This policy explains which consumer health data MakeByte collects through the Symkura app and this website, what we use it for, who receives it and how you can exercise your rights. It is written for the Washington My Health My Data Act and Nevada’s consumer health data law; our Privacy Policy still applies in full. In short: Symkura is a symptom diary, so almost everything you enter in it is consumer health data; we use it only to run your diary and your reports, and we never sell it.

1. Who we are

Symkura is an app by MakeByte: Benjamin Straatmann, MakeByte, Thamaschstraße 2, 86687 Kaisheim, Germany. Email: [email protected]. Symkura is a documentation tool, not a medical device. It does not replace medical advice, diagnosis or treatment.

2. What we collect and why

Symkura does not use your device location. The consumer health data we may have falls into these categories.

Your diary

Symptom entries with pain intensity, body regions, triggers, mood, sleep, medications and notes, the photos you attach and, if you turn them on, cycle and weight. We use them for your symptom diary, its statistics and the patient report you can print or share for a doctor visit. They are stored on your device and, with your account, on our server.

Conditions, doctors and profile

The conditions you choose (for example migraine), your own triggers and symptoms, the doctors you add (name, specialty, phone, address and the conditions they treat) and, if you enter them, your first and last name, date of birth and gender for the patient report. They are synced with your account so they are there on every device.

Doctor appointments

If you import appointments, Symkura reads the device calendars you select, read-only and with your permission. Title, time and location of the appointments you pick are stored with your account so the app can remind you and show your next appointment. Symkura never changes your calendar.

Weather

If you set a weather place, the app adds temperature, humidity and air pressure to your entries. The place is one you search for; the app does not read your device location.

Your account

Your email address and your account ID. Together with the fact that you use Symkura, they could be read as health-related, so we include them here, as well as whether you have Symkura Pro. We use them to run your account, keep your data in sync, manage your purchase, answer your requests and keep the service secure.

Optional statistics

Usage statistics are off unless you turn them on. They are technical events such as “entry created”, linked to your account, and never contain symptoms, values, notes or photos. Community insights are off unless you turn them on; the app then sends aggregated figures per condition with a random device token that is not linked to your account, never single entries or your own text.

Messages to us

Feedback you send in the app and emails to our addresses. If you mention health information in them, we use it only to answer you and to fix or improve what you tell us about.

Your consent

Before Symkura stores any of this, it asks for your consent during setup and stores the time of your consent on your device and with your account. You can withdraw your consent at any time by deleting your account (section 6).

3. Where the data comes from

• From you: what you enter in the app and what you write to us.
• From your device calendar, if you import appointments: only the appointments you pick.
• From our weather service: the weather values added to your entries.
• From the app itself: statistics and reports it works out on your device from your entries.

4. Where it is kept and how we protect it

Your account and your diary, including photos, are stored in our own database on a server we rent from IONOS SE in Germany. All connections are encrypted (TLS), and row-level security limits access to your own account. On your device you can lock the app with a PIN or biometrics, and the app’s data is excluded from Google device backups. Reminders are scheduled on your device, so their text does not pass through a push service.

Our server keeps technical logs for 14 days to keep the service secure. Daily encrypted database backups are kept for 15 days. Neither the app nor this website shows advertising or uses tools that follow you across other websites or apps, and no third party collects consumer health data about you over time and across websites or apps through Symkura. Our account emails, sent through Brevo, contain a tracking pixel, and this website measures how its pages are used; our privacy policy describes both (sections 3 and 4). We keep your data as long as your account exists; section 6 explains how deletion works.

5. Who receives it

We do not sell consumer health data. We do not share it with third parties for their own purposes, and we have no affiliates. We disclose it only to these service providers, which process it on our behalf under a contract and only for the purposes in section 2:

• Hosting: IONOS SE, Germany, runs the server with our database. It holds your account and your diary.
• Website, weather service and feedback: Cloudflare, Inc., USA, hosts this website, runs our weather service (it receives the place you chose or the search term, never account or health data) and relays the feedback you send in the app to us.
• Purchases: RevenueCat, Inc., USA, receives a pseudonymous ID and whether you have Symkura Pro, which shows that you use Symkura. It receives nothing you enter in the app.
• App updates: Expo (650 Industries, Inc.), USA, receives your IP address, operating system, app version and a random installation ID when the app checks for updates, which shows that Symkura is installed. It receives nothing you enter in the app.
• Email: Heinlein Hosting GmbH (mailbox.org), Germany, stores the emails you send us and the feedback the app relays.
• Account emails: Brevo GmbH, Germany (Brevo group, France), sends the emails about your account, such as the code to reset your password. It receives your email address and the content of these emails.

