Consumer Health Data Privacy Policy

Some states, including Washington, have laws about "consumer health data": information that could show something about a person's health. Debt Boss isn't a health app. But if you add a medical debt, what you enter could show that you received health care. This policy explains how we handle that information. It adds to our Privacy Policy, which covers everything else.

• We ask for your consent before you add your first medical debt, and you can withdraw it at any time.
• We use it only to run the game you asked for.
• We never sell it, never use it for advertising, and never share it with anyone except the service provider that stores it for us.
• You can see, change or delete it whenever you like.

What we may have

If you choose the Medical type for a debt, we have that type and the details you enter for that debt: its name, balance, interest rate, minimum payment, due day and the payments you log.

Any debt's name could also reveal health information if you include it, so please use a nickname and leave out doctor, hospital or condition names.

Usage stats never include it: a medical debt is counted only as "other", with no amounts or names.

Your consent

Before you add your first medical debt, the game explains what it keeps and why, and asks you to agree. Nothing is pre-ticked, and you can say no and add the debt as "Other" instead.

You can withdraw your consent at any time in OPTIONS (MEDICAL DEBT CONSENT). When you do, your medical debts switch to "Other" and the Medical type isn't used again until you agree again. Debts you've already slain keep their type in your crossed-off log; to remove them, use OPTIONS, then ERASE SAVE, or delete your account.

We keep a record of when you agreed or withdrew: on your device, and in your account if you're signed in.

Where it comes from

Only from you, when you type it into the game. We don't buy health data, get it from anyone else, or try to work out anything about your health.

Why we use it

Only to provide the game you asked for: to show the debt as a monster, track your payments and forecasts, and, if you have an account, save it so it follows you to your other devices. We don't use it for advertising, marketing or anything else.

Who it's shared with

We don't sell it, and we don't share it with other companies or people.

If you play as a guest, it stays on your device and is never sent to us.

If you have an account, it is stored for us by Supabase, our database provider, under a contract that limits Supabase to running Debt Boss.

We may disclose it if the law requires it.

Your rights

• See it: everything you've entered is visible in the game.
• Change or delete it: edit or remove any debt at any time.
• Delete all of it: open ACCOUNT and choose DELETE MY ACCOUNT, or OPTIONS, then ERASE SAVE. This deletes your cloud save right away. Backup copies are deleted automatically within 30 days.
• Ask us: email us for a copy of the health data we hold about you, a list of every company we've shared it with, or to delete it. We answer within 30 days, at no cost.
• Appeal: if we turn down a request, reply to our answer to appeal it, and we'll respond in writing and explain our decision. If you're still not satisfied, you can contact your state's Attorney General.

We will not treat you differently for using these rights.

How we protect it

It's encrypted when it's sent and when it's stored, each account can reach only its own save, and only the people who run the game can see the database.

Contact us

Debt Boss LLC, New York. Email: [email protected]