Rash: Consumer Health Data Privacy Policy
This is a separate policy, required by Washington's My Health My Data Act to be linked distinctly from our homepage and not merged into our general Privacy Policy. It governs consumer health data only.
Last updated: 26 July 2026 · Effective: on first release of the Rash: When to See a Doctor app. Publisher: Bulpara Inc.
Draft pending legal review. Describes how the app behaves, but
not yet reviewed by counsel. [TO BE COMPLETED] marks the registered entity, its address
and its jurisdiction. Coverage of state consumer-health statutes other than Washington's — including
Nevada SB 370 and Connecticut's health-data amendments — is unverified against this text
and must be confirmed by counsel before release.
We do not sell consumer health data. We have never sold it, we do not sell it now, and we have no mechanism to sell it. We will not ask you for the signed authorization that Washington law would require for a sale, because there is no sale.
1. Who this applies to
Everyone who uses the app. Washington residents, and anyone whose consumer health data is collected in Washington, have the specific statutory rights described in section 6; we apply the same practices to everyone rather than operating two systems.
2. The consumer health data we collect, and why
| Category | What it is | Why we collect it, and how it is used |
|---|---|---|
| Health condition and symptom information | Your answers to the 21-question signs-and-symptoms checklist: fever, whether the rash fades when pressed, how fast it is spreading, pain, mouth or eye involvement, blistering or peeling, recent new medications, tick exposure, age band, pregnancy, and whether you are immunocompromised. | To compute, on your device, a suggested level of care and a timeframe. A copy is sent to our server only if you also choose to send a photo, so that the photo supplement fits your situation. It is used for nothing else. |
| Bodily functions and physical characteristics — imagery | A photograph of a skin concern on your body, or on the body of a child for whom you are the parent or guardian, if you choose to add one. | Only to produce the optional photo supplement: a description of what is visible, a list of conditions that can look similar, and questions to ask your clinician. It is used for nothing else. It is never used to train a model, never used for advertising, and never used to profile you. |
| Health-related services sought | The fact that you used the app at all, and the fair-use counter tied to a random device token. | Only to enforce the fair-use limit on photo analyses. The token is random, generated on your device, and is never derived from any Apple-issued ID and never joined to anything else. |
We do not collect precise or approximate location data of any kind, so we cannot and do not use a geofence around any health facility. Location data is removed from your photo on your own device before anything is uploaded.
3. Where it comes from
- You, directly — the answers you type and the photo you choose. That is the only source.
- We do not buy, licence, receive or infer consumer health data from data brokers, advertising networks, public records, other apps, or any third party.
4. What is shared, and with whom
Consumer health data is shared only with the processors that make the photo supplement possible, only for that purpose, and only for as long as the job runs:
| Category of third party | Specific company | Category of data shared |
|---|---|---|
| Cloud object storage (transit buffer) | Cloudflare, Inc. | The photograph, held for seconds in a private bucket with public read access disabled. |
| AI inference platform | Replicate, Inc. | A short-lived signed link to the photograph, your checklist answers, and the model's output. |
| AI model provider | Google LLC (Gemini 2.5 Flash, via Replicate) | The same. |
- No advertiser, ad network, attribution partner or analytics vendor receives consumer health data — there is none in the app.
- No data broker receives it.
- No affiliate of ours receives it. [TO BE COMPLETED — counsel to confirm the affiliate list is empty on the date of release.]
- We would disclose data to law enforcement only where legally compelled — and there is almost nothing to disclose, because the photograph is deleted within seconds and your history never leaves your phone.
5. How long it is kept
- The photograph: deleted from our servers as soon as the analysis reaches a final state — typically a few seconds. A storage lifecycle rule deletes anything left behind within 24 hours. We keep no copy, and no server-side photo history exists.
- Your checklist answers: held in memory for the length of the job, then discarded. Not written to any database.
- Your history: on your phone only, under your control, until you delete it.
- The fair-use counter: a random token and a count, kept while the app is installed.
6. Your rights, and how to exercise them
Under Washington's My Health My Data Act you have the right to:
- Confirm whether we collect, share or sell your consumer health data, and access it — including a list of all third parties with whom we have shared it, and an active contact for each.
- Withdraw consent to our collection and sharing of your consumer health data.
- Delete your consumer health data from our records — and we must pass that deletion on to our processors.
- Appeal a refusal, and, if we refuse the appeal, contact the Washington Attorney General.
The two fastest routes
- Withdraw consent, instantly: in the app, Settings → turn off photo analysis. The checklist, the care level, the timeframe and every emergency warning keep working with it off, forever. That is what makes the consent genuinely free to withdraw.
- Delete everything, instantly: in the app, Settings → Delete everything.
By email
Write to privacy@bulpara.com with the word health data in the subject. We respond within 45 days, and we require our processors to complete any deletion within the same 45 days. If a request is genuinely complex we may extend once, and we will tell you before the first 45 days are up. You will never be charged, denied service, or given a worse price or experience for exercising any of these rights.
Appeals: reply to our decision and write appeal in the subject. We will
respond in writing with our reasoning. If we still refuse, you may complain to the Washington State
Attorney General at www.atg.wa.gov/file-complaint. Washington's Act also gives individuals
a private right of action under the Consumer Protection Act.
7. Consent
We collect consumer health data only with your consent, asked for separately from anything else:
- The consent screen appears once, full screen, immediately before the first time the camera or photo picker is opened — after you already have your checklist answer, so that declining costs you nothing.
- It is not part of an onboarding carousel, not a checkbox in the Terms, and nothing is pre-ticked.
- There are two separate toggles, each off by default: one to send the photo for analysis, and one to keep photos on your own phone for comparison later. The second is genuinely optional and the app works fully with it off forever.
- The buttons are Analyze my photo and Skip the photo, at equal visual weight.
- Both are revocable in Settings, with a one-tap purge. If we materially change what the consent screen says, you are asked again.
8. Contact
- Consumer health data requests, and the person accountable for them: privacy@bulpara.com (45-day response)
- Publisher: Bulpara Inc.,
[TO BE COMPLETED — registered entity, address and jurisdiction]
This policy applies to the general Privacy Policy's subject matter only where the two overlap; where they differ as to consumer health data, this policy governs.