Consumer Health Data Privacy Policy

Last Updated: September 30, 2026

This document is Meadow’s Consumer Health Data Privacy Policy. It is required by the Washington My Health My Data Act and by Nevada’s consumer health data law, and it describes only how we handle consumer health data.

It is a separate document from our Privacy Policy, which covers all other information we process. Where both documents describe the same practice, they are written to say the same thing.

1. Who This Applies To

Meadow is owned and operated by Ostra Health, Inc., based in the United States.

This policy applies to consumer health data of residents of Washington and Nevada, and to consumer health data collected in those states. We apply the same practices to every Meadow user regardless of where they live.

It does not apply to information governed by HIPAA. Meadow is not a healthcare provider, health plan, or clearinghouse, and it is not a business associate of one.

2. Consumer Health Data We Collect

“Consumer health data” means personal information linked or reasonably linkable to you that identifies your past, present, or future physical or mental health status, including inferences drawn from other data. We collect the following categories:

Migraine and headache attacks, including start and end times, duration, and pain level
Pain types and pain locations on the head
Symptoms, triggers, warning signs, and the effect of attacks on your activities
Medications, doses, schedules, protocols, dose check-offs, quantities, and whether a medication helped
Menstrual period and ovulation status recorded with an attack
Symptom logs and notes
Health answers collected during onboarding, such as migraine frequency, typical duration and pain, warning signs, triggers, sex, and whether you track your cycle
Weather and barometric pressure linked to your attacks, and precise location used to calculate your forecast
Data we generate from the above, such as daily migraine-risk scores and journal insights
Health information you choose to include when you contact support

We collect only what is necessary to provide the features you use, and we do not collect consumer health data beyond the categories listed here.

3. Where It Comes From

Directly from you, when you type or select it in the App or send it to support
From your device, with your permission: your location, used to look up local weather
Generated by Meadow: forecasts and summaries derived from what you logged and from weather data

We do not purchase consumer health data, and we do not obtain it from data brokers or from other apps.

4. Why We Collect It

To provide the journal, medication, insight, and reminder features you asked for
To calculate your migraine-risk forecast
To build doctor reports you request, which are generated on your device
To sync your data across your devices
To personalize the App
To understand how features are used, diagnose errors, and improve reliability
To maintain security and prevent fraud and misuse
To respond to your support requests
To comply with legal obligations

We do not use consumer health data for advertising, and we do not use it to make decisions about your employment, insurance, credit, or housing.

5. Consumer Health Data We Share, and With Whom

We share consumer health data only with service providers that need it to deliver the App, and only for that purpose. They are contractually restricted to processing it on our instructions.

The specific third parties that receive consumer health data are:

Supabase: cloud database, authentication, and server functions. Receives all of the categories in Section 2 as part of storing your account and calculating your forecast.
PostHog: product analytics. Receives your account identifier, your onboarding health answers, and, for each attack you log, its pain level, its duration, and whether triggers or symptoms were recorded. It does not receive your notes, medication names, location, or the specific triggers and symptoms you selected.
Open-Meteo: weather lookups. Receives coordinates or a city name, without any account identifier.
Our email provider: support mailbox. Receives the content of support messages you send, which contains health information if you choose to include it.

Categories of third party, stated for completeness: cloud infrastructure and database providers; product analytics providers; weather data providers; and email providers.

If you share a doctor report, you choose who receives it through your device’s share sheet. That is a disclosure you make, not one we make, and we do not receive a copy.

We may also disclose consumer health data if required by law, subpoena, court order, or government request, or where we believe it necessary to protect the rights, safety, or property of Meadow, our users, or others.

If Ostra Health, Inc. is involved in a merger, acquisition, sale of assets, or similar transaction, consumer health data may transfer to the successor entity. Any materially new use of that data requires the notice and consent the law requires.

6. What We Do Not Do

We do not sell consumer health data, and we have never sold it. Washington law requires a signed valid authorization before any sale. If that ever changes, we will obtain one first.
We do not share consumer health data for targeted advertising, and Meadow contains no advertising SDKs.
We do not use a geofence around any facility that provides in-person health care services, whether to identify or track people seeking care, collect consumer health data, or send messages or ads.
We do not send your journal to AI providers or use it to train AI models.

7. How Long We Keep It

We keep consumer health data while your account is active, unless you delete it sooner. You can edit or delete entries in the App at any time.

When you delete your account, we delete your consumer health data from our active systems, generally within 30 days. Backup copies may persist for a limited period before being overwritten.

Consumer health data already provided to a service provider listed in Section 5 remains subject to that provider’s retention schedule and our agreement with it.

8. Your Rights

You have the right to:

Confirm whether we collect, share, or sell your consumer health data
Access the consumer health data we hold about you
Receive a list of all third parties with whom we have shared your consumer health data, with contact information for each
Delete your consumer health data from our records
Withdraw consent to our collection or sharing of your consumer health data
Appeal if we deny a request

Exercising these rights is free, and we will not deny you service, charge you a different price, or give you a lower quality experience for doing so.

9. How to Exercise Them

Email meadowsupport@ostrahealth.com with the subject line Consumer Health Data Request, and tell us which right you are exercising. Use the email address on your Meadow account, or tell us the address on the account.

You can also delete your account and your data directly in the App.

We respond within 45 days of receiving a request. If we need more time we will tell you within those 45 days, and we may extend once by a further 45 days. A withdrawal of consent takes effect no later than the time our response is due.

An authorized agent may submit a request on your behalf with written permission signed by you.

10. Appeals

If we deny your request, our response will explain why and how to appeal. To appeal, reply to that response or email meadowsupport@ostrahealth.com with the subject line Consumer Health Data Appeal. We will respond within 45 days.

If we deny the appeal, you may complain to the Washington Attorney General at atg.wa.gov/file-complaint, to the Nevada Attorney General at ag.nv.gov, or to the attorney general of your own state.

11. How We Protect It

We maintain administrative, technical, and physical safeguards for consumer health data, including encryption in transit and at rest with our cloud provider, access restricted to the personnel who need it, and contractual restrictions on every service provider listed in Section 5. No system is perfectly secure, and we cannot guarantee absolute security.

12. Changes to This Policy

The current version is always posted at https://meadow.ostrahealth.com/consumer-health-data, with the date it took effect at the top. If we add a category of consumer health data we collect, add a purpose for which we use it, or add a recipient we share it with, we will give notice before the change takes effect and obtain any consent or authorization the law requires. Earlier versions are available on request.

13. Contact

Ostra Health, Inc., operator of Meadow

Email: meadowsupport@ostrahealth.com