Consumer Health Data Privacy Policy

Sprig is a dating service. Some information you choose to share can reveal things the Act protects — in particular sexual orientation, gender identity, and information about sexual or reproductive health choices. On Sprig, the categories we collect are:

• Orientation and gender identity: the gender, orientation, and “seeking” preferences you set on your profile.
• Sexual-behavior and desire question answers: your answers, notes, acceptable-answer selections, importance levels, and dealbreaker flags for the compatibility questions we flag as sensitive in our intimacy & affection category — the questions about sexual behavior and desire itself. (The surrounding romance-and-affection questions — date nights, flowers, hugs — are not consumer health data and are not flagged.)
• Family-planning question answers: the same, for the flagged questions in our future & family category — for example, whether you want children, and fertility-related questions. (Money, career, in-law, and parenting-values questions in that category are not flagged.)
• Health-practice question answers: a small number of lifestyle questions we flag because they concern medication, preventive care, or mental-health practices.
• Any other question we flag as sensitive: flagging is per-question, not per-category — the consent screen appears before the first flagged question wherever it lives.
• Inferences: your compatibility scores with other members are computed in part from the answers above.

Lifestyle questions about habits such as drinking or smoking are not currently flagged. [ATTORNEY: confirm whether substance-habit answers should be treated as consumer health data under RCW 19.373.010 — the full grey-area list, with our interim calls, is the “Sensitivity review” sheet of the question-bank audit workbook.]

You, directly. That is the only source. We do not buy data about you, enrich your profile from data brokers, pull from social media, or infer health information from your browsing. If you never provide a category above, we never have it.

• Matching: computing compatibility between you and other members, including orientation-aware discovery (showing you people you're seeking who are seeking you).
• Member-to-member display, on the commit-first rule: another member can see your answer to a question only if they have answered that same question themselves — and never if you mark the answer private. A private answer still informs matching but is not displayed to anyone, and is not identified question-by-question (see Section 5 of the Privacy Policy for the full visibility rules).
• Safety review: if content is flagged by the member who received it, our safety team reviews the reported content and, for safety-critical reports (such as a possible minor), a limited window of recent messages from that conversation (Privacy Policy §4).

We do not use consumer health data for advertising of any kind, and we do not use it for purposes beyond those listed here without asking for your consent first.

• Profile basics (gender, orientation, seeking): collected when you build your profile, because orientation-aware matching is the service you're signing up for — Sprig cannot show you compatible people without it.
• Flagged (sensitive) questions: before the first of these questions, we ask for your affirmative consent on a separate screen, and we record when you gave it. Marking an answer private does not remove the need for this consent — a private answer is still collected and used for matching, so the consent requirement applies the same way; privacy only limits what other members see. Answering is always optional — skipping does not limit the rest of the Service. If you skip, these questions are hidden from your question flow and we won't ask there again; you can turn them on anytime in Settings, and if you choose to answer one from another member's profile we'll ask for your consent right there.
• Withdrawing consent: you can withdraw at any time in Settings. Withdrawal stops these questions from being asked and deletes your existing answers to them.

• Other members: only per the commit-first rule above — never in bulk, never publicly, never to members who haven't answered the same question.
• Service providers (processors), under contract: infrastructure hosting (currently IONOS); private photo, file, and backup storage (currently Cloudflare R2) — our encrypted nightly database backups are stored there, so that provider holds a copy of the data described in this policy; and email delivery (our own email system and the sending provider it uses, currently Resend). Processors may handle data only on our instructions, and we may change providers within these categories without changing how your data is used.
• Legal and safety: where disclosure is required by law or necessary to prevent imminent harm, as described in the Privacy Policy.
• Affiliates: none. Sprig has no affiliated companies with access to member data.

We do not sell consumer health data, and we never will ask you for the authorization that a sale would require. We do not share it with third parties for their own purposes.

Under the Act you have the right to:

• Know and access the consumer health data we have about you, including the third parties we've shared it with;
• Withdraw consent (Settings, or email us);
• Delete your consumer health data. Deleting your answers (or your whole account, in the Safety Center) removes the data from the live Service immediately; we instruct our processors to delete it, and it ages out of routine backups within six months;
• Not be discriminated against for exercising any of these rights.

To exercise any right, use the in-app controls above or email [email protected]. We'll verify the request comes from the account owner and respond within 45 days. Email and the in-app controls are the ways to submit requests — postal mail is not a request channel.

Appeals: if we decline a request, we'll explain why and you may appeal by replying to that decision; appeals receive a fresh review and a written response within 45 days. If you're unsatisfied after appeal, you may contact the Washington Attorney General at atg.wa.gov/file-complaint.

We do not use geofencing of any kind. Location on Sprig is a self-reported ZIP code converted to an approximate area center — the Service never collects precise location, and photo location metadata is stripped on upload.

Material changes to this policy will be announced by email or in-app notice before they take effect, and new uses of consumer health data will not happen without fresh consent.

Sprig Dating LLC
c/o Washington Commercial Registered Agent LLC
100 N Howard St STE R
Spokane, WA 99201
[email protected]