Nevada Consumer Health Data Privacy Policy

Categories of consumer health data we collect, and how we use each one

GentleTaper runs on your own device. Your taper record — the medication, the doses, the schedule, your symptoms and your notes — is written to your browser's storage and stays there. It is never sent to us.

Two things do reach us:

• Your email address, if you create an account. Signing in works by a single-use link sent to your address; there is no password to create, and none is stored. An account currently holds your email address and nothing else — signing in does not move your taper history off your device. We use the address to send you that link and to keep the account. On its own an email address is not health information, but an account on a corticosteroid taper app can suggest something about the person holding it, so we treat it as consumer health data.
• What you write to us by email. If you email us and describe your taper, your symptoms or your medication, that message is consumer health data and we hold it, together with your address. We use it to answer you.

Purposes for collecting, using and sharing it

• To send you a sign-in link and to keep your account
• To reply to messages you send us

Nothing else. We do not use consumer health data for advertising, marketing, profiling, scoring or research, and we do not use it to train any model. We do not analyse it, by hand or by automated means, for any purpose other than answering you.

Categories of sources

Directly from you — the address you enter to sign in, and anything you choose to write to us. We do not obtain consumer health data from data brokers, advertising networks, public records, health care providers, insurers, connected devices, or any other outside source.

How we process it

Accounts and authentication records are held in a PostgreSQL database hosted by Supabase, in Amazon Web Services' Montreal region, encrypted in transit and at rest. Authentication logs record the address, the time and the IP of each sign-in attempt. Email is held in our mailbox at Porkbun. Access to both is limited to one person, the operator of GentleTaper.

There is no automated decision-making and no profiling. Messages are kept while they are still needed to help you and then deleted; an account is kept until you ask us to delete it.

Categories of consumer health data we share

None. We do not share any category of consumer health data with any third party.

Third parties and affiliates

Third parties with whom we share consumer health data: none.

Affiliates with whom we share consumer health data: none. GentleTaper has no affiliates.

Two service providers process it on our behalf, under contract and only to provide the service. Each acts on our instructions and may not use your data for its own purposes.

• Supabase Pte. Ltd., with Amazon Web Services beneath it — holds accounts and authentication records, in the Montreal region of Canada.
• Porkbun — carries our email.

Tracking across other websites and services

No third party collects consumer health data from GentleTaper over time or across other websites or online services.

For completeness: the site uses Vercel Analytics to count visits. It sets no cookies, receives no account identifier, and receives no health data. It records the page path, the referring site, country, device type, operating system and browser. Page paths in the app contain no doses, symptoms or identifiers.

We do not sell consumer health data

We have never sold consumer health data and we do not offer it for sale. Nevada law requires your written authorization before any such sale; we do not ask for one, because we do not sell.

Your rights, and how to exercise them

If you are a Nevada consumer, you may:

• Confirm whether we are collecting, sharing or selling your consumer health data, and obtain a list of all third parties with whom we have shared it
• Tell us to stop collecting, sharing or selling your consumer health data
• Have your consumer health data deleted

How to submit a request: email privacy@gentletaper.com from the address on your account, and tell us which right you are exercising. We use that address to authenticate the request. If we cannot match it to an account or to correspondence we hold, we will ask you for something that lets us verify it, and we will not act on an unverified request.

How long we take: we respond without undue delay and no later than 45 days after we authenticate your request. If it is genuinely complex we may extend that once by a further 45 days, and we will tell you why within the first 45.

A deletion request means deleting your account and your correspondence with us, which is all the consumer health data we hold. Your taper record is on your device and unaffected.

Reviewing and changing your data yourself

Your taper record is on your own device and under your control. Every dose, hold, plan change, symptom entry and note is entered by you in the app and can be changed or removed there, and the app has a control that erases your history from the device entirely. You do not need to ask us, and we could not do it for you.

If we decline your request

If we decline to act, we will tell you why, and you may appeal — either by replying to that message or by emailing privacy@gentletaper.com with “Appeal” in the subject line. We will respond in writing within 45 days of receiving your appeal, explaining our reasons.

If we deny your appeal, you may contact the Nevada Attorney General's Bureau of Consumer Protection at ag.nv.gov/Complaints/File_Complaint.

Changes to this policy

Uploading taper data to your account is planned but not built. If it arrives, GentleTaper will hold health data on a server for the first time, and this policy will be rewritten before that happens rather than after — with a new effective date, and with your separate, express consent asked for before any of your health data is stored.

The same applies to any other material change: a new category of consumer health data, a new purpose, or any sharing with a third party. We will post the revised policy here with a new effective date and, where we have a way to reach you, tell you before the change takes effect. We will not apply a new purpose to data already collected without asking you first.

Contact

Soutien aux Études KotobaPro
privacy@gentletaper.com