Version: v1.3Effective Date: October 19, 2026Company: Viking Media Labs Inc., a Canadian corporation operating DoserlyContact: privacy@doserly.com; 72 Victoria St S, Kitchener, ON N2G 4Y9, Canada
This notice supplements the Privacy Policy. It uses Washington My Health My Data Act categories as the baseline for consumer health data and describes Nevada and Connecticut differences below. Rights depend on applicable law.
1. Categories and sources
Consumer health data can include account-linked medications, supplements or compounds; doses and adherence; symptoms; lab results; health conditions or possible inferences from entered records; and health information an adult enters for a dependent. Optional imports for the adult primary self profile can include selected steps, heart rate, resting heart rate, sleep periods/stages or duration, paired systolic/diastolic blood pressure, source and coverage records, and account-linked trends or possible associations. A mean, trend, or association about one person remains consumer health data.
Sources are you or an authorized adult entering records, your app/device activity, Apple Health or Health Connect on a phone you connect, and the watches, companion apps, phones, or other sources that write to those stores. We may receive account, payment, delivery, and security information from service providers. Apple Health and Health Connect access is separate from Doserly's own account-sync choice.
2. Why we collect and use it
We use health data to provide requested tracking, reminders, personal trends, account sync, export, and optional AI reports, and to secure and support the service. Optional analytics has an off-by-default control. The current app does not record sessions; optional session replay, offered in earlier versions, has been removed. We do not use health records to produce population-level health insights. Any future use for that purpose would require an accurate notice and applicable legal basis before use.
Wearable import and US account sync require a separate, initially off Doserly choice before an OS health-permission request. You select available types and confirm the readings are yours. An OS grant alone is insufficient. Background collection, if offered, has its own separate choice. For an AI report, you review a pre-send disclosure and choose whether to send a de-identified but still personal summary to OpenAI. Wearable summaries are excluded while that option is disabled; if enabled, they require a separate off-by-default choice for that report.
3. Recipients and purposes
Supabase stores account and health records and runs server functions; PowerSync supports account synchronization. Selected imported readings, source/coverage data, and personal trends sync to the adult owner's account through these US-based services. OpenAI receives only a user-approved report request and curated reference retrieval. Current reports replace IDs, names and calendar dates with aliases and relative days, omit notes/free text and custom lookup names, and use a random submission token. Those controls reduce direct identifiers; the health facts can still identify someone by context. If a separately enabled wearable option is selected, OpenAI may receive 28-day personal metric averages, observed days, coverage, source labels, and possible dose/outcome associations with dates and uncertainty. Raw samples, timestamps and health-store IDs are excluded from that summary request.
OneSignal/Resend deliver enabled reminders or transactional messages; Sentry handles diagnostics; Adapty and Apple/Google stores handle entitlements/billing; PostHog receives optional analytics and holds masked replay recordings made by earlier app versions for people who turned replay on; FatSecret or Open Food Facts receive a requested lookup; a recipient you choose receives a directed export; authorities may receive data when legally required. Ask privacy@doserly.com for identities of third parties to whom your consumer health data was disclosed or shared, as applicable. We use processor agreements and instructions where the provider acts for us; the legal classification of each OpenAI flow remains for counsel review. We do not sell consumer health data.
4. Your choices and deletion
In Settings > Wearables, Stop importing stops new collection/sending on this phone; saved Doserly history remains and another connected phone may continue. Change OS access in Apple Health or Health Connect separately. Delete imported wearable history is a separate account-wide request: once accepted and synced, it removes imported readings from Doserly across connected devices, but leaves manual records and the phone health store unchanged. Offline copies can remain until reconnect; a later explicit seven-day reimport can restore deleted readings. Delete Account in Settings > Account is broader and does not cancel an Apple/Google subscription. A saved AI report, OpenAI-held request, legally retained record, or backup may require a separate process or follow another retention schedule.
To stop a future AI submission, cancel the pending request or decline a later pre-send sheet; a prior provider submission cannot be undone by withdrawing permission. Email privacy@doserly.com for access, correction, deletion, withdrawal, recipient details, or a request concerning another person's profile. We may verify identity and authority and notify recipients of a deletion where law requires and the flow allows. An adult account holder may enter a child's information with lawful authority; children cannot create accounts.
5. State rights, timing, and appeal
Where Washington law applies, you may confirm processing; access health data and the identities/categories of third parties and affiliates with whom it was shared; withdraw consent; request deletion, including from processors as required; and appeal a refusal. We generally respond within 45 days after receipt, subject to a legally permitted extension with notice. If we deny a request, our reply will explain the reason and how to appeal by emailing privacy@doserly.com with "Appeal" in the subject. We will review the appeal and explain the result and how to contact the Washington Attorney General when required. You may contact a regulator independently; our process does not limit that right.
Nevada's consumer-health-data law has its own consent, collection, sharing, deletion, and geofencing rules; Nevada residents may request the applicable rights through the same address. Connecticut's privacy law can provide access, deletion, correction, portability, opt-out, and appeal rights when it covers Doserly's processing; we will apply its required response and appeal process where applicable. Other local rights are honored where law requires.
6. Geofencing and changes
Doserly does not use geofencing to identify or track people seeking health care or to collect health data within a health-care-facility perimeter for prohibited purposes. We do not use health data for targeted advertising. Material changes to categories, sources, purposes, or recipients will be disclosed before new collection or sharing where law requires; a policy update alone is not the separate wearable or AI choice.
Contact privacy@doserly.com or Viking Media Labs Inc., 72 Victoria St S, Kitchener, ON N2G 4Y9, Canada, with questions or an appeal.