Consumer Health Data Privacy Notice

“Consumer health data” is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, as those laws define it. Our products are cosmetics and personal care goods. They are not intended to diagnose, treat, cure, or prevent any disease, and we don’t ask for medical information to sell them. Still, some information we handle could be considered consumer health data, and this notice explains how we treat it.

We do not sell consumer health data, and we never use it for advertising.

We may also use any of this information as necessary to prevent, detect, or respond to security incidents, fraud, or illegal activity, and to comply with the law.

We don’t use third-party trackers that could collect health information about you, we don’t buy health data, and we don’t geofence health care locations. Our Skin Type Quiz runs entirely in your browser: we don’t receive or store your answers.

• Directly from you, when you place an order, take part in a consultation, share member feedback, message us, or report a reaction.
• Our own records of the products you’ve purchased from us.

We do not obtain consumer health data from data brokers or other third parties.

We collect and share consumer health data only as necessary to provide a product or service you have asked for, or as the law otherwise allows. If we ever want to collect or share it for another purpose, we will ask for your separate consent first, and you can withdraw that consent at any time.

Our service providers process consumer health data only on our behalf and under contract. Shipping carriers receive your name and address, not what’s inside your package. We don’t share consumer health data with any affiliates.

• Access: confirm whether we collect, share, or sell your consumer health data; get a copy of it; and get a list of every third party and affiliate we have shared it with, along with an email address or online form you can use to contact each one.
• Deletion: ask us to delete your consumer health data. We will also tell our service providers to delete it. Copies in backup systems are deleted within six months.
• Withdraw consent: withdraw any consent you have given us to collect or share your consumer health data.
• No discrimination: we will never treat you differently, or charge you more, for exercising these rights.

How to make a request

Email hello@aahspoonful.com with the subject line “Health Data Request,” or reach us through our contact page. Tell us which right you’d like to exercise, and include your name and the email address on your account or orders. To protect your information, we verify requests by matching these details with our records, and we may ask you to confirm the request from that email address.

We respond within 45 days. If we need more time (up to another 45 days), we’ll tell you why. Requests are free of charge up to twice a year.

Appeals

If we decline your request, we will explain why. You can appeal by replying to our decision with “Health Data Request Appeal” in the subject line, and we will respond in writing within 45 days. If your appeal is denied:

• Washington residents may contact the Washington State Attorney General.
• Nevada residents may contact the Nevada Attorney General.

We do not allow third parties to collect consumer health data about you over time and across different websites through our site. You can review the consumer health data we hold about you and ask us to change it by contacting us as described above.

We may update this notice from time to time. We will post the updated version here, change the “Last updated” date, and notify you of material changes as the law requires.

Questions about this notice? Email hello@aahspoonful.com or reach us through our contact page. For more about how we handle personal information, see our Privacy Policy.