Apple and Google sell Symkura Pro in their stores and process your purchase under their own privacy policies.

6. Your rights and how to use them

You have the right to confirm whether we collect, share or sell your consumer health data and to get access to it, including a list of all third parties we have shared it with and how to contact them; to withdraw your consent to further collection and sharing; to have your consumer health data deleted; and to review your data and ask us to correct it.

In the app

• In the More tab you can export your diary as CSV or as a PDF report.
• You can turn usage statistics and community insights off at any time in the More tab.
• “Delete account and data” deletes your account and all data stored for it on our server, including photos, right away. Data on your device remains until you delete it in the app or remove the app. What remains after that, and for how long, is listed on Delete your account.
• You can change or delete your entries, conditions, doctors and profile details at any time.

By email

Write to [email protected] from the email address of your account, with the subject “Consumer health data request”. You do not need to create a new account. If we cannot confirm that the request comes from you, we may ask for more information.

What happens next

We answer within 45 days of receiving your request. If we need more time, we may extend this once by up to 45 days; we tell you within the first 45 days and explain why. We delete data within 30 days of confirming a deletion request and ask the service providers in section 5 to delete it too, including your customer record at RevenueCat. Copies in our database backups are gone no later than 15 days after the deletion. Requests are free of charge.

7. Appeals

If we decline your request, you can appeal by replying to our answer or by writing to [email protected] with the subject “Appeal”. Within 45 days we tell you in writing what we did or did not do, and why. If we deny your appeal, you can complain to your state’s attorney general. In Washington: atg.wa.gov/file-complaint. For Nevada, our answer includes the contact details of the Office of the Nevada Attorney General.

8. Changes to this policy

If we change this policy, we update the date at the top and tell you in the app. We will not collect, use or share consumer health data in new categories or for new purposes until we have told you and you have agreed.

Hinweis: Diese Richtlinie richtet sich an Menschen in den USA und liegt deshalb nur auf Englisch vor. Für alle anderen gilt unsere Datenschutzerklärung.

This policy explains which consumer health data MakeByte collects through the Symkura app and this website, what we use it for, who receives it and how you can exercise your rights. It is written for the Washington My Health My Data Act and Nevada’s consumer health data law; our Privacy Policy still applies in full. In short: Symkura is a symptom diary, so almost everything you enter in it is consumer health data; we use it only to run your diary and your reports, and we never sell it.

1. Who we are

Symkura is an app by MakeByte: Benjamin Straatmann, MakeByte, Thamaschstraße 2, 86687 Kaisheim, Germany. Email: [email protected]. Symkura is a documentation tool, not a medical device. It does not replace medical advice, diagnosis or treatment.

2. What we collect and why

Symkura does not use your device location. The consumer health data we may have falls into these categories.

Your diary

Symptom entries with pain intensity, body regions, triggers, mood, sleep, medications and notes, the photos you attach and, if you turn them on, cycle and weight. We use them for your symptom diary, its statistics and the patient report you can print or share for a doctor visit. They are stored on your device and, with your account, on our server.

Conditions, doctors and profile

The conditions you choose (for example migraine), your own triggers and symptoms, the doctors you add (name, specialty, phone, address and the conditions they treat) and, if you enter them, your first and last name, date of birth and gender for the patient report. They are synced with your account so they are there on every device.

Doctor appointments

If you import appointments, Symkura reads the device calendars you select, read-only and with your permission. Title, time and location of the appointments you pick are stored with your account so the app can remind you and show your next appointment. Symkura never changes your calendar.

Weather

If you set a weather place, the app adds temperature, humidity and air pressure to your entries. The place is one you search for; the app does not read your device location.

Your account

Your email address and your account ID. Together with the fact that you use Symkura, they could be read as health-related, so we include them here, as well as whether you have Symkura Pro. We use them to run your account, keep your data in sync, manage your purchase, answer your requests and keep the service secure.

Optional statistics

Usage statistics are off unless you turn them on. They are technical events such as “entry created”, linked to your account, and never contain symptoms, values, notes or photos. Community insights are off unless you turn them on; the app then sends aggregated figures per condition with a random device token that is not linked to your account, never single entries or your own text.

