Legal

Consumer Health Data Privacy Policy

Last updated: 18 August 2026

This policy is a separate document from our Privacy Notice, as required by Washington’s My Health My Data Act. It describes the one narrow category of consumer health data that Project Stardust Inc. (“we,” “us,” “our”) collects, why we collect it, who receives it, how long we keep it, and the rights you have over it.

1. What this policy covers, and what it does not

It covers the registration step on our website: the point at which you give us an email address to express interest in a research study.

It does not cover the research study itself. Once you are enrolled, information about you is collected and held inside the study’s own systems under a protocol approved and monitored by an independent institutional review board, and under the informed consent document you sign. That research data is governed by the protocol and by federal human-subjects regulations, not by this policy. My Health My Data Act contains an exemption for information used in such research.

We have written this policy on the basis that the registration email sits outside that exemption, because at the point you give it to us you are not yet enrolled in anything. We would rather be governed by this policy than argue about whether we need to be.

2. What consumer health data we collect

Two items, both submitted through the registration form on our study page:

• Your email address.
• The region you are in – one of three metro areas where the study runs, or, if you are elsewhere, your state. The study involves in-person sessions, so we ask this to tell you straight away whether it can reach you rather than after you have gone through a consent process.

The region is deliberately coarse. The most specific answer the form allows is a metro area, and it is a fixed list of choices rather than something you type. We do not ask for, and the form cannot accept, a street address, a postcode, or any location taken from your device.

We do not ask for, and you should not send us, a due date, a medical history, medications, test results, scan reports, or any other health information. Everything the study needs is collected inside the study system after you have reviewed and signed a consent form.

Why this counts as health data. On their own, an email address and a state are not health information. But the page you submit them from is about pregnancy monitoring and states that we are seeking people in the second or third trimester. Submitting them therefore supports an inference about your health. My Health My Data Act treats inferences as consumer health data, so we treat both items in this context as consumer health data, and hold them accordingly.

3. Where it comes from

Directly from you, and only from you. We do not buy consumer health data, we do not obtain it from data brokers, marketing partners or social media platforms, and we do not infer it from your browsing. Our website sets no advertising or analytics trackers on the study page.

4. Why we collect it

For one purpose: to pass your email address to the electronic data capture system used by the study, so that the study team can create your record and the system can send you the informed consent document and, after that, the eligibility questions. The region is used only to work out whether the study can reach you, and to understand where demand exists if we expand.

We do not use it for marketing. If you also want to hear from us generally, our mailing list is a separate, optional sign-up and we do not add study registrants to it.

5. Who we share it with

• Google LLC, as our processor. The registration form submits to Google Workspace, which we use under a Business Associate Agreement. Google processes it on our instructions and for no other purpose.
• The study team, being the named study personnel who create records in the data capture system.
• The study’s electronic data capture system, which sends the consent and screening documents.

We do not share it with anyone else. We do not disclose it to advertisers, data brokers, affiliates or social media platforms. If we were ever compelled to disclose it by law, we would do so only to the extent required.

6. We do not sell consumer health data

We have never sold consumer health data and we do not intend to. My Health My Data Act requires a separate, specific, written authorization signed by you before any sale may take place. We hold no such authorizations and we do not seek them.

7. How long we keep it

We delete the email address and region you registered with within 90 days, whether or not you go on to take part. It exists only to get you into the study system; once it has done that, it has no further purpose here.

• Registration records are held in monthly batches, and each batch is destroyed in full once its oldest entry reaches 90 days. In practice most addresses are destroyed sooner than that — often after around 60 days.
• Destruction is automated, and the system checks afterwards that the data has actually gone rather than assuming it. Each run is logged.
• If you do go on to enrol, the information collected about you inside the study system is a separate matter, retained under the protocol approved by the institutional review board for the period that protocol specifies. Deleting your registration email does not delete that, and the consent form you sign explains what can and cannot be removed once a study is under way.

8. Your rights

You have the right to:

• Know whether we hold consumer health data about you, and get a list of everyone we have shared it with
• Withdraw your consent to our collecting or sharing it
• Have it deleted, including from our processor’s systems and from anyone we have shared it with
• Appeal if we refuse a request
• Not be discriminated against for exercising any of these rights. Nothing about your care, or your ability to take part in a study, depends on it

Deleting your registration email means we cannot contact you about the study. If you have already enrolled, deletion of your registration record does not remove research data already collected under the protocol — the consent document explains what can and cannot be removed once a study is underway.

9. How to exercise your rights

Email privacy@project-stardust.org. Tell us what you want us to do. We will respond within 45 days, and will tell you if we need a single 45-day extension.

We will ask you to confirm the request came from you, but only using information we already hold. We will not ask you for additional personal information in order to verify a deletion request.

If we refuse. We will explain why in writing, and tell you how to appeal. If you appeal and we still refuse, we will give you a link to submit a complaint to the Washington State Attorney General ↗.

10. Who we are and how to contact us

Project Stardust Inc. is the controller of the consumer health data described in this policy.

For anything relating to this policy: privacy@project-stardust.org.
For general enquiries: hello@project-stardust.org.
For questions about a research study: research@project-stardust.org.

11. Changes to this policy

If we change how we handle consumer health data, we will update this policy and change the date at the top before the new practice takes effect. Where a change is material and would apply to data we already hold, we will ask for your consent again rather than rely on the original.