Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Orlyn (operated by Luca Diaz Hilterscheid as a sole proprietor under the laws of the Federal Republic of Germany) collects, uses, and shares consumer health data as defined by the Washington My Health My Data Act (RCW 19.373), and the rights you have over that data. It applies to Washington residents and to persons whose consumer health data is collected in Washington, and supplements our general Privacy Policy. If this policy and the general Privacy Policy conflict with respect to consumer health data, this policy controls.

1. Categories of consumer health data we collect

Orlyn is a quit-drinking support app. We collect the following categories of consumer health data, in each case only when you provide it:

• Alcohol-use answers. Your responses to the onboarding questionnaire, including the three AUDIT-C alcohol-screening questions (drinking frequency, typical quantity, and frequency of heavier sessions), your motivation for quitting, and your chosen start date.
• Craving and mood logs. Daily check-in data such as mood, craving intensity, optional journal notes, sober-streak events (including a logged drink), and use of the craving-support tools.
• Coach conversations. The messages you exchange with the AI support coach, which may describe your drinking, cravings, health, or wellbeing.

We do not collect biometric data, precise location data, or data from health sensors, and we do not use geofencing of any kind around any facility.

2. Purposes: why we collect and use it

• To provide the services you asked for: your sober streak, daily check-ins, craving support, personalized onboarding, and the AI coach.
• To generate the AI coach's replies. Your coach messages are processed by our AI model provider (DeepSeek) solely to produce the response; see Section 4.
• To operate, secure, debug, and improve the service (for example, aggregate usage metrics and crash diagnostics).
• To comply with legal obligations and respond to your requests.

We collect consumer health data with your consent, or as reasonably necessary to provide a product or service you have requested. We do not use consumer health data for advertising, and we do not infer health characteristics about you for marketing purposes.

3. Sources of the data

All consumer health data comes directly from you: the answers you give in onboarding, the check-ins you log, and the messages you send to the coach. We do not buy or derive consumer health data from third parties.

4. Who can see it (categories of recipients)

We do not sell consumer health data, and we will not sell it. We share it only with processors acting on our instructions, under contracts that restrict their use of the data:

• Supabase (database and authentication hosting), which stores your account and health data.
• DeepSeek (AI model provider), which processes the text of your coach messages to generate replies. Using the coach is optional; the rest of the service works without it.
• Sentry (error monitoring), which may incidentally process limited data in crash reports; we scrub identifiers and message content where feasible.
• Apple and payment processors (Apple In-App Purchase / RevenueCat, and Stripe for web purchases) receive purchase data only, not your health data.

We do not share consumer health data with advertisers, data brokers, or social networks. We may disclose data where required by law, as described in the general Privacy Policy.

5. Your rights

Under the My Health My Data Act you have the right to:

• Know whether we collect, share, or sell consumer health data about you, and to access that data, including a list of the third parties with whom we have shared it.
• Withdraw consent to our collection and sharing of your consumer health data.
• Delete your consumer health data. You can delete your account and all associated data at any time in the app under Settings, Account, Delete Account, or by emailing us.
• Not be discriminated against for exercising any of these rights.

To exercise any right, email us at support@orlyn.ai from the email address on your account (so we can verify your identity), or use the in-app tools described above. We respond within the timelines required by the Act. If we refuse a request, you may appeal by replying to our decision; if your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

6. Changes to this policy

If we change this policy, we will post the updated version at orlyn.ai/consumer-health-data and update the effective date above. Material changes will be notified in the app or by email.

7. Contact

Luca Diaz Hilterscheid (Orlyn)
Märkische Heide 5, 14532 Kleinmachnow, Germany
Email: support@orlyn.ai