Messages to us

Feedback you send in the app and emails to our addresses. If you mention health information in them, we use it only to answer you and to fix or improve what you tell us about.

Your consent

Before Symkura stores any of this, it asks for your consent during setup and stores the time of your consent on your device and with your account. You can withdraw your consent at any time by deleting your account (section 6).

3. Where the data comes from

• From you: what you enter in the app and what you write to us.
• From your device calendar, if you import appointments: only the appointments you pick.
• From our weather service: the weather values added to your entries.
• From the app itself: statistics and reports it works out on your device from your entries.

4. Where it is kept and how we protect it

Your account and your diary, including photos, are stored in our own database on a server we rent from IONOS SE in Germany. All connections are encrypted (TLS), and row-level security limits access to your own account. On your device you can lock the app with a PIN or biometrics, and the app’s data is excluded from Google device backups. Reminders are scheduled on your device, so their text does not pass through a push service.

Our server keeps technical logs for 14 days to keep the service secure. Daily encrypted database backups are kept for 15 days. Neither the app nor this website shows advertising or uses tools that follow you across other websites or apps, and no third party collects consumer health data about you over time and across websites or apps through Symkura. Our account emails, sent through Brevo, contain a tracking pixel, and this website measures how its pages are used; our privacy policy describes both (sections 3 and 4). We keep your data as long as your account exists; section 6 explains how deletion works.

5. Who receives it

We do not sell consumer health data. We do not share it with third parties for their own purposes, and we have no affiliates. We disclose it only to these service providers, which process it on our behalf under a contract and only for the purposes in section 2:

• Hosting: IONOS SE, Germany, runs the server with our database. It holds your account and your diary.
• Website, weather service and feedback: Cloudflare, Inc., USA, hosts this website, runs our weather service (it receives the place you chose or the search term, never account or health data) and relays the feedback you send in the app to us.
• Purchases: RevenueCat, Inc., USA, receives a pseudonymous ID and whether you have Symkura Pro, which shows that you use Symkura. It receives nothing you enter in the app.
• App updates: Expo (650 Industries, Inc.), USA, receives your IP address, operating system, app version and a random installation ID when the app checks for updates, which shows that Symkura is installed. It receives nothing you enter in the app.
• Email: Heinlein Hosting GmbH (mailbox.org), Germany, stores the emails you send us and the feedback the app relays.
• Account emails: Brevo GmbH, Germany (Brevo group, France), sends the emails about your account, such as the code to reset your password. It receives your email address and the content of these emails.

Apple and Google sell Symkura Pro in their stores and process your purchase under their own privacy policies.

6. Your rights and how to use them

You have the right to confirm whether we collect, share or sell your consumer health data and to get access to it, including a list of all third parties we have shared it with and how to contact them; to withdraw your consent to further collection and sharing; to have your consumer health data deleted; and to review your data and ask us to correct it.

In the app

• In the More tab you can export your diary as CSV or as a PDF report.
• You can turn usage statistics and community insights off at any time in the More tab.
• “Delete account and data” deletes your account and all data stored for it on our server, including photos, right away. Data on your device remains until you delete it in the app or remove the app. What remains after that, and for how long, is listed on Delete your account.
• You can change or delete your entries, conditions, doctors and profile details at any time.

By email

Write to [email protected] from the email address of your account, with the subject “Consumer health data request”. You do not need to create a new account. If we cannot confirm that the request comes from you, we may ask for more information.

What happens next

We answer within 45 days of receiving your request. If we need more time, we may extend this once by up to 45 days; we tell you within the first 45 days and explain why. We delete data within 30 days of confirming a deletion request and ask the service providers in section 5 to delete it too, including your customer record at RevenueCat. Copies in our database backups are gone no later than 15 days after the deletion. Requests are free of charge.

7. Appeals

If we decline your request, you can appeal by replying to our answer or by writing to [email protected] with the subject “Appeal”. Within 45 days we tell you in writing what we did or did not do, and why. If we deny your appeal, you can complain to your state’s attorney general. In Washington: atg.wa.gov/file-complaint. For Nevada, our answer includes the contact details of the Office of the Nevada Attorney General.

8. Changes to this policy

If we change this policy, we update the date at the top and tell you in the app. We will not collect, use or share consumer health data in new categories or for new purposes until we have told you and you have agreed.