Pavuno Consumer Health Data Privacy Policy

Effective date: October 31, 2026

This Consumer Health Data Privacy Policy applies to "consumer health data" as defined by the Washington My Health My Data Act, Nevada Senate Bill 370, and similar state laws. It supplements the Pavuno Privacy Policy. H23Rx, LLC ("H23Rx," "we," "us," or "our") operates the Pavuno app and website.

1. Categories of consumer health data we collect

Medications, doses, schedules and dates taken, including GLP-1 and other injectable medications.
Injection sites and injection history.
Symptoms, side effects and daily check-ins.
Weight, body measurements and goals.
Nutrition and diet information, including water, protein and fiber intake, scanned barcodes, food photos and nutrition estimates.
Activity and other data types you approve from Apple Health or Android Health Connect.
Notes and imported historical health records.
Information that could identify your health condition or status, such as the subscription plan you choose (for example, a GLP-1 tracking plan).

2. Sources

Directly from you; from Apple Health or Android Health Connect if you connect them; and from your purchase of a subscription plan through an app store or our website.

3. Purposes of collection and use

To provide the tracking, reminder, charting, food-scanning, syncing, reporting and export features you request; to secure your account and the Service; and to comply with law. We collect consumer health data only with your consent, or as necessary to provide a feature you request.

4. Categories of consumer health data shared, and with whom

We do not sell consumer health data. We disclose it only to the following:

Processors that handle it on our behalf under contract: cloud hosting and database providers (all categories in Section 1); Google (food photos submitted for AI nutrition estimates only); and Apple or Google app stores, RevenueCat and Stripe (your subscription plan and purchase status only).
Recipients you choose, when you export or share a report.
Wearable and health services you choose to connect, for the data needed to provide that connection.
Authorities, when required by law.

We do not share consumer health data with affiliates. If we ever want to share consumer health data with a third party other than a processor, we will first obtain your separate consent.

De-identified, aggregated information that cannot reasonably be linked to you is not consumer health data. We may use and share it as described in Section 5 of the Privacy Policy, and we publicly commit not to attempt to re-identify it and to contractually require recipients not to do so.

5. Your rights

You have the right to:

Confirm whether we collect, share or sell your consumer health data, and access that data, including a list of all third parties and affiliates with whom we have shared it and their contact information.
Withdraw your consent to our collection and sharing of your consumer health data.
Have your consumer health data deleted, including from our processors. We will delete it within 30 days of authenticating your request, and from backups as described in the Privacy Policy.

How to exercise these rights: use Settings \> Privacy in the app or email support@h23rx.com. We will respond within 45 days after authenticating your request; we may extend that by another 45 days when reasonably necessary, and we will tell you if we do. We will not discriminate against you for exercising these rights.

Appeals: if we decline to act on your request, you may appeal by emailing support@h23rx.com with the subject line "Health Data Appeal" within a reasonable time after our decision. We will respond within 45 days, explaining any action taken. If your appeal is denied, you may contact the Washington State Attorney General at atg.wa.gov or the attorney general of your state.

6. Geofencing

We do not use geofencing around healthcare facilities or any other location.

7. Contact

H23Rx, LLC, 777 Brickell Ave, Suite 500, Miami, FL 33131. Privacy: support@h23rx.com.