Consumer Health Data Privacy Policy

Consumer health data we collect

We collect only information you choose to provide, generate, or explicitly authorize POTS IQ to import. Categories may include: symptoms and flares; heart rate, blood pressure, standing-test results and other vitals; hydration, sodium and electrolyte intake; medications and supplements; exercise and activity response; diagnoses and conditions you enter; care-team and appointment information; journal notes and possible triggers; goals and reminders; allergies and emergency-card information; and derived summaries, trends, and personal associations. If a Premium user connects Apple Health, POTS IQ may read heart rate, resting heart rate, heart-rate variability (HRV), blood pressure, oxygen saturation, respiratory rate, and exercise minutes after the user grants Apple Health permission.

Sources of consumer health data

Consumer health data comes directly from you through information you enter, select, or generate inside POTS IQ, plus summaries and trends derived from those entries. Premium users may optionally connect Apple Health; when enabled, POTS IQ reads only the Apple Health categories listed above after system permission is granted. We do not automatically import medical records or health information from clinics, insurers, employers, advertising networks, or data brokers.

Why we collect and use it

BP Labs LLC processes consumer health data only to provide the product and services you request: saving and displaying your history; showing dashboards, summaries, and descriptive trends; organizing medication and supplement response timelines; supporting reminder plans; creating user-controlled reports, quick health cards, and exports; securing and maintaining the service; troubleshooting; and responding to support or privacy requests. POTS IQ does not use consumer health data to diagnose a condition, establish cause and effect, make automated decisions that produce legal or similarly significant effects, or train large language models.

Consent

Before POTS IQ stores consumer health data, we ask for a separate, affirmative opt-in that identifies the categories of health data we collect, why we use them, the service-provider category that processes them, and how to withdraw consent. Consent is not bundled into acceptance of the Terms of Use. You may withdraw consent at any time from Settings → Data. If you withdraw consent, POTS IQ stops active health-data processing for your account and removes active account-linked health data; your basic account may remain so you can choose whether to consent again later. If we later want to collect a new category of consumer health data or use health data for a materially different purpose, we will update this policy and obtain additional consent when required.

Health data we share and who receives it

We do not sell consumer health data and do not use HealthKit or other consumer health data for targeted advertising, marketing, or unrelated data mining. Amazon Web Services (AWS) is the service-provider/processor category that receives the consumer health data needed to operate POTS IQ. AWS provides account authentication, API processing, database storage, backups, and security infrastructure. For Apple Health sync, raw Apple Health samples remain in Apple Health on the device; POTS IQ sends compact derived daily summaries to AWS so the user can see trends and reports across devices. Floot hosts the POTS IQ application interface, but production health-data flows are designed to send consumer health records directly from the app to AWS rather than through Floot. BP Labs LLC has no health-data-sharing affiliates at launch. We may disclose information when you intentionally export or share it, when necessary to protect the service or users, or when legally required. If future sharing is not necessary to provide a feature you request and applicable law requires separate sharing consent, we will ask for that consent before the sharing occurs.

Cross-border processing

POTS IQ's current AWS infrastructure is operated in the United States. If you use POTS IQ from Canada or another country, the account information and consumer health data you choose to enter may therefore be processed or stored in the United States. Information processed there may be subject to U.S. law and lawful access by courts, law-enforcement agencies, or national-security authorities. BP Labs LLC remains responsible for personal information under its control and uses contractual, administrative, and technical safeguards with service providers.

Your rights and how to submit a request

• Confirm whether POTS IQ is collecting, sharing, or selling your consumer health data.
• Access the consumer health data associated with your account and, where required, obtain information about recipients.
• Export a copy of your history from Settings in JSON or CSV format.
• Request correction of inaccurate personal data.
• Withdraw consent for collection or sharing.
• Request deletion of consumer health data.

You may use Settings → Data for exports, consent withdrawal, and account deletion. You may also email accounts@bplabsllc.com from the email associated with your account. Do not include passwords, verification codes, or unnecessary health details in the email. We may request additional information reasonably necessary to verify your identity and request. We respond within the deadlines required by applicable law. For an access request governed by Canada's PIPEDA, the ordinary deadline is 30 days after receipt, with only the extensions permitted by that law and notice of an extension provided within the original 30-day period.

Appeals and complaints

If BP Labs LLC declines to take action on a privacy request, our response will explain the reason and the appeal or complaint options available under applicable law. For jurisdictions where POTS IQ provides an internal appeal, email accounts@bplabsllc.com with “POTS IQ Privacy Appeal” in the subject and identify the prior request. Canadian users may submit an unresolved PIPEDA concern to the Office of the Privacy Commissioner of Canada. Washington consumers may also use the Washington Attorney General complaint process, and Connecticut consumers may use the Connecticut Attorney General complaint process.

Deletion, backups, and retention

Account-linked health information is retained while your account is active so POTS IQ can provide history and reports. Account deletion removes the Cognito account and linked data from the active POTS IQ service. Consent withdrawal removes active account-linked health data while allowing the basic account to remain. POTS IQ currently uses a 35-day AWS DynamoDB point-in-time recovery window. Deleted data may therefore remain temporarily in disaster-recovery copies until those copies age out, but those copies are not used for normal app operation. If recovery data is ever restored, BP Labs LLC's restoration procedure requires deletion requests to be honored before recovered data is returned to active use. Other records may be retained only when legally required or reasonably necessary for security, fraud prevention, or legal claims.

Security

We use administrative, technical, and organizational safeguards appropriate to the nature of the data and the service. Authentication is handled by Amazon Cognito; API requests require a validated Cognito token; application code derives the data-owner identifier from that verified token instead of accepting a user ID supplied by the browser; DynamoDB data is encrypted at rest; and network traffic is protected in transit. No online service can guarantee absolute security.

Advertising, sale, profiling, and AI training

POTS IQ does not sell consumer health data or personal data, does not use consumer health data for targeted advertising, does not use consumer health data for automated decisions that produce legal or similarly significant effects, and does not use personal data or consumer health data to train large language models.

Changes to this policy

If we materially change how we collect, use, or share consumer health data, we will update this policy and obtain additional consent when required before using previously collected data for a materially different purpose.

Contact and last update

BP Labs LLC operates POTS IQ. BP Labs LLC's privacy lead can be reached at accounts@bplabsllc.com for questions, access/correction requests, complaints, or other privacy matters. This policy was last updated September 30, 2026.