Consumer Health Data Privacy Policy

Consumer health data we collect

SparklingTreat is a Windows app that offers short workday resets involving movement, posture, breathing, eye rest, and short mental pauses.

Optional usage data

If you choose to share usage data, we receive a record of how you use SparklingTreat. It may include:

• Which reset you used, including the category selected, such as posture, energy, breathing, lower back, or eyes
• Whether a reset was offered, taken, put off, switched, skipped, dismissed, or left to expire, and a reason if one was selected
• How much of a reset was completed
• A better / same / worse response, when provided
• Accumulated detected computer-work time, time since the last keyboard or mouse input, and whether the computer was locked when a reset was offered
• The work setting selected in the app, such as home or a shared office
• App version, installation source, content-catalog version, event time, and local time-zone offset

SparklingTreat does not determine whether someone is physically sitting or standing.

Information necessary to provide and secure the Service

Whether or not optional usage sharing is enabled, our systems and service providers process limited information needed to operate SparklingTreat:

• The coded participant ID and status of the access code used to validate access
• App version and error information when a service request fails
• The time of a service connection
• An approximate location, such as city, state, and country, derived when Microsoft Azure Application Insights temporarily processes the connection's IP address. Under our current configuration, the full IP address is discarded rather than stored. Connection and diagnostic records are kept for 90 days

We do not collect raw keystrokes, screen contents, websites, documents, messages, application names, meeting content, or precise location.

Sources of consumer health data

Information comes from:

• The SparklingTreat app on the user's computer
• Choices and responses entered in the app
• Information a person gives us directly, such as in a support email
• Service-connection and diagnostic records created by Microsoft Azure when the app contacts our service

Why we collect and use it

We process information necessary to validate access, deliver content, secure the Service, and investigate technical problems.

When a user chooses to share optional usage data, we also use it to:

• Understand which resets people use and find helpful
• Improve SparklingTreat
• Produce deidentified team-level statistics for an organization that provides SparklingTreat

We do not use consumer health data for advertising, employee scoring, productivity scoring, or individual compliance monitoring.

Your choice about optional usage data

Optional usage sharing is off until you choose it. You make the choice when you first set up the app and can change it at any time in Settings → Usage data. The core reset experience works the same either way.

Turning optional sharing off stops future optional usage uploads immediately. It does not delete information already shared. You may request deletion as described below.

Necessary service connections and diagnostic processing continue while you use SparklingTreat's online features.

Processors, third parties, and employer reporting

Microsoft

Microsoft processes the information described above as our contracted processor for Azure hosting, storage, and diagnostics. Microsoft processes it to provide those services to SparklingTreat and not for Microsoft's own advertising purposes.

Organizations providing SparklingTreat

An organization never receives code-level information or information about an identified employee. It may receive deidentified aggregate statistics, subject to these safeguards:

• Aggregate code activation is reported only when at least five codes were issued
• Weekly active people and completed resets are reported only when at least five people were active in the period
• Better / same / worse totals are reported only when at least five people answered in the period
• Reset category or format information is reported only when at least ten active people chose to share optional usage data
• A result is withheld if the value itself is small enough to risk singling someone out
• Reports built from optional usage data state that they cover only people who chose to share

Weekly active people, completed resets, and better / same / worse totals come from weekly team counts. The app sends one count a week containing only whether it was active, how many resets were completed, and how many better, same, and worse answers were given. The count carries no access code, coded ID, or other identifier, cannot reasonably be linked to a person, and is treated as deidentified data. We describe it here so you know what the app sends. Answering better / same / worse is always optional.

SparklingTreat treats these reports as deidentified statistics, does not attempt to identify anyone from them, and requires recipient organizations not to attempt reidentification.

Categories of consumer health data shared

SparklingTreat does not share consumer health data with third parties or affiliates for their own purposes. Microsoft acts as our processor. Organizations receive only the deidentified aggregate statistics described above.

We have never sold consumer health data, and we do not sell it. If that changed, we would first obtain the separate authorization required by law.

We do not use geofencing, and SparklingTreat does not collect precise location.

How long we keep information

Your rights

Where the Act applies, you may ask us to:

• Confirm whether we collect, share, or sell your consumer health data and provide access to it
• Provide a list of third parties and affiliates with whom it was shared or sold
• Withdraw consent to future collection or sharing
• Delete your consumer health data

How to submit a request: email hello@sparklingtreat.com. Include your access code or coded participant ID because we do not store your name alongside optional usage data and may not be able to locate the records without one.

We take reasonable steps to verify that a request relates to your data. We respond without undue delay and within 45 days. When reasonably necessary, we may extend that period once by another 45 days and will notify you during the initial period with the reason for the extension. Requests are free at least twice in any 12-month period.

If consumer health data is stored in archived or backup systems, deletion from those systems may be delayed until they are restored, but for no longer than applicable law permits.

Appeals: if we decline a request, you may appeal by replying to our decision. We will respond in writing within 45 days. If we deny the appeal, you may contact the Washington Attorney General at atg.wa.gov/file-complaint.

Security

We limit access to stored information to people and service providers that need it for the purposes described in this notice. Information is encrypted in transit, and Microsoft Azure provides encryption at rest for stored information. Access codes are stored encrypted on users' computers, while our servers keep only a one-way hash.

No security measure can eliminate every risk. We maintain safeguards appropriate to the nature and amount of information we process.

Changes to this notice

If we plan to collect, use, or share an additional category of consumer health data, or use it for an additional purpose, we will update this notice and obtain consent when required before beginning that activity. We will also update the effective date above.

Contact

SparklingTreat LLC
hello@sparklingtreat.com