Consumer Health Data Privacy Policy

Version 1.21 · Effective November 3, 2026

This notice is about consumer health data — the health information you give Stabilibuddy. It is a separate document from our general Privacy Policy and it stands on its own: you do not need to read that one to understand this one.

Stabilibuddy is operated by ChillyPixel LLC, and we are the people responsible for the data described here.

1. What consumer health data we collect, and why

We collect no health data beyond this. We do not obtain health data about you from any outside source, we do not buy it, and we do not collect location data, biometric identifiers, or data from any sensor or wearable.

We do derive things from what you logged, and that is the point of the app: the summaries, forecasts and sleep insights described above are produced from your record and are themselves health data about you. We hold them, they are covered by everything in this notice, and deleting your data deletes them.

2. Where it comes from

From you, at your direction. Every item above is something you typed into Stabilibuddy or imported into it yourself. We receive no consumer health data from data brokers, advertisers, health plans, clinicians, or any other source you have not pointed us at.

There is one case where data arrives from somewhere other than your keyboard, and it only happens if you start it: the eMoods web import. You give us your eMoods username and password, we use them to sign in to your own eMoods account — through Amazon Cognito, which is the sign-in service eMoods uses — and we fetch your history from eMoods' servers. That is your data coming from an account you already hold, not data anyone sold us. If you import from a file instead, or from Bearable, nothing leaves our servers at all.

3. What we share, and with whom

We share consumer health data with the service providers that run Stabilibuddy for us, and — if you set it up — with the person you granted access to, which section 4 describes. Apart from Anthropic and the notification services, described next, the providers receive it only so they can run the service, with one exception set out below rather than left for you to find: Microsoft stores what we send to Azure OpenAI in order to detect misuse of that service, which is Microsoft's own purpose. None of them may sell your data, advertise from it, or build a profile of you.

Anthropic is different. We read bug reports with the help of its Claude under Anthropic's own consumer terms, not a contract with us, so Anthropic handles a report under those terms. It does not train its models on it, it keeps it for up to 30 days (up to two years if its automated safety systems flag it), and it says it does not sell personal data. That is why the box you tick to send a report names Anthropic.

So is your browser's notification service. If you turn on reminder notifications, each reminder goes through the service your browser uses for them: Google's for Chrome and most Android browsers, Apple's for Safari, Mozilla's for Firefox, Microsoft's for Edge. Your browser chooses it, not us, and it works under its own terms rather than a contract with us. What it learns is that the device receives notifications from Stabilibuddy, a mood tracking app, and when. That is why it is named here. The message is encrypted so that only your device can read it, and it says only “Time to log”. Nothing you logged goes to it. Notifications are off unless you turn them on.

The services, Anthropic and the notification services among them, are:

Four of those carry health data specifically, and they are worth naming plainly. Azure SQL Database holds everything you log. Azure OpenAI Service receives your symptom ratings, medications and sleep when you ask for a forecast, and your notes as well if you have chosen to include them — your irritability, anxiety, depression and elevated-mood ratings, your custom symptoms, and each medication with whether you took it and, if you did, the dose, day by day over your most recent logged days, the routines you take your scheduled medications with (their names and usual times), and figures calculated across your whole history (a simulation or backtest uses only the period it replays) such as the average of each rating over every day you recorded it, psychotic symptoms among them (in a forecast those go only in figures summarised across many days, never day by day) — and, when you ask for a sleep insight, your 30 most recent logged days one by one: every rating, psychotic symptoms included, your custom symptoms, sleep, therapy, and each medication with whether you took it and, if you did, the dose; with the average of each rating, your medication figures and your custom-symptom figures across your whole history, and how your sleep relates to your medications, your moods and the day of the week; and your notes as well if you have chosen to include them. We do not add your email address, name or account identifier to either request; but the names you give custom symptoms, medications and medication routines go as free text, and so do your notes if you include them. Nothing in them is removed or reworded, so a name or an email address you type into them goes too. Microsoft may process these requests in any region it runs the model in, so we make no promise about where that happens. eMoods returns your own history to us during a web import, which is the one flow that brings health data in rather than sending it out. Claude, from Anthropic, reads the full text of a bug report or feature request you send, when we review it. The rest carry your health data only incidentally or not at all.

