Nubia Consumer Health Data Privacy Policy
Effective date: 2026-09-13
Policy version: 1.0
This notice describes how Emine Kuzhan, the operator of Nubia, collects, uses, and shares consumer health data and how consumers can exercise applicable rights. It applies to information covered by Washington's My Health My Data Act, Nevada's consumer health data law, and other applicable consumer health privacy requirements. These laws can protect information outside the scope of HIPAA, including information that reveals or supports an inference about health.
Contact for health-data requests: privacy@heynubia.com
1. Categories of consumer health data and purposes
We handle the categories below when you use the corresponding feature. The inclusion of a category does not mean every user supplies it or every category leaves the device.
| Category | Examples | Purpose |
|---|---|---|
| Skin and physical-health information | Skin concerns, body locations, symptoms, severity, duration, irritation/reactions, sensitivities, allergies, marks/scarring, and notes or ratings you enter. | Maintaining your record, providing requested skincare organization and personalization, following changes, and displaying safety or professional-care guidance. |
| Treatment and safety context | Medications, diagnosed conditions, current/past treatment, clinician instructions, procedures and related safety cautions that you provide. | Applying routine/product rules and presenting relevant cautions. |
| Reproductive-health context | Pregnancy, breastfeeding or trying-to-conceive information you provide; separately, menstrual-history timing read locally from Apple Health with permission. | Applying the requested safety preferences and optional local wellness displays. This does not provide fertility or pregnancy prediction. |
| Wellness and activity information | Sleep/workout context, hydration/SPF and hygiene logs, sun-exposure or irritation records, rest-day choices, and lifestyle/occasion activity. | Requested wellness views, reminders, progress and routine features. Current Apple Health readings remain on-device; manually entered wellness records may be stored in your account. Historical imported summaries may remain from earlier versions. |
| Product use and health-related purchases/interests | Products you save, report using or reacting to, routines, completion/check-in history, and purchases or feature use that reveal an interest in skincare or wellness. | Maintaining your Shelf and routines, providing paid access, explaining suggestions, and recording your requested history. |
| Inferences and measurement | Derived skin/safety flags, routine adaptations, coarse check-in outcomes, and usage of health-related screens or articles linked to an account or pseudonymous identifier. | Personalization and, where lawfully permitted, measuring feature use and improving the service. Coarse events are not automatically anonymous or non-health data. |
| Health-related images and notes | Local journal notes or legacy photos, photo references, selected product images that may reveal health information, and health details voluntarily sent to support. | The journal, requested product-photo matching, preparation of a user-accessible care summary, or resolving your request. A professional-care summary is not automatically sent to a clinician. |
| Location associated with health-related use | Authorized coordinates used for UV/weather context and derived seasonal information. Foreground requests use two-decimal coordinates (roughly 1 km); automatic UV reminders can store a two-decimal location with your account for scheduled server checks. A separate two-decimal device cache can support background widget refresh for up to 24 hours. | Providing local environmental context and reminders you request. These rounded locations are not necessarily anonymous. This is not health-facility geofencing. |
| Identifiers and social/communication context linked to health information | Account, device, notification and pseudonymous metrics identifiers; shared routine activity; invitation details; reminder context; request/consent records. | Associating records with you, enabling requested sharing/reminders, enforcing privacy choices, and responding to requests. |
Collection or sharing takes place only with the consent required by applicable law or within a valid exception, such as processing necessary to provide the specific product or service you requested. Optional measurement or sharing is not made necessary merely by including it in Terms. Separate consent is obtained where required for sharing. Publishing this notice is not consent, and we do not sell consumer health data.
2. Sources
Consumer health data comes from:
- You, through profile answers, product selections, check-ins, logs, photos, journal entries, permission choices, purchases, or communications.
- Your device and Apple Health, when you enable the corresponding local feature or location permission.
- Your use of Nubia, including routine and feature activity and the inferences produced from your inputs.
- People you invite or connect with, through invitations, responses and shared-activity state.
- Service providers that return requested product matches, weather context, notification status or subscription information.
The public website also processes searches and content requests. Its optional Google Analytics payload excludes article topics/titles/slugs and search text. A health-related search can still be present in website/API requests or infrastructure logs and must be treated according to its actual content.
