Consumer Health Data Privacy Policy

Last updated: 27 October 2026

1. Scope

This policy covers the consumer health data that Reific, Inc. (“Reific”, “we”, “us”) collects through Zeds (zeds.app). Reific operates Zeds, is the controller of this data (we decide why and how it is used) and is the purchaser of any data you later license to us. This is our consumer health data privacy policy under Washington’s My Health My Data Act and the consumer health data laws of Nevada and Connecticut.

Other personal data, such as a message you send us, is covered by our Privacy Notice.

2. The consumer health data we collect, and why

The tally

When you choose an export file on Zeds (from Apple Health, the Oura app, the Google Health app or the Samsung Health app), your browser analyzes it on your device and produces a tally. The file itself is not sent to us. We receive the tally only if you send it with the form. It contains:

the first and last month the data covers, and counts of the days, months and nights with data and of the gaps between them;
which signal categories are present (sleep and sleep stages, heart rate, heart rate variability, resting heart rate, breathing rate, temperature, steps and activity, workouts and blood oxygen), on how many days and in which months, how many readings a day there are, and what share of them is out of range;
the kind of device or app, as a generic label such as “Apple Watch”, “Oura”, “iPhone”, “Fitbit”, “Pixel Watch”, “Galaxy Watch”, “Galaxy Ring” or “Android phone” (we are not affiliated with Apple, Oura, Google or Samsung);
the number of records, workouts and ECG recordings, and the type and size of the file;
the median hours the device was worn at night and by day, counts of time-zone changes and unusual nights, and flags for data that looks stuck, duplicated or imported;
a score and an estimate computed from these;
only if you tick the separate cycle-tracking box before the check: how many cycle-tracking entries there are (such as menstrual flow, ovulation tests and cervical mucus), on how many days and in which months.

The tally holds no readings, timestamps, device names or your name. It shows that you track certain things about your body, which makes it consumer health data.

The check never reads the profile or photo files inside an export (the “Your Profile” folder of a Google Takeout, the “files” folder of a Samsung Health download).

Purposes and use: to assess how much data there is and how complete it is; to decide whether to contact you, and to contact you, about licensing your full export; and to keep a record of your consent.

Your contact details, linked to the tally

Your email address; your phone number, if you give it; whether you ticked the cycle-tracking and updates boxes; the version of the Contributor Terms you accepted; and when you sent the form.

Purposes and use: to contact you about your data, to keep a record of your consent and, only if you ticked the updates box, to send you occasional updates.

Later, only under a signed agreement: your full export

If both sides go ahead, you send us the full export file under a signed Contributor Agreement and a separate, signed sale authorization (see section 5 of the Contributor Terms). It holds the readings your devices recorded, in the categories listed above.

Purposes and use: to check the file and pay you as agreed; to remove your identity from the records (de-identify them); and to license the de-identified data to teams building health AI. After payment we delete the raw file and the link between the data and your email address.

3. Where it comes from

From you, directly, when you send the form; from your own browser’s analysis, on your device, of a file you chose; and, under a signed agreement, from the export you send us. We do not get consumer health data about you from anyone else.

4. What we share

We share the tally and your contact details only with the service providers and the affiliate listed in section 5, which handle them for us and on our instructions, and with public authorities where the law requires it.

We never share consumer health data with, or send it to, analytics or advertising providers. The site’s usage statistics (see our Privacy Notice) never include the tally, the estimate, anything read from your file or your contact details, and we never combine them with those.

No sale of your consumer health data happens without a separate sale authorization that you have signed (see section 5 of the Contributor Terms). Your data is never sold to advertisers, data brokers, insurers or employers, and we do not use it for advertising.

Once data from a full export has been de-identified, we license it to teams building health AI. De-identified data can no longer reasonably be linked to you, so it is not consumer health data. We publicly commit not to re-identify it, and the teams that receive it are contractually barred from trying.

5. Who we share it with

Attio, Inc.: Customer relationship management (CRM). Stores the tally and your contact details.
Google LLC (Google Cloud): Hosting. Runs Zeds in its Belgium region, carries your submission from your browser to our server, and keeps server logs for up to 30 days.
Our email provider: Carries and stores the emails we exchange with you.
Reific, UAB: Our affiliate and our establishment in the EU, A. Jakšto g. 6A-22, LT-01105 Vilnius, Lithuania. May handle the tally and your contact details on our behalf.
Public authorities: Only where the law requires us to disclose data.

6. Your rights in Washington, Nevada and Connecticut

If you live in Washington, Nevada or Connecticut, you have these rights over your consumer health data. We honor the same requests wherever you live.

Confirm and access. Ask whether we collect, share or sell your consumer health data, and get a copy of it.
Third parties. Get a list of all the third parties and affiliates with whom we have shared or sold it, with an email address or other online way to contact each.
Withdraw consent. Withdrawing is as easy as giving it: one email to zeds@reific.co. We then stop collecting and using your consumer health data.
Delete. Have it deleted. We also tell the service providers and the affiliate that hold it to delete it.

How to ask. Email zeds@reific.co from the address you gave us and say what you would like. You do not need an account. To protect your data we first check that the request comes from you, usually by confirming that you control that email address; if we cannot, we will tell you what else we need.

When we answer. Within 45 days of receiving your request. If we need longer, we may extend this once by up to 45 more days, and we will tell you why within the first 45 days. Requests are free.

Appeal. If we decline to act on a request, we will tell you why. You can appeal by replying to our decision, and we will answer your appeal in writing within 45 days. If we deny it, you can complain to the attorney general of your state: Washington (atg.wa.gov), Nevada (ag.nv.gov) or Connecticut (portal.ct.gov/ag).

We will not treat you differently for exercising any of these rights.

7. Contact

Reific, Inc., 251 Little Falls Drive, Wilmington, Delaware 19808, United States. Email zeds@reific.co.