Draft, under legal review. Plume is in a free private beta; this document will be replaced by the reviewed version before public launch.

Plume Consumer Health Data Privacy Policy

Effective: [not yet in effect: draft of November 11, 2026] · [operator's legal name: to be added before launch], [postal address: to be added before launch] · privacy@plumeapp.net

Almost everything you log in Plume is "consumer health data" under these laws. This policy says what we collect, why, where it comes from, who receives it, and how to use your rights. We collect and share it only with your consent, which you give in the app before any of it reaches our servers. You can withdraw that consent at any time.

Before you sign in. Once you have given consent, Plume stores and processes your data on our servers even if you have not signed in, under an account that is tied to your iPhone and has no name, email or Apple ID attached. Everything in this policy applies to that data in the same way, including who receives it. If you don't use that account for 180 days we delete it with everything in it, and you can delete it yourself at any time in Settings. Signing in later keeps the same account.

1. Categories of consumer health data we collect

• What you write or say in your entries, whatever it is about. Most of it is about your body and habits: food, drink, caffeine, alcohol, supplements, medications you mention, symptoms, sleep, exercise and energy, and the facts Plume reads from that.
• Photos, voice recordings and files you attach to entries (for example meal photos).
• Measurements from Apple Health or Oura, as summaries (daily totals, sleep and workout times, steps per hour): steps, sleep duration, heart-rate variability, resting heart rate, weight, workouts, active energy, sleeping wrist temperature (the night's difference from your usual), and what you logged as food in other apps (energy, protein, carbohydrate, fat, fibre, sugar, sodium, caffeine, water).
• Medications you mark as taken in Apple Health (name and time of each dose), only if you allow it. Plume stores them and lists them in your day; it gives no advice about them and does not use them in suggestions or experiments.
• Reproductive health, only while cycle tracking is on: cycle day and period flow.
• Mental-health-related data, only while mood tracking is on: mood and stress as Plume reads them from your entries, and the State of Mind entries you log in Apple Health (how pleasant it was, the labels you picked and the time), if you allow that.

You can switch cycle or mood tracking off in Settings. Plume then stops collecting and using that kind of data: it deletes the day values and Apple Health records for it, and retires what it had read from your entries so it is no longer shown or used. Your entries themselves stay as you wrote them, and the retired readings stay in your account until you delete those entries or the account.

• Inferences Plume makes from the above: rough nutrition estimates, patterns (for example "alcohol tends to lower your next-morning HRV"), experiment results, memories, recaps and answers to your questions.
• Health goals you set.

We never collect basal body temperature, ovulation test results or cervical mucus (our servers refuse them), and we do not use wrist temperature to estimate ovulation or fertility. We do not collect location.

2. Why we collect it and how we use it

To provide the Plume features you use: understanding entries, showing patterns and how sure Plume is of them, running self-experiments, writing weekly and monthly recaps, answering your questions about your own history, sending notifications you enable, and flagging when something is worth discussing with a doctor or pharmacist. Also to keep the service secure and to meet legal obligations.

We do not use consumer health data for advertising, we do not use it to train AI models, and we do not sell it.

3. Sources

• You: your entries, attachments, goals and settings.
• Apple Health on your iPhone, for the types you allow.
• Oura, if you connect it.
• Our own analysis of the above, including analysis done for us by OpenAI (section 5).

4. What we share, and how your consent covers it

Every category in section 1 is stored with our hosting provider. The entries, photos, voice audio, summaries and context needed to understand them are read by our AI provider. Nothing is shared for anyone else's purposes.

• Collection and use: the "Before Plume reads this" consent screen, shown before anything leaves your phone. It names what is collected, why, who receives it and how to take the consent back.
• Sharing with the processors in section 5 is covered by that consent and is limited to the purposes in section 2. They process the data for us, to provide Plume to you. We don't share consumer health data with any third party for that party's own purposes. If that ever changes, we will ask for separate consent first.
• Selling: never. Washington requires a separate signed authorization to sell; we don't ask for one and don't sell.

