Consumer Health Data Notice

Last updated: 16 September 2026 | Effective: 16 September 2026

This notice is published separately from our Privacy Policy because Washington’s My Health My Data Act requires a distinct consumer health data privacy policy. It explains what consumer health data Aromha, Inc. collects, why, who sees it, and the rights you have over it.

It applies to everyone, and residents of Washington, Nevada and Connecticut have the specific statutory rights set out in section 6.

1. What counts as consumer health data here

Consumer health data means information linkable to you that identifies your past, present or future physical or mental health status. For Aromha that is a short list, and we would rather name it than describe a category.

Your responses during the Aromha Brain Health Test. Which odors you identified, which you recalled, which you told apart, how intense you found them, and how confident you were in each answer.
The result the test produces, including your scores.
What you tell us in a message to support that concerns your health, your symptoms or your result.

We do not collect your medical history, your diagnoses, your medications, your genetic information, biometric identifiers, or precise location. We do not ask for them and the test does not use them.

2. Why we collect it

Only for these purposes.

To deliver the test you asked for and return your result to you.
To support you when you contact us.
To improve the Aromha Brain Health Test and our scoring methods.
To meet legal, tax and regulatory obligations.

We do not use consumer health data for advertising, to build a profile of you, to infer characteristics about you, or to make decisions about you.

3. Where it comes from

Directly from you, when you take the test or write to us. We do not buy consumer health data, and we do not obtain it from data brokers or from your clinician.

We do not sell consumer health data. We have not sold it and we do not intend to.

We do not send your result to anyone. Not to your physician, your clinic, your employer, your insurer or your family. Your result is returned to you and you decide who else sees it. That is true whether you bought the test from us directly or received it through a clinic, an audiologist or a community.

We share it only with:

Service providers who process it on our behalf and under contract, and only to run the service. Today that is our website hosting and form providers, our email provider and, for orders, our payment and shipping providers. They may not use it for their own purposes.
Legal and safety, where the law requires it or to protect someone’s safety.
Anyone you tell us to.

5. De-identified data, and the condition we have set

We may process test data into de-identified data that can no longer reasonably be used to identify you.

We will not release, license or sell de-identified data outside Aromha unless and until it has first been de-identified to the standard of a qualified expert determination under the HIPAA de-identification rule (45 CFR 164.514(b)(1)). We have not yet completed that determination. Until we have, de-identified data stays inside Aromha and is used only to run and improve the test.

Where any law would treat such a use as requiring your authorization, we will obtain that authorization first rather than relying on the argument that de-identification puts the data outside that law.

Once data has genuinely been de-identified and shared it no longer identifies you, so we may be unable to retrieve it later. We say that here rather than in a footnote because it is the part people are most often surprised by.

6. Your rights

You have the right to:

Know what consumer health data we collect, use and share, and with whom.
Access it, including a list of who has received it.
Withdraw consent to its collection and its sharing.
Delete it. We will delete it from our records and direct our service providers to do the same.
Not be discriminated against for exercising any of these rights.

To exercise any right, write to support@aromha.com. We will verify that the request is really yours and respond within the time the law allows, which is 45 days under the My Health My Data Act, extendable once by 45 days where reasonably necessary.

If we deny your request, we will tell you why and how to appeal. To appeal, reply to our decision or write to support@aromha.com with “Privacy appeal” in the subject line. Someone not involved in the original decision will review it. If we deny your appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the attorney general of your own state.

7. How long we keep it

Test responses and results are kept for as long as you may want to retrieve them, plus seven years, which matches our general business-records retention. After that we delete or de-identify them. If you ask us to delete, we delete rather than waiting for that period to run.

8. Where it is held

In the United States, on cloud infrastructure aligned to HIPAA security requirements. Access inside Aromha is limited to the people who need it to run the service.

9. No tracking

The aromha.com website sets no cookies and runs no analytics, advertising or tracking technology, so we do not collect consumer health data through tracking, and there is no advertising profile to opt out of. Our Cookie Policy says more. If that ever changes we will update this notice before it does.

10. Changes

We will post an updated notice with a new “Last updated” date and, for material changes, give additional notice. We will not use consumer health data we already hold in a materially new way without asking you first.

11. Contact

Aromha, Inc. 10008 Hemswell Lane, Potomac, MD 20854 support@aromha.com