And one disclosure that is larger than any of the categories above. Every forecast request instructs the model to read your record as a specialist in bipolar disorder would, looking for early warning signs of manic or depressive episodes. There is nowhere in this app to enter a diagnosis and we send none as a field — but the request is framed around that condition, and a reader of it would take it as being about you. We would rather state that than let the categories above imply that only ratings and notes leave.

Which of your notes go, and when. None, unless you turn on Include my notes in AI forecasts and sleep insights in Settings; it is off unless you do. When it is on: every note you have written, from your whole history (a simulation or backtest uses only the period it replays), goes with each forecast and each sleep insight, in full and at whatever length you wrote it. None is picked over another, so a note from years ago leaves, and so does a note about being in crisis. That is stated here rather than left for you to infer from the paragraph above.

A single action can also mean many transmissions: a forecast is assembled from several requests, and a simulation or a backtest sweep re-sends your record for each run it performs.

One disclosure we want you to see rather than find: Microsoft stores the content we send to Azure OpenAI in order to detect misuse of that service, and we have not been granted an exemption from that storage. Content already flagged by automated systems can in some cases be read by authorized Microsoft employees. Microsoft's current documentation does not state how long that store is kept, nor whether every prompt enters it or only the ones that get flagged. Microsoft exempts some customers from it; we do not hold an exemption. We applied on 30 September 2026 and were refused, because Microsoft grants it only to customers managed by one of its account teams and is not currently accepting applications to become one. If you would rather your notes were not subject to this, leave Include my notes in AI forecasts and sleep insights off, which is how it starts. If you would rather nothing you log was, do not generate forecasts or sleep insights — those two features are the only things that reach that service, and the rest of Stabilibuddy works without them.

4. You can share it with a person, if you choose

You can give a clinician or someone you trust read-only access to your record. That only happens if you set it up, it is separate from anything above, and you can withdraw it at any time from your care team settings.

5. We do not sell it

We have never sold consumer health data and we do not sell it. That includes any exchange of it for anything of value. If that ever changed we would have to ask you first, in a separate signed authorization, and we would.

6. Your rights, and how to use them

• Find out what we hold. Ask us and we will confirm whether we collect or share your consumer health data, and give you a copy along with the list of everyone it has been shared with.
• Delete it. Delete what you logged, or your whole account, from Manage Your Data — that page itemizes what each option removes before you confirm. You can also ask us to delete anything those controls do not reach. Delete My Logged Data does not delete a bug report or feature request you sent, because a report is about the app rather than part of your record. Deleting your account deletes it, and so does asking us. We may also delete a report once the problem it describes has been dealt with.
• What deletion does not reach, said here rather than left for you to discover. We delete from the systems we control. When you delete from Manage Your Data, or ask us to delete, we also pass your request on to the services in section 3 that may still hold a copy: Microsoft, for what it keeps from Azure OpenAI, and Anthropic, when what you deleted includes a bug report or feature request. We ask each of them to delete it. We cannot do that for them, and we cannot confirm that they have. Five things sit outside our own deletion. What you delete stays in the database's backups until they are removed, up to 42 days after you delete it. A file you uploaded to import a history is removed by a sweep rather than by the delete button, so it can outlive the deletion by up to 48 hours. The copy Microsoft keeps for abuse monitoring, described in section 3, is not ours to delete — we cannot promise it goes when you ask us, and we will not pretend otherwise. Anthropic keeps the text of a bug report Claude reads for up to 30 days, or up to two years if its automated safety systems flag it, and that copy is not ours to delete either. And when you ask for a forecast, we ask Microsoft not to store the result, but we have not established what it does with it afterwards, and we ask for it to be deleted only when we pass a deletion request on, as above.
• Withdraw your consent. You can withdraw consent to our collection and sharing of your consumer health data at any time. Deleting your account does this and removes the data with it.

To exercise any of these, write to privacy@chillypixel.com. We will respond within 45 days. If we ever need longer we will tell you why before that runs out. We will not treat you differently for asking, and there is no charge.

If you think we have got this wrong, you can complain to us at the address above. Washington residents may also contact the Washington State Attorney General's Office.

7. Changes to this notice

If we change this notice materially we will tell you before the change takes effect. The effective date at the top tells you which version you are reading.

---

See also our Privacy Policy and our Terms of Service.