5. Who receives it

Affiliates. No affiliate of ours receives consumer health data.

Third parties. We do not share consumer health data with third parties for their own use.

Processors, by category and by name:

These receive no consumer health data:

• Resend (Plus Five Five, Inc.), our email provider: if you sign in with email, it receives your email address and the sign-in code, and nothing else.
• Error reporting (Functional Software, Inc., "Sentry"), if we have it switched on: the type of a server error, a short technical message and where in our code it happened, after an automatic filter has removed quoted text, email addresses, IDs and long numbers, with a scrambled account ID. Not designed to carry anything you wrote; the filter could miss an unquoted fragment of text inside an error message.
• Usage analytics (Statsig, Inc.), only if you opted in and we have it switched on: fixed event names and categories with a scrambled account ID.

If you add your own API key. If you give Plume your own API key for an AI provider you choose (OpenAI, Google or Anthropic) in Settings › Advanced, Plume sends the text of your entries and questions, your photos when the model you picked can read images, and the context needed to understand them to that provider, using your key and at your direction. That processing is under your own agreement with that provider, not Plume's. Your key is stored encrypted on Plume's servers, is never shown again, and is removed when you remove it, when you choose "Forget everything", or when you delete your account.

6. Your rights and how to use them

You have the right to:

1. Confirm whether we collect, share or sell your consumer health data, and access it, including a list of every processor and third party that received it. In the app: Settings › Export all data (the export includes that list). Or write to us.
2. Withdraw consent to collection and sharing. In the app: Settings › Consent and data use › Withdraw consent. Our servers stop processing at once. What is already stored stays until you delete it; you can still export and delete.
3. Delete your consumer health data. In the app you can delete single entries, or everything: Settings › Delete account and data. Or write to us.

All three work in the app whether or not you have signed in.

What deletion does. Deleting your account erases your data from our servers right away: entries, photos, recordings, files, everything Plume derived, health records, goals, your name and email address, your consent records, and the encryption key for your files. If a step fails, it is retried every day until it is done.

What happens at each processor:

• Cloudflare stores the data for us, so erasing it from our servers is erasing it there. Copies leave Cloudflare's point-in-time backups (of the database and of each account's own storage) within 30 days, well inside the six months the law allows. We don't restore deleted data except to recover from an outage.
• OpenAI keeps nothing for us: we ask it not to store our requests. What it already received may stay in its abuse-monitoring logs for up to 30 days, and we have no way to delete it from them sooner.
• Oura, if you connected it: we give up our access there.
• Error reporting and analytics, if switched on, hold only a scrambled account ID with no health data; we don't send them a deletion request.
• Your own API key's provider, if you used one: that is under your agreement with them; we can't delete there.

The general Privacy Policy, section 6, lists the few things that are not health data and remain (for example an access-log line with your account ID removed).

Asking by email. Write to privacy@plumeapp.net.

• We answer within 45 days. If a request is complex we may take up to 45 more days, once, and we tell you why within the first 45.
• To make sure a request is really yours, we may ask you to confirm it from inside the app or from the email address you sign in with. We never ask for more than that needs. If you never signed in, your account is tied only to your iPhone, so the in-app export and delete are the reliable way.
• Requests are free, up to twice a year.

Appeal. If we decline a request, we tell you why. You can appeal by replying to that message, or by writing to privacy@plumeapp.net with "Appeal" in the subject. We answer an appeal in writing within 45 days, saying what we did or didn't do and why.

If your appeal is denied, you can complain to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint, or to the attorney general of your own state.

We don't treat you differently for using these rights.

7. Geofencing

We don't use geofences and don't collect location.

8. Contact

[operator's legal name: to be added before launch] · [postal address: to be added before launch] · privacy@plumeapp.net