Prediabetes.life — Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Sierre Technologies LLCcollects, uses, shares, and protects "consumer health data" as defined under applicable state law, separate from and in addition to our general Privacy Policy.

Sierre Technologies LLC, 4 Crossroads Ct, Dayton, NJ 08810, United States. privacy@prediabetes.life

• Diagnosis-related responses (whether a healthcare professional has told you that you currently have diabetes).
• Reproductive/pregnancy status.
• Biometric and lab information: weight, height, waist circumference, BMI, A1c percentage, fasting glucose.
• Family health history and ethnicity-derived risk factors (South Asian background, used as a risk factor in our program).
• Wearable/device-derived health metrics, where you choose to connect or import them. As of this Policy's effective date, this is not an active data source for any live third-party device.
• Derived health inferences we compute from the above (risk-factor summary, program eligibility).
• Controlled-beta screening responses: if you apply to our controlled beta program and separately agree to a dedicated screening-consent step, we ask whether a healthcare professional has told you that you have or are at increased risk of prediabetes/type 2 diabetes (or neither), approximately when, your current mindset toward lifestyle change, your comfort with health-related apps, programs or apps you have previously tried and stopped, your ability to commit to specific beta-testing activities, and your primary device. We retain this for up to 90 days from when you answer it, after which it is treated as expired and you would need to re-screen to remain under consideration; you can withdraw this consent, or request deletion, at any time by emailing privacy@prediabetes.life.

• To provide the core Service: personalized risk information, weight/lifestyle targets, and program guidance.
• To route you safely between the self-guided program and a recommendation to consult a healthcare professional.
• Security and audit logging.
• Controlled-beta candidate selection:your screening responses are used only to help us select and manage a small, varied group of beta testers — never to diagnose you or provide medical care, and never automatically: a person always reviews and decides selection, and answering the screener never by itself grants or guarantees access.

No purpose beyond those listed here is used without updating this Policy and, where required by law, obtaining fresh authorization.

Directly from you. Where a device/wearable integration becomes active, also from that device or service, with your affirmative connection action. As of this Policy's effective date, no live third-party wearable integration exists — only manual entry and a local test-provider path.

As of this Policy's effective date, we share consumer health data only with the service providers necessary to operate the Service (see Section 7), which process it solely on our behalf and have no independent right to use it. We do not share consumer health data with affiliates, advertisers, or data brokers. If this changes, we will update this Policy before the change takes effect and, where required, obtain your prior authorization.

• Supabase — database hosting.
• Hostinger — application hosting.

We do not sell consumer health data. Any future sale would require a new legal and product review and valid consumer authorization before it could occur.

We do not use consumer health data for targeted advertising, and we do not operate any advertising or ad-targeting system.

We do not use geofencing technology around health care facilities, or any other location, to collect consumer health data or identify consumers seeking health care services.

• Right to know/access: you may request confirmation of whether we process your consumer health data, and access to that data.
• Right to withdraw consent: you may withdraw your consent to our collection or use of your consumer health data at any time from Settings, or by emailing privacy@prediabetes.life.
• Right to deletion, including from backups: you may request deletion of your consumer health data at any time from Settings. Upon a verified request, we delete this data from active systems with an operational target of 30 days, and from backups through normal backup rotation with a maximum target of six months.
• Third-party deletion notification: where we have shared your consumer health data with a processor described in Section 7, we instruct that processor to also delete the data in accordance with our processing agreement with them.
• Right to appeal: if we deny your request, see Section 13.

We will respond to a request under this section within 45 days of receipt. Where reasonably necessary given the complexity or number of requests we receive, we may take one additional 45-day extension, and we will notify you of that extension, and the reason for it, within the initial 45-day period. These are outer limits — our operational target for completing a deletion from active systems, stated above, is faster, at 30 days.

Where applicable law requires a separate, specific authorization — distinct from ordinary consent — before we collect or share consumer health data, we will obtain that authorization through a dedicated flow, separate from the general privacy/terms acceptance used at signup.

1. Submit your initial request to privacy@prediabetes.life.
2. We will provide a written decision.
3. If you disagree with our decision, you may appeal by emailing privacy@prediabetes.life with the subject line "Privacy Appeal."
4. Where operationally possible, your appeal will be reviewed by someone who was not solely responsible for the initial decision.
5. We will determine the outcome of your appeal within 45 days of receipt, unless a shorter period is required by applicable law.
6. If you remain dissatisfied, you may contact the applicable state or federal regulator.

See our general Privacy Policy, Section 11; the same controls and the same no-guarantee caveat apply to consumer health data.

We will post any changes here with a new effective date, using the same material-change/reacceptance standard described in our Privacy Policy.

Sierre Technologies LLC
4 Crossroads Ct, Dayton, NJ 08810, United States
privacy@prediabetes.life