Consumer Health Data Privacy Policy
This Consumer Health Data Privacy Policy explains how Mário Otruba ("we", "us"), who makes and runs the STCKD app ("STCKD: Peptides & Supplements"), handles consumer health data. It is written for people covered by the Washington My Health My Data Act (RCW 19.373), Nevada's consumer health data law (Senate Bill 370, NRS Chapter 603A) and the consumer health data rules of the Connecticut Data Privacy Act. We apply it to everyone in the United States.
It adds to our Privacy Policy, which covers all personal data.
1. Summary
- You can use STCKD without an account. Then your health data stays on your phone and we never receive it.
- If you have an account, we store your health data on our servers only after you give a separate consent. You can withdraw it at any time.
- We use it only to store it, sync it between your devices and show it back to you.
- We do not share it with third parties or affiliates. We do not sell it. We do not use geofencing.
- You can see, export and delete your data in the app, or by writing to support@stckd.app.
2. Who we are
Mário Otruba, Martina Hattalu 2973, 026 01 Dolný Kubín, Slovakia. Email: support@stckd.app. Phone: +421 940 857 804. We have no affiliates.
3. Consumer health data we collect
"Consumer health data" means personal information that is linked or reasonably linkable to you and identifies your past, present or future physical or mental health. In STCKD, this is what you choose to track:
| Category | Examples | How we use it |
|---|---|---|
| Medicines, peptides and supplements you use | Names, categories (for example peptide, GLP-1 or TRT), doses and units, method (for example subcutaneous or intramuscular), schedules, cycles, half-life, vial inventory | Store and sync your plan; show your schedule; count what is left |
| Intake history | Doses taken or skipped, times, actual doses | Store and sync your log; show your calendar and streaks |
| Injection sites | The site of each dose, rotation settings | Store and sync your log; suggest the next site in your rotation |
| Symptoms, mood and energy | Symptoms with severity, mood, energy (1 to 10), daily notes | Store and sync your Feel Log |
| Body measurements | Body weight | Store and sync your weight history |
| Notes and choices that may reveal health information | Notes about a product, stack names, your focus (peptides, GLP-1, supplements) | Store and sync them with the rest of your data |
| Account details, where they show that you use STCKD | Email address; if you sign in with Google, also your Google name, profile-picture link and account identifier | Run your account |
We use this data only to store it, sync it between your devices, restore it, and show it back to you. The app's insights, charts and reports are calculated on your phone.
We do not collect precise location, biometric data, genetic data, or data about reproductive or sexual health care. We do not try to infer health information about you from other data.
4. Where the data comes from
- From you: everything in the table above is what you type or tap into the app.
- From your device: the app adds technical sync information, such as when your data was last saved.
- From Google, only if you sign in with Google: your Google email, name, profile-picture link and account identifier.
We do not buy or receive consumer health data from anyone else.
5. Your consent
Collection. Data you track in guest mode stays on your phone, and we never receive it. If you have an account, the app asks for your consent before it sends your health data to our servers. This consent is separate from our Terms, and the box is not ticked for you. If you do not consent, the app keeps working, but your data stays only on your phone.
Sharing. We do not share consumer health data with third parties. If we ever wanted to, we would first ask for your separate consent, as the law requires.
Withdrawing consent. In the app, open Profile (tap your avatar on the Today screen) → Legal & privacy → Withdraw health-data consent. You can also email support@stckd.app. Syncing stops, and we delete the synced copy from our servers. It disappears from backups within up to 7 days after deletion (Supabase daily backups roll over). Your data stays on your phone.
6. Who receives your data
Third parties and affiliates: none. We do not share consumer health data with any third party, and we have no affiliates.
Processors. These companies handle data only on our behalf, under contract and on our instructions. The law does not treat them as third parties:
| Processor | What it does | What it receives |
|---|---|---|
| Supabase, Inc. (with its sub-processors Amazon Web Services and Cloudflare) | Our database, sign-in and sync | Your synced health data and account details |
| Google LLC (Google Workspace) | Our support mailbox | Health details only if you include them in an email to us |
| Resend | Sends sign-up confirmation and password-reset emails | Your email address. These emails show that you have a STCKD account. |
Sign-in and App Store providers. If you sign in with Apple or Google, that company learns that you signed in to STCKD. We never send your tracked health data to Apple or Google.
7. No sale and no geofencing
We do not sell consumer health data. We do not collect your location, and we do not use geofences around health care facilities or anywhere else.
8. Your rights
You have the right to:
- confirm whether we collect, share or sell your consumer health data;
- access it and get a copy, together with a list of every third party and affiliate that received it. Today this list is empty. We also name our processors and how to contact them;
- delete it. This includes the synced copy on our servers, and we make sure our processors delete it too. Backups roll over within up to 7 days after deletion (Supabase daily backups roll over);
- withdraw your consent to our collection (section 5);
- in Connecticut, also correct your data, get it in a portable format, and opt out of sale, targeted advertising and profiling. We do none of these;
- appeal if we turn down your request (section 10).
We will not treat you differently for using these rights.
9. How to use your rights
- In the app: export your data (Profile → Export my data (JSON)), edit or delete entries, withdraw consent, or delete your account (Profile → Delete account & all data). See Delete Your Account and Data.
- By email: write to support@stckd.app, ideally from the email address of your account.
We check that the request comes from you. Usually a message from your account's email address is enough. Otherwise we may ask you to confirm from that address or to sign in to the app. We never ask for your password. Someone else can make a request for you if you give them written permission.
We answer within 45 days. If we need more time, we may extend this once by another 45 days and will tell you why. Requests are free.
10. Appeals
If we turn down your request, you can appeal. Reply to our answer, or email support@stckd.app with the subject "Health data appeal". We answer in writing within 45 days and explain our decision.
If we deny your appeal, you can complain to your state's Attorney General:
- Washington: Washington State Attorney General, atg.wa.gov
- Nevada: Nevada Attorney General, ag.nv.gov
- Connecticut: Connecticut Attorney General, portal.ct.gov/ag
11. Security and access
Only Mário Otruba has administrator access to our systems. Our processors must keep your data confidential. How we protect data is explained in section 19 of our Privacy Policy.
12. Changes
When we change this policy, we update the version and dates at the top and tell you in the app about important changes. We will ask for your consent before we collect or use consumer health data for a new purpose. Previous versions are in our archive.
13. Contact
Mário Otruba, Martina Hattalu 2973, 026 01 Dolný Kubín, Slovakia · support@stckd.app · +421 940 857 804