Consumer Health Data Privacy Notice for DEUX (Washington and Nevada)
DRAFT, NOT YET PUBLISHABLE. Not legal advice. Washington's My Health My Data Act names "reproductive or sexual health information" as consumer health data, and Nevada has a similar law. Apps in this space publish a separate notice like this one (Flo, a large sexual and reproductive health app, publishes one for Washington and Nevada residents). The elements below follow the laws' published requirements as summarized in public legal commentary; a privacy lawyer must confirm the list against the statute text and whether it applies to you as an individual publisher (forming an LLC makes the answer clearer). Washington's law lets consumers sue, so this is the document most worth a lawyer's hour.
Effective date: [EFFECTIVE_DATE] · Publisher: Elena Rudinski · Contact: support@letsdeux.com
This notice adds to our Privacy Policy (https://legal.letsdeux.com/privacy.html) and applies to people who live in Washington or Nevada (we apply it to everyone). It is linked from the home page of our website (https://legal.letsdeux.com) and inside the app (Profile > Legal and Settings > Privacy).
1. What consumer health data we collect, and why
| Category | Examples in DEUX | Why |
|---|---|---|
| Information about sexual activity and preferences | the positions you play, ratings, the settings that shape your sessions (for example oral and variety preferences, who leads, effort limits) | to build the sessions you ask for |
| Information about physical ability and limits | abilities and effort limits you set | to keep sessions suitable for you |
| Your notes about sessions | private notes you write | to let you keep them and, under the mutual-reveal rule, share them with your partner |
| Feedback you send us | a message you write in the app, which could mention your health or intimate life only if you choose to write it | to answer you and improve the app; only we can read it, never your partner |
| Information about your relationship | partner names, anniversary, who you are linked with | to run the partner features |
We collect it only with your consent and only to provide the features you use. We do not collect precise location. We do not use it for advertising, to train AI models, or for research.
2. Where it comes from
Only from you (what you type, choose, rate, or play in the app) and from your linked partner's actions that you can see (for example their note, once both of you have written one). We do not buy health data or collect it from other sources.
3. What we share, and with whom
- With your linked partner, at your choice: each of you can see the other's sessions, ratings, settings and notes as described in the Privacy Policy. You can stop at any time by unlinking.
- With our processors, only to run the service and bound by a written contract: our database and sign-in host (Supabase, United States).
- We do not sell consumer health data and we do not share it for advertising. We would need your separate, signed authorization to sell it.
- We will disclose it if a valid legal process requires; we will ask for valid legal process, tell you when we are allowed to, and give only what is required.
4. Your consents
- To collect and use the data above for the features you use: asked at sign-up on a separate, unticked consent line (next to the 18+ confirmation) that links this notice and the Privacy Policy; the time of your consent and the policy version are recorded with your account. You can withdraw consent at any time by deleting the settings or notes concerned, unlinking your partner, or deleting your account (Settings > Delete account).
- To share it with anyone outside the purposes above: we do not do this; if we ever want to, we will ask separately first.
5. Your rights
You can, free of charge: confirm whether we collect your consumer health data and see it (Settings > Export my profile, or email us); see the list of third parties and affiliates we have shared it with (see section 3); withdraw consent; delete it (Settings > Delete account removes it from our database right away, and we pass the deletion to our processors); and appeal a decision about a request.
- Email support@letsdeux.com to use any right, from the address on your account. We respond within 45 days (we may extend once by 45 more days and will tell you why).
- Deletion also reaches backups: copies in encrypted backups are removed as backups roll over, within 7 days days (and in any case no longer than 6 months).
- If you disagree with our response, reply with the word "appeal"; we answer within 60 days. If you are still not satisfied, you may contact the Washington Attorney General (atg.wa.gov) or the Nevada Attorney General.
6. Security
Encrypted in transit and at rest; each account can read only its own data and what its linked partner shares; access limited to the publisher. [UPDATE after end-to-end encrypted notes and app lock ship.]
7. Changes
If we change this notice we will update the date above and tell you in the app before it applies.