CONSUMER HEALTH DATA
Consumer Health Data Privacy Policy
THE LIST
Exodus Original LLC
Version 1.3 · Effective 8 September 2026
This version clarifies coverage of health information throughout the journal and how deletion requests are handled. Previous versions are available on request.
This policy explains how Exodus Original LLC handles consumer health data under applicable law, including Washington's My Health My Data Act and Nevada's consumer health data law. It supplements our Privacy Policy.
Health information may appear in check-ins, quiz answers and results, or in journal entries, notes, reflections, date records and other content you choose to write. Information does not lose these protections because it was entered outside a health-related feature. Please record your own experiences rather than another person's medical history or other private health information.
1. What consumer health data we collect, and why
Check-ins and quizzes require a separate opt-in. You can also choose to write about your own health in other parts of your journal.
| Category | What it is | Why we collect it |
|---|---|---|
| Check-in responses | Your answers about how you feel physically and emotionally in connection with a person or an occasion, and the reading THE LIST produces from those answers | So that the Check-ins feature can show you your answers and how your own responses to someone change over time |
| Health information you choose to write | Information about your physical or mental health, symptoms, treatment, medication or sexual or reproductive health, if you include it in your content | To store, display, synchronize and export the journal you request |
| Quiz responses and results | Your answers to, and results from, quizzes whose questions concern how you feel or how safe you feel in a relationship | So that the quiz can show you your result |
We use this information to provide the journal and features you request, including the readings described above. We do not use it for advertising, eligibility decisions or medical diagnosis. We do not analyze your free-text journal to infer medical conditions.
2. Where this information comes from
From you and from the features you choose to use. You provide the written content and selected answers. The app also produces readings and quiz results from those answers.
We do not buy it, receive it from data brokers, obtain it from other services, or derive it from your device, your location or your browsing.
3. What we share, and with whom
We do not share consumer health data with any third party or affiliate.
- The categories of consumer health data that we share is: none.
- The categories of third parties with whom we share consumer health data is: none.
- The specific affiliates with whom we share consumer health data is: none. Exodus Original LLC has no affiliates.
We do not sell consumer health data, and we do not offer it for sale. We have never done so. If that ever changed, the law requires us to obtain a separate signed authorization from you first, and we would have to ask you specifically.
Service providers. To run THE LIST we use Supabase, which provides our account system, database and hosting. If you are signed in and synchronisation is active, information you enter, including consumer health data, is stored through Supabase so that it is available to your account. Supabase acts as our processor: it handles the information on our instructions, under a written contract, only to provide the service to us, and it is not permitted to use it for its own purposes.
Consumer health data is not sent to any AI provider. THE LIST has no artificial intelligence feature, and nothing you record in it is sent to an AI provider.
4. How this information is processed
Information you enter is stored in your browser on the device you entered it on. If you are signed in and synchronisation is active, it is also transmitted over HTTPS and stored through our service provider so that it is available to your account and across your devices. It is encrypted in transit and encrypted at rest by our infrastructure provider.
Access is restricted to what is necessary to provide the features you have turned on. We do not monitor or routinely review it. Our personnel may access it only in the limited circumstances, and subject to the limits, described in section 3 of our Privacy Policy: to provide support you have asked for, to investigate a security or misuse concern, to comply with applicable law or valid legal process, or to respond to a specific, credible threat of serious harm to a person that we have become aware of.
5. Your consent, and how to withdraw it
Before storing check-ins or quiz answers, we ask for permission separately in the feature, with an unchecked box. Accepting the Terms is not that permission. When you independently write health information in your journal, we process it to provide the journal service you request, subject to applicable law.
You can withdraw that consent at any time in Settings, under Permissions. Withdrawing consent stops further recording through that feature and requests deletion of its stored answers and readings. A device that is offline must reconnect to finish account deletion; the app shows any unfinished request. This control does not delete entries you independently wrote elsewhere, such as your date journal. Delete those entries directly or contact us to request deletion of health information across your account.
6. Your rights
You have the right to:
- confirm whether we are collecting, sharing or selling consumer health data about you, and to access that data, including a list of all third parties and affiliates with whom we have shared or sold it (for us that list is none);
- withdraw your consent to our collection of consumer health data;
- have consumer health data about you deleted; and
- appeal if we refuse to act on a request.
Much of this you can do yourself, immediately, without contacting us: Settings shows what you have turned on, provides export tools, lets you withdraw consent (which deletes the information for that feature), and lets you delete your account.
How to make a request
Email thelisthelp@protonmail.com from the email address associated with your account, and tell us what you would like us to do.
We use your email address to authenticate the request. You do not need to create an account to make a request, and we will not ask you to. If we cannot authenticate a request using reasonable efforts, we may ask you for additional information reasonably necessary to verify it.
How long we take
We will act on your request without undue delay and within 45 days of receiving it, unless a permitted extension applies. If we cannot comply, we will explain our decision and how to appeal. If your request is complex, we may extend that once by a further 45 days, and if we do we will tell you within the first 45 days and explain why.
Requests are free, up to twice a year. If a request is manifestly unfounded, excessive or repetitive we may charge a reasonable fee or decline to act, and if we do we must be able to show why.
If we refuse
You may appeal by replying to our decision and asking us to reconsider. We will tell you in writing within 45 days of receiving your appeal what we have decided and why.
If we deny your appeal, you may contact the Washington State Attorney General at https://www.atg.wa.gov/file-complaint, or the Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint/, to submit a complaint.
7. Deletion, and what happens to backups
When you delete an entry, withdraw a feature's permission, or delete your account, we remove the information covered by that request from active account storage. A feature switch does not delete health information you independently wrote elsewhere. You can delete those entries or ask us to help with a broader request. An offline device must reconnect to finish an account-side request.
Routine provider backups may contain a previous copy until they expire. Access to these copies is restricted to recovery and legal requirements; they are not used for advertising or ordinary product use. For a verified consumer health data deletion request, any delayed deletion from archived or backup systems will be completed within six months, or sooner where required by applicable law.
Before any recovered data is returned to normal use, we must ensure that the applicable deletions are respected. If we cannot reliably establish which information must remain deleted, we do not return that historical personal data to the live service. We do not promise that a deleted entry, or an account lost in an outage, can be recovered. Copies you independently downloaded or kept outside the Service remain under your control.
We carry deletion requests through the service providers that process the information for us, including Supabase, using their deletion mechanisms and applicable contractual procedures. We notify other recipients when required by law. Our processors are subject to applicable deletion requirements even though we do not sell the information.
8. Reviewing and correcting your information
Everything described in section 1 is visible to you inside THE LIST, and you can change or delete it there directly. If you would prefer us to do it, email thelisthelp@protonmail.com.
9. Tracking across other websites
No. THE LIST does not permit any third party to collect consumer health data about you over time across different websites or online services. We do not use third-party advertising trackers, analytics tools or session-recording scripts in THE LIST.
We do not use geofencing or request your device's geolocation. You may choose to write a location in your journal. Infrastructure providers also process IP addresses as described in the general Privacy Policy.
10. Changes to this policy
If we make a material change to this policy, including collecting a new category of consumer health data, using it for a new purpose, or sharing it with anyone, we will update the version number and effective date above and tell you in the Service or by email before the change takes effect, and where the law requires it we will ask for your consent first.
We keep previous versions so you can see what applied when.
11. Contact
Exodus Original LLC