Consumer Health Data Privacy Policy

Effective October 27, 2026. Two Three Ventures, LLC operates iQStax. This notice explains the current handling of consumer health data, including the optional records-only cloud service. It applies alongside the Privacy Policy, which explains account details, billing, marketing and website analytics. The planned shared website subscription service is not active.

Who this notice covers

iQStax is intended for adults aged 18 and over worldwide, subject to availability and applicable local law. It is not intended for children. Contact info@myiqstax.com if you believe a child has provided information to our online service. An app-store content rating is not an age-verification check.

This notice includes Washington residents and people whose consumer health data is collected in Washington. Rights may also apply under the law where you live. Publishing this notice does not enroll you in cloud storage or marketing.

Health data and its sources

You choose what to record: medication and other item names, categories, inventory, doses, amounts, dates, body locations, schedules, preparation details, weight, mood, symptoms, notes, related history, and photos you choose to attach locally. These entries, combinations and histories may reveal physical or mental health information. The source is what you enter or import into iQStax, including supported entries from the paired Apple Watch through your iPhone. We associate a consented cloud copy with your verified account and related account identifiers.

Purposes and your choice

On-device records support your own logging, reminders, inventory and progress views. If you affirmatively choose records-only cloud backup and authorized support access, the account service stores your permitted records for backup, reviewed restore, assistance and recovery. Account sign-in, subscription verification or marketing consent alone does not authorize a health-record upload. Consent is optional for local phone tracking. Photos stay out of app-managed cloud backups; exports or operating-system backups you choose are separate.

Recipients and disclosures

We have no affiliates receiving consumer health data and no other staff or separately engaged providers with access to customer or support data. Service providers may use their own infrastructure and subprocessors. Brevo handles separate newsletter signups; we do not send app health records to it. Netlify hosts the older browser beta, whose working records remain in that browser. It receives ordinary connection information, not an automatic upload of those local records.

Health records are not included in newsletter signup or store purchase verification. We do not sell consumer health data or use it for advertising. If you choose to export, share or use an operating-system backup, the recipient or platform you select handles that copy separately. We may disclose information when legally required; we do not treat that as permission for unrelated new uses. We obtain any additional consent required before a new collection or sharing purpose begins.

Retention and copies

Local records remain until you remove them or your device or browser removes its data. Active consented cloud snapshots remain until replaced, withdrawn or deleted. Account/contact and consent information remains until account deletion. Failed active-storage removals are retried. Cloudflare database recovery copies may retain removed database information for up to 30 days; separate deletion/withdrawal protections are used to prevent restored copies from reactivating old access or consent.

Content-free support audit entries and deletion-protection markers have a separate 90-day retention period. They do not contain health-record contents. Provider security and email-delivery logs have separate retention. We explain any applicable retention limitation when responding to a request and arrange required deletion with providers; removal from active storage is not a promise of immediate erasure from every backup.

Cloud backup and restore use dated snapshots, not continuous merging between devices. Photos are excluded from app-managed cloud copies. Your local photos, exported files, operating-system backups and copies you shared need to be managed separately; importing a saved copy can bring records back.

Access, withdrawal and deletion

You can ask whether we collect, share or sell your consumer health data, request access and correction, ask for the categories and names of recipients and a way to contact them, withdraw collection or sharing consent, or request deletion. Use Profile → Account & cloud backup → Account & privacy choices where available, or contact info@myiqstax.com with “iQStax health data request.” We may ask for information reasonably needed to verify the request. Do not send health records, passwords, or sign-in codes in an email. You do not need to create a new account to make a request.

When the service accepts your withdrawal, it stops future uploads and support access and initiates removal of the active cloud copy. Online account deletion and local device deletion are separate. See data deletion instructions. Subscription cancellation and separate marketing lists are also separate actions.

Privacy requests and appeals

Andy, the operator of iQStax, handles requests at info@myiqstax.com. You can request access, correction, deletion, withdrawal of consent, and information about recipients. Identify the service involved without sending health records, passwords or sign-in codes. We use only the information reasonably needed to verify and fulfill your request; you do not need to create a new account to make one.

We respond within 45 days. If applicable law permits an extension and one is necessary, we notify you within the initial 45 days, explain why, and give the extended deadline. Your location may provide additional rights or require a shorter deadline; those requirements continue to apply.

To appeal a decision, reply to it or email info@myiqstax.com with “Privacy appeal” and your request reference. Andy will reconsider the decision and give you a written explanation within 45 days. If an appeal is denied, we explain how to contact the relevant regulator, including the Washington Attorney General for Washington consumer-health requests. See our separate Consumer Health Data Privacy Policy and data deletion instructions.

Consumer-health requests are free at least twice annually where Washington law applies. We will explain any lawful refusal, limitation or permitted charge rather than treating a request as consent to new collection. Applicable legal rights are not waived by this notice.