This page is for people in Washington, Nevada and Connecticut, where state laws give you extra rights over information about your health: Washington's My Health My Data Act (chapter 19.373 of the Revised Code of Washington), Nevada's SB 370 (2023), and the consumer health data rules in the Connecticut Data Privacy Act. It sits alongside our Privacy Policy and does not replace it. If the two differ about consumer health data, this page applies to you, and neither takes away a right the law gives you. The rights below are the ones we work to wherever you live.
Plain English, written so you can check every line against the app.
The short version
- Most of your health information stays on your phone, and we store no copy: your readings (blood sugar, blood pressure, cholesterol, weight), medicines, kidney and heart answers, pregnancy answers, past struggles with food, your age and your diary.
- What does reach us or pass through us is small, and each part has its own switch that starts off: the AI helper, your health profile, Percy's memory, and "Help make Percy better?". Say no and Percy still works.
- We do not sell consumer health data and we do not use it for advertising. It goes to the processors listed below, which work for us to run Percy.
- You can see it, delete it, withdraw your consent, and appeal if we say no. We answer within 45 days.
Who we are
NRC VANTAGE ENTERPRISE, trading as Normal Range Club, a sole proprietorship registered in Malaysia, registration number 202603193260 (PG0590927-D), owned by Choo Lai Hock, known as Jason Choo. We decide how and why the information below is handled. Business address: 12A-10 Plaza Permata, 6 Jalan Kampar, Sentul Selatan, 50400 Kuala Lumpur, Malaysia. Contact: [email protected].
The consumer health data we collect, and why
"Consumer health data" means information that identifies, or could reasonably be linked to, your physical or mental health. These are the categories we handle, what each is for, and where it lives.
| Category | What it is | Why | Where it lives |
|---|---|---|---|
| Health conditions and goals | Conditions you pick or mention (for example type 2 diabetes, high blood pressure, cholesterol), the goal that goes with them, and a flag if you mention pregnancy or a condition so the answer is careful | To make a Percy answer fit you and keep it careful | On your phone. Goes with a question to the AI services only when you switch the AI helper on, and, for your picked conditions and goal, only when you also switch on your health profile. Diabetes in pregnancy is not sent |
| Body measurements | Your weight today and your height | Same as above | On your phone. Goes with a question only if you switch on your health profile and have told Percy you have no history of eating struggles |
| Food and movement details | Allergies, food rules, foods you do not eat, how you eat, fitness level, body areas to spare, short notes such as "knee sore" or "slept badly" | To answer your question and, if you switch memory on, to remember you | On your phone. Goes with a question to the AI services when the AI helper is on. Held on our server only if you switch Percy's memory on |
| What you type or photograph in a question | Your question, which can include health details or numbers you type, and meal or menu photos | To answer you | Passes through our server to the AI services and is not kept by us. Photos are read in memory and not stored. The question and Percy's answer are kept only if you say yes to "Help make Percy better?" |
| Questions and answers we keep (only if you say yes) | Your questions and Percy's answers, without your name, under a code instead | So our team can find where Percy gets things wrong and fix it | Our server, up to 180 days, then deleted. Deleted at once if you switch it off |
| Readiness check result | One result ("nothing flagged" or "worth a word with your doctor first") and its date. We do not keep which answers were yes | To hold the guided movement parts until you have spoken to your doctor, if the result says so | Our server, while your account is open |
| Percy's memory (only if you switch it on) | What you told Percy about how you eat and move, as in the row above, including allergies and short notes | So Percy remembers you on any device you sign in on | Our server, while the switch is on. Emptied at once when you switch it off |
What we do not collect: your saved readings, your age, medicines, kidney and heart answers, pregnancy answers, past struggles with food, your Journey diary and your medication reminders. They stay on your phone. If you type a number or a detail into a question, it is part of the question and goes with it, so please do not type prescriptions, test results or other people's details.
We also keep a short record that you switched each of these on or off, and when. It holds no health details.
Where it comes from
From you: what you type, pick or photograph in the app, and what your phone sends with a question you ask. We do not buy health information, and we do not get it from data brokers, your doctor, your insurer or any other website. Our sign-in provider tells us your name, email and an account reference, and Apple or our payment provider tells us about your subscription. None of those is health information.
