Consumer Health Data Privacy Policy
Last updated: 27 October 2026
This policy is for people in Washington State, under the Washington My Health My Data Act (RCW 19.373), and in other US states with similar consumer health data laws, where they apply. It adds to our Privacy Policy. Halcyo is provided by HESTERVALE LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA (“we”, “us”).
The short version
- The health information you enter in Halcyo stays on your phone. In the current version we don’t receive it.
- We don’t sell consumer health data, and we don’t use it for advertising.
- You can delete everything on your phone in the app, and ask us to delete anything we or our processors hold.
Consumer health data in Halcyo
The app asks about your tinnitus (what it sounds like, which ear, how long, how much it affects you, and a few safety questions), matches the tone you hear, and keeps daily check-ins (loudness, distress, stress, sleep and factors such as caffeine or alcohol). This can be consumer health data. It is stored only on your phone, in the app. We use it there to set up your sound, your 28-day program and your reminders.
Sources: you, through what you enter in the app.
What we collect
In the current version of Halcyo, the app sends none of the information above to us. Subscriptions run through the App Store or Google Play, and RevenueCat, Inc. processes your purchase records and an anonymous app user ID for us so the app knows whether your subscription is active. The fact that you subscribe to a tinnitus app could be read as information about your health; RevenueCat processes it only to provide this service to us.
The AI coach is not available in the current version. If we turn it on, it will only send messages after you agree on a separate consent screen, and this policy will be updated first to describe what is sent (your messages and parts of your plan go to our server and to Anthropic PBC to write a reply) and how long it is kept.
Sharing
We don’t share consumer health data with third parties or affiliates, and we don’t sell it. We use processors that act only on our instructions: RevenueCat, Inc. (subscription status) and, once the coach is available and only with your consent, Cloudflare, Inc. (coach server) and Anthropic PBC (AI replies).
Your rights
You have the right to confirm whether we collect, share or sell your consumer health data, to see it and the list of third parties and affiliates we share it with (there are none today), to have it deleted, and to withdraw any consent you gave.
- Delete what is on your phone: in the app, Settings → Your data → Delete all my data. Deleting the app also removes it.
- Everything else: email [email protected]. We may ask you for information to find your records (for example, the app user ID shown with your purchase) and answer within 45 days. If we need longer, we tell you why and may extend once by another 45 days.
- Appeal: if we decline your request, reply to our answer with “appeal”. We will respond to the appeal in writing. If you are not satisfied, you can contact the Washington State Attorney General.
Contact
Privacy Officer, HESTERVALE LLC, [email protected]