Sensitive Information Notice (Consumer Health Data)

BULLSEYE PERSPECTIVE — SENSITIVE INFORMATION NOTICE (CONSUMER HEALTH DATA) Effective 2026-09-01

WHY THIS NOTICE EXISTS Bullseye is a coaching service, not a healthcare provider, and we are not a HIPAA covered entity — HIPAA does not apply to us. That is precisely why this notice exists: several state laws, notably the Washington My Health My Data Act and comparable Nevada, Connecticut, and California provisions, protect health-adjacent information held by companies like us that HIPAA does not reach. Coaching conversations about stress, sleep, grief, relationships, mood, or motivation can be consumer health data under those laws even though we make no clinical claim about them. We treat that information as sensitive by default.

WHAT MAY BE SENSITIVE Free-text you write in journals, coaching conversations, and voice entries; mood and tension readings; life events you record; and interpretations our system derives from them, including persona summaries and any handwriting read. We do not ask for diagnoses, medications, treatment history, biometric identifiers, or precise location, and you should not enter them.

WHAT WE DO NOT DO

• We do not sell consumer health data. Not for money, not for anything of value.
• We do not share it for advertising, profiling, or lead generation.
• We do not use it to make decisions about your insurance, credit, or employment.
• We do not disclose it to a coach, or to anyone else, without your specific consent.

CONSENT IS PER-CATEGORY AND PER-COACH Access for a human coach is off until you turn it on, is granted to one named coach at a time, and is granted per category: the specific journal entries you pick, activity insights, memory, timeline, and handwriting read are each a separate switch. Revoking a switch removes that coach's access immediately. Revocation is a permissions change — your own data is never deleted because you closed access to it.

COACH-ONLY INTERPRETATIONS Some interpretations (the persona summary and the handwriting read) are written for a coach to test in conversation and are deliberately not shown to you, because an unverified inference presented to you as a conclusion about yourself is the harm this design avoids. They are hypotheses for a coach to check against your own words, never assessments, and they never leave the coaching relationship. They are deleted when your data is deleted and are excluded from your data export for the same reason they are not shown in the app.

NO ASSESSMENT, NO MONITORING, NO SAFETY DETECTION Nothing in this product assesses, screens, diagnoses, or monitors your mental or physical health, and nothing monitors your safety. The app pauses coaching and shows crisis resources when it recognises crisis language in what you type, which is a fixed keyword safeguard, not detection, and it will miss things. Never rely on this service in an emergency.

DELETION AND EXPORT You may withdraw consent, export your data, or delete it at any time from Account. On deletion, sensitive information is permanently erased after a 30-day recovery window. See the Privacy Policy for the two narrow categories that survive and why.

WASHINGTON RESIDENTS This notice is our consumer health data privacy policy for the purposes of the My Health My Data Act. You may request the list of third parties with whom we have shared consumer health data (we share it with no one for their own purposes), withdraw consent, and request deletion, through the Requests page in the app. We do not use a geofence around any health facility.

BY SIGNING You acknowledge how sensitive information is handled here and consent to the processing described, which you may withdraw at any time.