Who receives it
We do not sell consumer health data, we do not use it for advertising, and we do not give it to an AI company to train its models. It goes to companies that work for us, under their business terms, to run Percy ("processors"), and each gets what it needs:
| Who (category) | What they get | Why | Where |
|---|---|---|---|
| Our hosting provider | Everything we store on our server (see the table above) | Hosts our server and database | The European Economic Area (EEA) |
| Our network and security provider | Everything passes through it in transit, including a photo and your IP address. It keeps no copy of photos, logs or questions | Sits in front of our sites and the app | United States and worldwide |
| Our AI services | The question and the context described in the Privacy Policy under "Percy and AI", and, only if you switch it on, your health profile. Not your name or account. Their business terms say they may not use your content to improve or train their own products, and they keep requests for a limited period, only to police misuse | Read photos and menus and write answers | United States and worldwide |
| Off-site backup storage | Encrypted backups of what is on our server. It cannot read them | So we can recover from a failure | United States |
Affiliates: we share consumer health data with no affiliate. When you ask to see your information (below), we give you the names of the companies behind each category above and how to contact them.
Your consent
We ask for your consent on a screen of its own, separately for each of: the AI helper, your health profile, Percy's memory, and "Help make Percy better?". Nothing is ticked for you. Saying no does not cost you anything in Percy. You can withdraw any of them at any time, as easily as you gave it. Withdrawing stops anything further being sent or kept; it cannot call back what an AI service already received with an earlier question.
Your rights
- To know and to see. Ask whether we collect consumer health data about you, and get a copy of it. This includes a list of every third party and affiliate we have shared it with, and how to contact them. In the app, "Also get what NRC holds" downloads a file. For safety we ask you to sign in again first.
- To withdraw consent. Use the switches in Me, then Settings: AI helper, health profile, memory, and "Help improve Percy". Switching off "Help improve Percy" deletes what we kept at once.
- To delete. We delete your consumer health data from our live system, and it is gone from our encrypted backups within 6 months (see below). The app's delete button asks you to cancel any running subscription first (on the web, in the app under Me, then Plan & billing; in the iPhone app, in Apple's subscription settings). If that is a problem for you, email us and say so: we treat your email as a request under this policy and answer it within 45 days.
- To correct what we hold, and to take a copy to use elsewhere, where Connecticut or other law gives you that right. We offer both to everyone.
We do not charge for any of this, and using a right does not cost you anything else in Percy.
How to use your rights
- In the app: Me, then Settings, then My records. You can download your information, delete what NRC holds on its server, and switch each consent off.
- By email: [email protected]. Write from the address you signed in with, so we can check it is really you.
We answer within 45 days of receiving your request. If we reasonably need longer, we may extend that once by another 45 days, and we tell you why within the first 45 days.
If we say no: appeal
If we refuse your request or only partly act on it, we tell you why, in writing. You can appeal. Email [email protected] with the word "Appeal" in the subject and, if you can, what you want us to look at again. We answer your appeal in writing within 45 days of receiving it, with our reasons.
If we turn your appeal down, or you are not happy for any reason, you can complain to your state's Attorney General. In Washington, the Attorney General's website is atg.wa.gov (its "File a Complaint" page is at atg.wa.gov/file-complaint). In Nevada or Connecticut, contact your state's Attorney General. You do not have to appeal to us first.
Deletion and backups
Anything you delete leaves our live system straight away and is gone from our backups within 6 months. Our off-site encrypted backups rotate: seven daily, four weekly and six monthly copies. Local nightly backups are kept for 14 days. A one-off safety copy made before an update is kept for 30 days at most. If we ever restore a backup, anyone who asked to be deleted is left out of the restore. What an AI service already received with an earlier question cannot be called back; it keeps requests for a limited period, only to police misuse. We cannot delete what is on your phone: clearing the app's data on your device does.
Changes
If this policy changes, we update this page and the version at the top, and we keep the old versions. If a change is material (anything about what we collect, who receives it, or what we do with it), we tell you before it takes effect. A change that needs a fresh yes from you gets a fresh yes from you; it does not get a quiet edit to this page.
Questions: [email protected], or the support page. See also the Privacy Policy and the Terms and Conditions.