Senstory — Consumer Health Data Privacy Policy
Last updated: 13 October 2026
This is a draft. It is written against what Senstory actually collects, but a document governed by a law carrying a private right of action should be reviewed by a US privacy lawyer before it is published. Complete the bracketed items first.
This policy applies to residents of Washington State under the My Health My Data Act, and to residents of Nevada under Nevada SB 370. It is separate from, and additional to, our general Privacy Policy, which continues to apply to all users.
It explains what consumer health data Senstory collects, why, who we share it with, and the rights you have over it.
1. Who we are
Andrew Gallagher, trading as Senstory, a sole trader based in the United Kingdom.
- Email: admin@senstory.app
- Postal address: [add a postal address — US consumers are entitled to a working contact route, and "available on request" is weaker here than under UK law]
Senstory helps parents and carers of children with neurodevelopmental differences track their child's wellbeing, surface patterns over time, and create personalised supports such as social stories.
2. What "consumer health data" means here
Washington law defines consumer health data broadly: personal information that identifies a consumer's past, present, or future physical or mental health status. It covers behavioral health, symptoms, diagnoses, treatments, medications, and bodily functions.
Much of what Senstory is designed to record falls within that definition. We treat it as consumer health data throughout, whether or not any clinical professional is involved.
Senstory does not diagnose, assess, treat, or provide medical advice. The information below describes what we store because you chose to record it, not any clinical determination made by us.
3. Whose health data this is
In most cases the health data in Senstory is about a child, and it is entered by their parent or carer, who holds the account.
Under Washington law the child is the consumer, and the parent or carer acts as their authorized agent. So:
- The parent or carer gives consent on the child's behalf.
- The parent or carer exercises the rights in Section 8 on the child's behalf.
- Where a user records information about their own health (for example in the parent wellbeing features), that data is their own.
Senstory is intended for use by adults. It is not directed to children, and children do not hold accounts.
4. The consumer health data we collect
| Category | What it includes |
|---|---|
| Behavioral and mental health records | Logged behaviors, moods, emotional regulation ratings, triggers, incidents, and daily check-ins about a child |
| Sensory information | Sensory preferences, sensitivities, and the sensory profile built from them |
| Health-adjacent daily records | Sleep, appetite, activities, and events you choose to log |
| Documents you upload | Reports and similar documents you provide for the Service to summarize, which may contain diagnoses, assessments, or professional observations |
| Appointments and care planning | Appointments, tasks, key dates, and the professionals or services they relate to |
| Information you give to the AI assistant | Anything you type into the in-app assistant about your child's health, development, or behavior |
| Derived content | Insights, summaries, patterns, and supports the Service generates from the above |
We do not collect precise location data, biometric identifiers, or data from health devices or wearables.
5. Where it comes from
All consumer health data in Senstory comes from you. You enter it directly, or you upload a document containing it. We do not buy health data, obtain it from data brokers, or receive it from third parties.
Derived content (insights, summaries, social stories) is generated by the Service from what you entered.
6. Why we collect it, and how we use it
We collect and use consumer health data only to provide the Service you asked for:
- To store and display the records you log, so you can see them over time
- To identify patterns and generate insights about your child's wellbeing
- To create personalised supports, such as social stories and visual symbols
- To let the in-app assistant answer questions in the context of your child
- To send reminders you have set for appointments, tasks, and key dates
We do not use consumer health data for advertising, profiling unrelated to the Service, or training third-party AI models.
7. Consent
We ask for your consent before collecting consumer health data beyond what is strictly necessary to provide the Service, and separately before your information is sent to any AI provider.
That consent is:
- Separate from our terms of use and general privacy policy
- Opt-in — nothing is assumed from your continued use of the Service
- Specific about what is collected and who it is shared with
- Withdrawable at any time, without affecting data processed before you withdrew
[Confirm this matches the in-app experience shipped to US users before publishing. If consent is currently bundled into signup, it needs separating for Washington.]
8. Who we share it with
We share consumer health data only with service providers who help us operate the Service, under contracts requiring them to protect it. We name them specifically:
| Third party | What they receive | Why |
|---|---|---|
| Base44 | All account and logged information, including consumer health data | Application hosting, database, authentication, and AI processing platform |
| OpenAI (via Base44) | The information you logged that is needed for the feature you requested | Generating insights, summaries, and social stories |
| Google (via Base44) | The information you logged that is needed for the feature you requested | Generating insights, summaries, and social stories |
| ElevenLabs (via Base44) | Text to be spoken, which may include your child's name and story content | Generating spoken audio for social stories and songs |
Information is sent to AI providers only when you use an AI feature, and only to produce the content you requested. It is not used to train their models.
Not shared with: our payment and subscription providers. Apple, Google Play, Stripe, and RevenueCat handle subscriptions only. They receive payment or subscription-status information and an identifier — never health data, and never information about your child.
We may disclose information if required by law, or to protect the rights, safety, or security of users or others.
9. We do not sell consumer health data
Senstory does not sell consumer health data, and we have never done so. "Sell" has a broad meaning under Washington law, including exchanges for anything of value.
Selling consumer health data would require your separate, signed authorization. We do not ask for one, because we do not sell it.
10. Your rights
You have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data
- Access that data, and receive a list of all third parties with whom we have shared it, including an active contact for each
- Withdraw consent to our collection and sharing of it
- Delete it
On deletion: when you ask us to delete consumer health data, we delete it from our records — including backups and archives — and notify every processor and affiliate that received it, instructing them to do the same. You can delete your account and all associated data at any time from within the app (Settings → account deletion), or by contacting us.
11. How to exercise your rights
Email admin@senstory.app with the request and the email address on your account. We may need to verify your identity before acting.
We will respond within 45 days. If we need longer, we will tell you within that period and may extend by a further 45 days.
If we refuse a request, we will tell you why, and you may appeal by replying to our response with the word "Appeal". We will review and respond within 45 days.
If we deny your appeal, you may submit a complaint to the Washington State Attorney General at www.atg.wa.gov/file-complaint.
12. How long we keep it
We keep consumer health data for as long as your account is active, because its value to you is the history it builds. If you delete your account, or ask us to delete your consumer health data, we delete or anonymize it within a reasonable period — except where we must keep limited records to meet a legal obligation.
13. Security
Information is encrypted in transit and at rest on our platform provider's infrastructure. Access is restricted to what is needed to operate the Service. Everyone who processes data on our behalf is bound by contract to protect it.
14. Geofencing
Washington law prohibits geofencing around facilities providing in-person health care services. Senstory does not use geofencing, and does not collect precise location data at all.
15. Changes to this policy
If we change the categories of consumer health data we collect, why we collect it, or who we share it with, we will update this policy, change the date above, and obtain your consent before the new processing begins.
Questions: admin@senstory.app