3. Sharing and recipients
We may disclose the following categories for the identified purposes. Whether a particular processor disclosure constitutes “sharing” under a specific statute depends on that statute and the arrangement; this table makes the actual categories visible regardless of that distinction.
| Recipient category and named service | Categories disclosed and purpose |
|---|---|
| Account/database/hosting processors, Google Firebase and Google Cloud | Server-stored skin, treatment/safety, reproductive information you enter, product/routine/wellness history, saved UV-reminder location, identifiers, inferences and related requests as needed to host and operate Nubia. Current HealthKit samples are not uploaded through the current integration. |
| Product-recognition processor — OpenAI | If you use product-photo recognition, the product photo you take or choose, the identification instruction and catalog context, and associated technical request information. The request does not include your health profile, journal or Apple Health readings. If the image itself contains health information, that information is transmitted with it. |
| Notification processors — OneSignal and Apple push services | Device/account identifiers, message content, scheduling and delivery information. Health-related reminder or shared-activity context can itself reveal health information. |
| Weather provider — Apple WeatherKit | Rounded coordinates and request context for authorized UV/weather information; we do not add your account identity to the weather request. |
| Subscription services — RevenueCat and Apple App Store | App/customer identifiers, transaction and entitlement status and related metadata. Subscription information can show that you use a skincare/wellness service; the billing flow does not send your full medical profile. |
| Support/email services, email-routing and mailbox providers | Health information you choose to include in a support or rights request, with necessary contact and case details. |
| Website/content/image hosts, Google Cloud/Firebase and the website and content-delivery providers serving requested pages and images | Health-related searches or resource requests and associated connection information when actually transmitted, to deliver pages, search results and images. |
| Optional website measurement — Google Analytics and Google Tag Manager | With analytics consent, generic page categories, language, broad campaign/link/reading information and technical connection data, to the extent this qualifies as consumer health data. Our measurement payload excludes article topics/titles/slugs and search text. It is not used for advertising profiling. |
| People you authorize through social/share features | Friend identity and enabled routine activity; shared-night theme, date/timezone and invitation status; or the specific note/export/content you choose to share through a device share action. Ordinary friend activity does not give access to your private medical profile, journal or Apple Health store. |
| Professional advisers or authorities where specifically authorized by law | Only the information necessary for the applicable legal, safety, or rights-protection purpose and subject to any applicable limits. |
Nubia is operated by an individual, not a corporate group. We do not share consumer health data with corporate affiliates.
We do not disclose consumer health data to advertising networks or data brokers, and do not use Apple Health information for advertising or marketing. A business transfer does not authorize an otherwise prohibited sale or a new use without the legally required steps. You can request the identities and contact methods for actual third parties and affiliates receiving your covered data where the law provides that right.
4. Your health-data rights
Where applicable, you can request confirmation of whether we collect, share or sell your consumer health data; access to that data; information about recipients; withdrawal of consent to collection and sharing; and deletion. We will not discriminate against you for exercising those rights. A specific feature may become unavailable if the information it objectively needs is removed or its necessary processing is withdrawn.
Send a request to privacy@heynubia.com, or use the app's account-deletion control for account deletion. A request for only a category of health data does not require deleting your entire account. We may reasonably verify identity or representative authority, but you do not need to open a new account. We do not require a particular subject line. Avoid sending passwords, full medical files, or identity documents unless an appropriate verification method is requested.
The in-app export is a convenience and is not a complete health-data access response. Contact us for omitted records or recipient information. Removing Health access in Apple settings stops future authorized readings but does not erase manual or historical account entries. Turning off automatic UV reminders stops scheduled use of the saved location but may not erase the setting; you can request its removal. Revoking device location access does not necessarily disable an already saved server reminder. Account deletion does not cancel a subscription or remove your original Apple Health records or copies you independently exported.
Washington. We respond without undue delay and within 45 days of receiving your request; a justified extension can add 45 days with notice within the first period. We promptly authenticate requests without resetting that receipt-based deadline. Covered deletion includes notice to relevant recipients and backup/archive data, for which the law permits a delay of no more than six months after authentication. We respond to an appeal within 45 days.
Nevada. General covered requests receive a response within 45 days after authentication; an additional 45 days may be used with the required notice. Requested deletion is subject to the separate 30-day deadline after authentication. Recipient deletion obligations also apply. A legally available archive/backup delay is an exception, not our routine retention policy. We respond to an appeal within 45 days. Backups are retained only as needed for recovery or a specific lawful preservation duty. Data subject to deletion must be removed or isolated from ordinary use pending a legally permitted deletion cycle, and deletion reapplied before any restored data is used. No recovery cycle extends an applicable deletion deadline, and a shorter applicable deadline takes priority. See the retention criteria in the Privacy Policy.
Information requests are ordinarily free, including at least two annually where the relevant health law provides. We charge a reasonable fee or refuse an excessive request only where the law permits and with an explanation. If another applicable law gives you greater rights or a shorter deadline, we follow it.
5. Appeals and changes
If we refuse a request, email privacy@heynubia.com asking for review; you may use “Health privacy appeal” as the subject. We provide a written decision and reasons. If we deny the appeal, we provide the applicable attorney general complaint route, including the Washington Attorney General or Nevada Attorney General where appropriate. You retain any independent right to complain or seek a remedy.
We indicate revisions through the effective date and provide notice of material changes as required. We will obtain fresh consent for a new collection or sharing purpose where required; updating this notice alone does not authorize the new activity.