Consumer Health Data Privacy Policy

Effective date: October 24, 2026

Who this covers. This policy applies to "consumer health data" as defined by Washington's My Health My Data Act (RCW 19.373) and Nevada law (NRS 603A, as amended by SB 370). It covers Washington and Nevada residents, and anyone whose consumer health data is collected in Washington or Nevada. Brightloop LLC ("Brightloop," "we," "us") operates the Solys app and solysapp.com (the "Service").

1. Consumer health data we collect, and why

Category	How it reaches us	Why we use it
Health information in content you post or send. Posts, comments, Rally Messages, messages, Mission answers, Vault items, photos, videos and voice replies in which you mention your physical or mental health, a condition, a treatment or a struggle	You write or upload it	To store it and show it only to the audience you chose; to review content for safety and rule violations; to keep the Service secure
Crisis-support signal. An automated inference that a post you wrote may show you're in crisis	Created by our automated review, only if you turned crisis support on	To privately show you crisis resources. Nothing else
Pulse check-ins. How you say you're feeling	You enter it, only after you agree on the Pulse consent screen	To show you your own history. If you choose, it's included in a combined Circle count shown only when at least 5 members have shared

We do not offer crisis support or Pulse to people who tell us they live in Washington or Nevada. Because the law also covers data collected while you're in these states, this policy covers those features anyway.
We do not collect precise location, biometric data, or data from health devices. We do not geofence health care facilities.
We do not use health information to build a profile of you or to guess at your health beyond the crisis-support signal you turned on.
We do not use any consumer health data for advertising.

2. Where it comes from: only from you, from content you create, and from features you turn on. We never buy it or get it from data brokers.

3. Who we share it with. Only what each recipient needs to run the Service:

The audience you choose: your Circles, your Beacons, or the public for public posts.
Service providers that process data only on our instructions, under contract:
- Supabase: database and file storage
- Mux: video hosting
- Anthropic: automated content review, and the crisis-support signal if you turn it on
- Google: website hosting, and the team email that receives moderation alerts
- Resend: sends those alerts
- Apple and Google: push notifications, which can show a short preview of a post or message
- PostHog (product analytics) and Google Firebase Crashlytics (crash reports) are also service providers. We do not send them consumer health data.
When the law requires it, or to protect someone from imminent harm, as our Privacy Policy explains.
Affiliates: Brightloop has none.

We do not sell consumer health data. We will never sell it without your separate, signed authorization as Washington law requires. No third party collects consumer health data from the Service to track you across other apps or websites over time.

4. Your rights. You can:

Confirm and access: ask whether we collect, share or sell your consumer health data, and get a copy;
See who received it: get a list of every third party and affiliate we shared it with, with their contact information;
Review and correct: edit or delete your own content in the App at any time, or ask us to;
Withdraw consent: turn off crisis support or Pulse in Settings at any time;
Delete:
- delete individual posts, or one or all Pulse answers, in the App;
- or delete your account in Settings → Delete account or at solysapp.com/account-deletion.
- We delete it from our live systems within 30 days. Backups roll off automatically within 7 days. We also tell our service providers to delete it.

How to ask. Email privacy@solysapp.com with "Consumer health data request" in the subject. You don't need an account. We verify you're the person the data is about (usually by replying from the email on the account). We answer within 45 days. We can extend once by 45 more days if reasonably necessary, and we'll tell you why. Requests are free, at least twice a year.

Appeals. If we decline, reply to our decision with "Appeal" in the subject. We'll answer in writing within 45 days and explain why. If we deny the appeal, you can contact the Washington Attorney General (atg.wa.gov/file-complaint) or the Nevada Attorney General (ag.nv.gov/Complaints/File_Complaint).

5. Changes.

We post every change here with a new effective date.
Before a material change, we tell you by email or with a notice in the App at least 30 days before it takes effect.
If we ever want to collect a new category of health data or use it for a new purpose, we will ask for your consent first.

Contact: Brightloop LLC, 5831 Forward Ave #1247, Pittsburgh, PA 15217 · privacy@solysapp.com