Consumer Health Data Privacy Policy
Document required by Washington's My Health My Data Act and analogous laws: what data that could be considered health-related is processed by Tonaleve, who it is shared with, and how to access it, delete it, or withdraw consent.
Last reviewed: August 29, 2026
This policy supplements our Privacy Policy and is published separately to comply with the State of Washington’s My Health My Data Act (RCW 19.373), with Nevada’s SB 370, and with the laws of other states that treat consumer health data as a special category. It applies to everyone who uses Tonaleve, not only to residents of those states.
1. The starting point: almost everything stays on your device
Tonaleve was designed to not accumulate sensitive data. The content a user could reasonably consider information about their health —the reference tone in Hz, the level in dB SL, the calibration history, session logs, check-ins about how it went, and the resulting sound program— is stored exclusively in the local storage of your browser or your app. It is not transmitted to our servers, we do not host it, we do not see it, we do not share it, and we could not hand it over even if asked.
What follows honestly describes the little we do process that could fall within the broad definition of “consumer health data” under those laws.
2. What consumer health data we collect
| Category | What it specifically is | Where it comes from |
|---|---|---|
| Relationship with the product | The fact that you have a Tonaleve account or subscription, which is a hearing wellness app. From that, an interest in tinnitus, rest, or sound masking could be inferred. | From your own registration and subscription |
| Associated contact identifier | Your email address, insofar as it is linked to the above. | You provide it |
| Support content | What you tell us when you open a support request or write to us, if you mention something about your health on your own. | You write it |
We do not collect: diagnoses, medical history, medication, clinical audiometry results, data provided by health professionals, biometric data, genetic data, precise location near health facilities, or audio recordings.
3. What we use it for
Only for: creating and maintaining your account, giving you access, billing and administering the subscription, sending you operational service notices, handling your support requests, preventing fraud, and complying with legal obligations. Nothing else.
We do not use it for advertising, we do not build commercial profiles, we do not use it to train artificial intelligence models, and we do not cross-reference it with third-party data.
4. Who we share it with
With the vendors strictly necessary to provide the service, each one contractually bound to process it only on our behalf:
| Third-party category | Who | What they receive |
|---|---|---|
| Payment processor | Stripe | Email and the payment data you enter at their checkout |
| Infrastructure, database, and security | Cloudflare | Stored account data and technical request data |
| Transactional email | Email delivery provider | Recipient’s email and the content of the notice |
We do not share consumer health data with advertisers, with data brokers, or with social networks. There are no third-party pixels or tracking tags —Meta, TikTok, Google Ads, or others— on the website, in the app, in the calibration step, or on the checkout screen.
On our marketing site (tonaleve.app) we measure which ad of ours a given visit came from,
using our own tool and our own cookie. That is site browsing information, not personal or
health information: it does not enter the app, it does not touch the calibration step or the
checkout screen, it is not cross-referenced with your account or your sound profile, and it is
not sold or used for any other purpose than knowing which ad works. Details are in section 7
of the Privacy Policy.
We may disclose information if required by a valid legal order; in that case we could only hand over what we actually have, which is what is listed in section 2.
5. We do not sell health data
Tonaleve does not sell consumer health data and has no intention of doing so. We therefore do not request or use the “valid authorization” that the My Health My Data Act requires for a sale. Should this ever change, we would ask for your express, separate authorization beforehand, and this page would be updated.
6. Consent
We collect and use the data described in section 2 only to the extent necessary to provide the service you subscribed to, or with your consent, as applicable. Any use beyond that necessity would require your prior consent, given separately and specifically.
You may withdraw your consent at any time by writing to us at [email protected].
Withdrawing consent does not affect the lawfulness of prior processing; if the data is essential
to maintaining the account, withdrawing consent means closing the account.
7. Your rights
Regarding the consumer health data we hold, you may:
- Confirm whether we process data about you and access it, including the list of third parties it was shared with.
- Withdraw consent for its collection and for it being shared.
- Delete it. Upon receiving a deletion request, we remove the data from our active systems and from our backup copies, and we forward the request to the vendors it was shared with, except for what we must retain due to a legal obligation —for example, accounting records of a payment already made—.
How to exercise them: write to us at [email protected] from your account’s email
address, indicating which right you wish to exercise. We verify your identity by replying to that
same address. We respond within 45 days, extendable by 45 additional days when the request is
complex, notifying you before the deadline. The process is free of charge.
If we deny your request we will explain why and how to appeal. If you file an appeal and we
also deny it, we will give you a way to file a complaint with the appropriate authority: in the
case of Washington, the Office of the Attorney General
(https://www.atg.wa.gov/file-complaint).
8. Data we cannot delete because we do not have it
As explained in section 1, your calibration profile, your history, and your check-ins are on your device. To delete them, remove them from the app itself or clear your browser’s storage. We do not keep a copy.
9. Security and incident notification
We apply the measures described in the Privacy Policy. Should an incident occur affecting consumer health data, we will notify as required by applicable law, including the FTC’s Health Breach Notification Rule.
10. An important reminder
Tonaleve is a general wellness product: it is not a medical device, it does not diagnose, treat, or cure any condition, and no health professionals take part in the service. We are not a covered entity or a business associate under HIPAA, so HIPAA does not govern this relationship; the state consumer health data laws and the FTC rules mentioned on this page do apply.
11. Changes
If we update this policy, we will change the “last updated” date in the header and, for material changes, notify you before they take effect.
12. Contact
Nordbridge IT Solutions LLC — Tonaleve
Health data, privacy, and exercising your rights: [email protected]
