classifications, and cholinesterase-monitoring summaries the app compiles for occupational-health tracking and for handoff to a physician, clinic, or state labor or health agency — to the extent that information identifies or could reasonably identify a worker's health or medical-monitoring status.

The app may also process health-related inferences only when a user asks the app to summarize, extract, translate, transcribe, organize, or export user-provided records. Idunn AI does not intentionally infer health status for advertising, sale, or unrelated profiling.

Consumer health data may also appear inside uploaded PDFs, spreadsheets, photos, chat messages, compliance forms, time-card notes, labor-quality notes, spray exposure notes, safety checklists, incident reports, or exported files if users include it.

Consumer health data comes from users, organization workspaces, uploaded files, photos, audio, documents, forms, signatures, messages, and app-generated summaries or extractions based on those materials.

We use this data only to provide requested app features, including storing records, extracting information from uploads, generating summaries or PDFs, supporting audits, enabling organization access, securing the app, troubleshooting errors, and complying with legal obligations.

We may also process this data to authenticate users, enforce workspace permissions, maintain backups, investigate security issues, respond to user requests, preserve records when legally necessary, and protect rights and safety.

Consumer health data may be shared with the organization workspace where it was entered, authorized users in that workspace, hosting/database/storage providers, AI/OCR/transcription providers, email or notification providers, diagnostics providers, professional advisors, and government agencies or courts when legally required.

We do not sell consumer health data. We do not use consumer health data for targeted advertising. We do not geofence people around health care facilities.

Categories of processors and third parties may include cloud hosting, database, authentication, file storage, AI, OCR, transcription, email, diagnostics, security, professional advisors, and authorities when disclosure is legally required. Idunn AI does not currently have corporate affiliates that receive consumer health data for separate use.

Consumer health data may also be shared when a user exports, downloads, emails, prints, screenshots, or otherwise distributes records from the app. Idunn AI cannot control files after they leave the service.

If an organization grants a packing house read-only access to shared documents, that sharing is intended for operational records such as spray, map, and compliance documents. An organization must not share a document containing consumer health data with a packing house unless it has any authority and consent the law requires; the organization, not Idunn AI, decides what to share and is responsible for that decision.

Where Washington law applies, consumers may have rights to confirm whether consumer health data is collected, shared, or sold, access the data, receive a list of third parties and affiliates with whom it was shared or sold, withdraw consent, delete consumer health data, and appeal certain refusals.

Submit requests through your signed-in account, organization owner, support@idunnai.com, billing@idunnai.com, or another request method made available in the app. We may authenticate requests and may delay backup deletion where Washington law allows.

Where Washington law applies, responses are generally due within 45 days, with one allowed 45-day extension when reasonably necessary. If a request is denied, an appeal process or complaint path will be provided when required.

Withdrawal of consent may limit or prevent the app from providing requested features. Deletion may be limited where information must be retained for legal, safety, security, accounting, dispute, or regulated-record purposes.

Idunn AI generally acts as a processor that stores and organizes consumer health data on behalf of, and at the direction of, the organization that enters it. The organization decides to collect such data and is responsible for obtaining any consent or signed authorization that the My Health My Data Act or other law requires before the data is entered into the app or shared — including a separate, valid authorization before any disclosure that would constitute a sale. By entering consumer health data, the organization and the user represent that they have obtained any legally required consent and authorization from the individual it concerns.

Idunn AI does not condition the provision of unrelated features on consent to collect consumer health data, collects and shares consumer health data only as needed to provide the feature the user requests, and will obtain consent or authorization itself where Idunn AI is the entity legally required to do so. Where Idunn AI must collect that consent or authorization directly, it will present a clear, separate request identifying the categories of data, the purpose, and the categories of recipients before the collection or sharing occurs.

Do not enter consumer health data unless it is necessary to provide the requested farm operations feature or your organization has obtained any consent required by law. If a feature asks for information that could reveal health status, provide only the minimum information needed.

If Idunn AI later adds features that intentionally collect or share additional categories of Washington consumer health data, or uses such data for additional purposes, the app should disclose that change and obtain consent where required before the new collection, use, or sharing.

Idunn AI does not sell consumer health data and does not offer to sell consumer health data. If any future business practice would be considered a sale under applicable law, it would require a separate valid authorization where required.

Organizations using Idunn AI are responsible for determining whether their own use of employee, contractor, visitor, or consumer health data triggers Washington, Oregon, federal, employment, workplace safety, pesticide, privacy, or record-retention obligations.

Before entering health-related data about another person, confirm that your organization has the required notice, consent, authority, and retention process for that information.