DRAFT — ATTORNEY REVIEW REQUIRED. This page is a structural, good-faith draft, not a finished legal document. It must be reviewed and finalized by counsel specializing in health-claims and state consumer-privacy law — in particular theWashington My Health My Data Act (MHMDA), CCPA/CPRA, andGDPR — before PoopRx collects, stores, processes, or shares any consumer health data in production. Nothing on this page is legal advice.

Privacy Policy

Last updated: PLACEHOLDER DATE — not yet in effect.

The short version

The poop-check wizard on this site is designed to run entirely in your browser. Your answers are processed on your device, are not transmitted to any server by default, and are not stored in any account. Answers live only in your browser's session storage and clear when you close the tab. If you opt in to "remember my answers on this device," they move to local storage on that device only, until you clear them — they are still never transmitted anywhere by that setting alone.

We do not sell your health data. We do not run ad-tracking pixels on the wizard, results, or article pages. Those are architectural commitments, not just policy language — see "What we do NOT do" below.

What the wizard does with your answers

• Your selections are processed client-side, in your browser, to route you to a results page and generate the citations shown to you.
• Nothing you enter in the wizard is sent to a PoopRx server as part of normal use.
• By default, answers are session-only and are cleared automatically when you close the tab.
• An opt-in "remember on this device" setting stores answers in browser local storage on that device only. Turning this on does not change the no-transmission rule above — it only changes how long your own browser keeps a local copy.
• PLACEHOLDER: confirm final build has no telemetry/analytics call embedded in the wizard flow itself before this claim ships as-is.

What we do collect

• Standard server logs. Like almost every website, our hosting/CDN layer logs standard technical data (IP address, user agent, requested URL, timestamp) for security, abuse prevention, and uptime — not tied to your wizard answers. PLACEHOLDER: confirm exact retention window with hosting provider before publish.
• Email, only if you give it to us. If you choose to subscribe (for example, to an educational email series), we collect the email address you provide and use it for that purpose. We do not pre-fill or infer an email from anything else on the site.
• No advertising or analytics trackers are wired into this site as of this draft. If that ever changes, this page gets updated first, and — per the Washington section below — a consent mechanism would be required before any health-adjacent data could be used that way.
• No cookies beyond what's strictly necessary, if any, are set by this site today.

What we do NOT do

• We do not sell, rent, or trade consumer health data to anyone, ever, under any framing.
• We do not place ad-tech pixels (Meta Pixel, Google Ads remarketing tags, or similar) on the wizard, results pages, or article pages.
• We do not use your quiz answers to build an advertising profile.
• We do not share wizard answers with a third party as part of normal operation.

Washington My Health My Data Act (MHMDA)

Washington's My Health My Data Act is one of the strictest consumer-health-privacy laws in the country, and it applies to any Washington-state visitor regardless of where PoopRx is based. This section is meant to be that law's required separate Consumer Health Data policy — kept distinct from marketing language, as the law requires.

• What counts as "consumer health data" here: information about your bowel or digestive symptoms, entered into the wizard, very likely falls within MHMDA's broad definition of consumer health data. We're treating it that way rather than arguing the narrow case.
• Consent before collection. MHMDA requires affirmative consent before consumer health data is collected, shared, or used — not after. If any future version of this site changes the wizard's client-side-only architecture in a way that involves the server receiving your answers, that change requires a pre-collection consent screen built first, not retrofitted after launch.
• No sale without signed authorization. We do not sell consumer health data, and would never do so without the separate, signed authorization MHMDA requires — which we do not intend to seek.
• No geofencing. We do not geofence around health facilities to target or infer visits.
• Your rights. You have the right to confirm whether we're processing your consumer health data, access it, request deletion, and withdraw consent. Because the wizard's answers never leave your device by default, deletion for most users is as simple as clearing your browser data for this site. For anything we do hold server-side (like a subscribed email address), requests will be honored within the 45-day window the law requires.

⚖️ Needs specific attorney attention: whether a fully client-side, "never transmitted" architecture actually exempts PoopRx from MHMDA's definition of "collection," or whether a pre-use consent screen is still required simply because health-adjacent data is being processed at all (even locally) — this is an open legal question, not an engineering assumption we're treating as settled.

California (CCPA/CPRA)

• Under California's current regulations, health data is treated as Sensitive Personal Information.
• We honor Global Privacy Control (GPC) signals automatically, with a visible on-page confirmation when one is detected. PLACEHOLDER: confirm GPC-detection implementation before launch.
• We offer a "Limit Use of My Sensitive Personal Information" control, available at [PLACEHOLDER LINK], for any use beyond delivering the core wizard experience.
• California residents have the right to know, delete, correct, and opt out of sale/sharing of personal information — see contact section below to exercise these rights.

GDPR (EU visitors)

If PoopRx knowingly markets to or targets EU visitors, GDPR applies. Health data is "special category" data under GDPR Article 9, which requires explicit, specific, opt-in consent — never a pre-ticked box, and never bundled into general terms-of-service acceptance. PLACEHOLDER: confirm whether/when PoopRx's marketing is EU-targeting in a way that triggers this, and build the opt-in consent flow accordingly before that happens.

Age screening

PLACEHOLDER — this site uses a neutral age-screen ahead of the wizard rather than assuming an all-adult audience, given the mascot's kid-appealing design. This section needs a COPPA-specific compliance gut-check from counsel before launch.

HIPAA

PoopRx is an independent consumer content and self-education site, not a healthcare provider, health plan, or clearinghouse, and does not currently integrate with one — so HIPAA's Privacy Rule does not apply to data processed by this site as currently scoped. PLACEHOLDER: re-confirm this if PoopRx ever integrates with an actual telehealth or healthcare-provider partner.

Changes to this policy

If this policy changes in a way that affects how consumer health data is handled, we will post the update here with a new "last updated" date, and — where MHMDA, CCPA, or GDPR require it — seek fresh consent before the change takes effect.

Contact

PLACEHOLDER — privacy contact email/address pending. Requests to access, delete, or withdraw consent for any data we hold can be sent there once published.