Consumer Health Data Privacy Policy

Who this covers

In plain terms: written for Washington residents, but we apply it to everyone — it would be strange to protect health data differently depending on which base you're at.

Washington's My Health My Data Act (RCW 19.373) gives Washington residents specific rights over "consumer health data". Nevada's NRS 603A gives Nevada residents comparable rights. This policy is written to satisfy both.

We apply the practices in this policy to every WheelsUp user, wherever you live. The rights described under Your rights are the ones those two statutes require; users elsewhere have the equivalent rights described in our Privacy Policy.

What consumer health data we collect

In plain terms: five things, all of them typed in or selected by you, all of them needed by a tool you chose to open.

WheelsUp is not a medical service and holds no medical records. The health-related information we collect is limited to what the benefits calculators need:

Your VA disability rating — the combined percentage, as you enter it.
Individual conditions and body sites you enter into the VA combined-ratings calculator, with the rating you give each one.
Deployment locations you select in the exposure screener — the places you tell us you served, used only to show which statutory presumption frameworks (PACT Act, Gulf War illness) may apply to a claim. We never infer these from any other source; the list is only what you tick.
Medical Evaluation Board (MEB) referral date, if you're going through a medical separation.
TDRL status (Temporary Disability Retired List), if it applies to you.

What we do not collect: diagnoses from a clinician, medical records, treatment or prescription history, test results, genetic or biometric data, appointment information, precise location, or anything from a health app, a wearable, DoD/VA systems, or any other outside source. We do not infer health information about you from anything else, and we do not attempt to.

Where it comes from

Only from you — typed into a form in the app, by you, on purpose. We do not receive consumer health data from data brokers, advertising networks, government systems, health-care providers, insurers, or any other third party, and we do not derive it from your usage of the site.

Why we collect it

In plain terms: arithmetic. Nothing else — not profiling, not advertising, not research.

One purpose: to run the calculation you asked for and show you the result, and to save it so it's still there next time you sign in. Specifically:

To compute a combined VA disability rating from the individual ratings you enter, using the VA's published combined-ratings table.
To estimate compensation amounts from the published rate tables, including dependant adjustments.
To model CRDP/CRSC and retired-pay offset scenarios, which depend on your rating.
To place medical-separation milestones (IDES/MEB/PEB steps, TDRL re-evaluation windows) on your timeline.
To show which statutory presumption frameworks (PACT Act toxic-exposure presumptions, Gulf War illness) may apply to a VA claim, from the deployment locations you select in the exposure screener.

We do not use consumer health data for advertising, for profiling, to train any model, for research, or to make any decision about you. We do not use it to send you marketing of any kind.

Consent — we ask before we collect

In plain terms: the first time you open a tool that needs health information, we stop and ask. Say no and the rest of WheelsUp works fine.

We do not collect any of the data above until you have opted in. The first time you open a tool that needs it, WheelsUp shows you what it wants to collect and why, and waits. Nothing is stored unless you agree.

We record the fact of your consent — when you gave it, which version of this policy you were shown, and the IP address it came from — so that both of us have a record of what was agreed.

Declining costs you nothing else. Every other part of WheelsUp — the timeline, the milestone checklist, pay, leave, TSP, SBP, the state-benefits reference — works normally without it. We do not charge you differently, degrade the service, or nag you for consenting or refusing.

You can withdraw consent at any time in Account settings → Privacy & Analytics. Withdrawal is as easy as consenting was. When you withdraw, we delete the consumer health data you had entered from the live service — we don't merely stop collecting more.

Who we share it with: nobody

In plain terms: nobody. Two companies hold it for us under contract, and the Act does not count that as sharing.

We share consumer health data with no third party, for any purpose. That is the whole answer, not a narrow one with an exception behind it: the My Health My Data Act defines “share” and “third party” so that a service provider processing data on our behalf, under a written contract, is neither. It is not sent to Stripe, Resend, or any analytics or advertising service — our analytics never carries plan contents at all. We have no affiliates, so none of it reaches one.

Two companies do hold it for us, under contract, and may not use it for any purpose of their own:

Fly.io — the hosting provider running the application and its database, which stores the data on our behalf and may not use it for anything else.
Cloudflare R2 — where our encrypted daily database backups are stored, again on our behalf only.

The only other circumstance in which it could leave is a valid legal demand — a court order, warrant, or subpoena — which we would comply with only to the extent legally required, and would tell you about unless we were legally prohibited from doing so.

We do not sell it

In plain terms: no. Not now, and if that ever changed we would have to come back and ask you to sign something.

We have never sold consumer health data and we do not sell it. We have no advertising business, no data-broker relationships, and no revenue that depends on your data — WheelsUp is paid for by subscriptions.

Washington law would require a separate, specific written authorization from you before any sale, distinct from the consent described above. We have never asked for one and have no plans to.

Your rights

Confirm and access. Ask whether we hold consumer health data about you, and get a copy — including a list of everyone we shared it with, if we ever did.
Withdraw consent. Take back your consent to collection and to sharing, at any time.
Delete. Have your consumer health data deleted. See below for what that reaches.
No retaliation. We will not deny you service, charge you more, or give you a worse version of WheelsUp for exercising any of these.

What deletion reaches. When you delete, we remove the data from the live service immediately, and we instruct our processors to do the same. One honest caveat, the same one in our Privacy Policy: our encrypted daily backups are point-in-time snapshots, so a snapshot taken before your deletion still contains the data until it ages out — up to 30 days. Those backups are encrypted by us before they leave our server, under a key only we hold, so no company that carries or stores them can read your health information. Backups are used only to restore the service after a failure, never to look anything up, and if a restore ever happened we would re-apply outstanding deletions to the restored database.

How to exercise them

In plain terms: most of it you can do yourself, right now, without asking us.

Access: Account settings → Export my data gives you a JSON file containing everything, health data included. No request, no waiting.
Withdraw consent + delete health data: Account settings → Privacy & Analytics → Health data.
Delete everything: Account settings → Delete my account.
Or ask us: use the privacy contact form. We respond within 45 days. If we need the further 45 days the statute allows, we will tell you inside that first 45-day period and give you the reason for the extension.

Verification. For a request made from inside your signed-in account, being signed in is the verification — we won't ask you for identity documents. For a request by email, we'll verify by replying to the address on the account. An authorized agent may act for you with your written permission.

If we say no

If we decline a request, we'll tell you why, in writing, within the response window. You may appeal by replying to that message or through the privacy contact form; we'll review and respond within 45 days, and if we still decline we'll explain the reasoning and tell you how to complain to the Washington State Attorney General (or, for Nevada residents, the Nevada Attorney General).

How long we keep it

For as long as your account exists and your consent stands — because the whole point is that your saved plan is still there next time. It is deleted when you withdraw consent, when you delete the individual entries, or when you delete your account, subject only to the 30-day backup window described above. We do not keep an archival copy for our own purposes, and we do not retain de-identified copies.

How we protect it

Consumer health data is stored under the same protections as the rest of your plan: encrypted in transit and at rest, scoped to your authenticated account at the query layer so no other user can reach it, and reachable by us only through the same authenticated paths. Administrative access is logged. Full detail on our Security page.

Contact

Questions about health data, or want to exercise a right? Ask a privacy question →

Material changes to this policy are announced by email, and we ask you to re-consent rather than assuming the old consent covers a new purpose.