Consumer Health Data Privacy Policy

I am Carl Brothers, in Washington state, and CYGM is my hobby project rather than a company. Washington has a consumer health data law that asks for a separate, plainly linked notice about health information, so this is it. It is written for everyone, not only for people in Washington.

It covers one thing: the story form on the stories page. Nothing else on this site collects health information. Your glucose readings never touch this website: they travel from your CGM's own service to your own device, and I never see them. The general privacy page covers everything else.

A story is free text, so I cannot know in advance what is in it. What the form asks for, and what is stored, is this:

• Health information you volunteer in your own words. Most stories mention a diagnosis of type 1 diabetes, in the writer's household or their own. Anything of that kind you choose to type is health information, and it is stored as you typed it. The form asks you not to include specific glucose readings, dates of medical events, or clinician and hospital names.
• Your name, and the choice you made about how much of it is shown: full name, first name only, initials, or anonymous.
• Your email address, which is never published.
• An optional place, a city or a country, if you filled it in.
• An optional service name, if you said which CGM service you use.
• An optional title for your story.
• Optional photographs, which are decoded and written out again on arrival, so the location and capture time your phone hides in a camera file do not survive. Only the pixels do.
• An optional link and the name you gave it.
• The consent record: the exact wording of the four boxes you were shown, the version of that wording, and the time you agreed.
• The date the submission arrived.

Your network address and your browser string are not stored with a submission. No profile of you is built, and there is no analytics package anywhere on this site.

From you, directly, typed into one form and sent once. There is no other source. I do not buy data, I am not given data by anyone, and nothing about you is inferred from anywhere else and attached to your submission.

To publish your story on this website, with the credit you chose, so other people thinking about building one of these can read an account that is not written by me. That is the purpose.

Your email address has two narrow uses on top of that: replying to you if you asked me something, and letting me find your file if you later ask me to take the story down.

It is not used for advertising, for any recommendation system, for training a model, or for anything to do with money, because there is no money in this project.

Nobody. There is no third party, no processor I hand it to, no affiliate, no partner, and no advertiser. I am the only person who reads a submission, and it is never emailed anywhere: it sits in a directory on this server that the web server refuses to serve, until I read it in a password-protected review area.

The one exception is the obvious one, and it is the point of sending it: with your consent, an approved story is published on this website, where anyone can read it, under the credit you chose. A published page can be copied or archived by others, which is what publishing means, so choose your credit with that in mind. The site is hosted by IONOS, so the files physically sit on their servers as any website does.

Nothing is sold. I do not sell health information, or anything else, and I never have. There is no arrangement under which anyone gives me anything of value for it.

Nothing is collected until you agree to it. The form has four separate boxes, none of them ticked for you and none of them bundled together, and a submission that is missing any one of them is refused outright rather than stored and held. You agree that your story, including any health information in it, may be published here and kept until you ask for it to come down; that you have permission from anyone else your story mentions, and that you are their parent or guardian if that person is a child; that you are eighteen or older; and that any photograph is yours to share, including everyone and everything in the frame.

The exact text of those four boxes is stored with your submission, along with the version of that wording and the time you ticked them. That is deliberate: if I ever reword the boxes, the record of what you actually agreed to does not change with it.

Email decibelkaos@gmail.com and say you want your story taken down. You do not have to give a reason, and you will not be asked for one.

Withdrawing consent and asking for deletion are the same act here, because the only thing consent supports is publication. When you ask, the published page comes down, and the stored file, its photographs and its consent record are deleted from the server. There is no database row left behind and no backup copy I keep for myself. Deletion happens within fourteen days, and usually the same day.

You can also ask me what I hold about you, or ask me to correct it. Same address, same turnaround.

Carl Brothers, Washington state, United States. decibelkaos@gmail.com. There is no company, no support desk and no form to fill in: that address reaches me.

If what the form collects changes, this page changes and the date moves with it. The consent wording is versioned separately, so an older submission always carries the text that was actually on screen when it was sent.

Effective 10 September 2026.