Ledger · the fine print

Consumer Health Data Privacy Notice

Effective 24 September 2026.

FoxFire Solutions LLC, a Delaware limited liability company having its registered office at 3 Germay Dr Unit 4 1430, Wilmington, DE 19804 (“Ledger”, “we”, “us” or “our”), publishes this Notice pursuant to the Washington My Health My Data Act, RCW 19.373 (the “Act”). It supplements our Privacy Policy and governs in the event of any inconsistency with it as to Consumer Health Data. We extend the rights described in Section 6 to residents of Nevada, whose consumer health data provisions appear at NRS chapter 603A.

“Consumer Health Data” has the meaning given in RCW 19.373.010 and, for the purposes of this Notice, comprises the categories identified in Section 1.

1. Categories collected

We collect the following Consumer Health Data:

• Your self-assessment responses, comprising your age band, the sex of your partners, the number of partners within the preceding twelve months expressed as a band, whether any partner is new since your last test, your frequency of condom use, the date of your last test, whether you have received a prior diagnosis, and whether you take pre-exposure prophylaxis.
• The relationship status recording that you are in a sexual relationship with an individual.
• The contact categories recording that you or an individual attended the other’s residence.

We treat each category as Consumer Health Data whether or not it is required to be so treated.

2. Sources

All Consumer Health Data is collected directly from you, through entry into the Service. We do not purchase it, infer it from your conduct, or obtain it from any third party.

3. Purposes of collection and processing

We process the self-assessment responses solely to present to you one of three guidance levels. We process the status and contact categories solely to present your own records and pattern observations to you. We do not process Consumer Health Data for advertising, for any assessment of any individual, or for any purpose other than those stated.

4. Consent

We obtain your consent before collecting each category identified in Section 1. That consent is sought separately from, and is not a condition of, your acceptance of our Terms of Service or your use of the Service generally. We obtain a further consent, separate and distinct from the consent to collection and sought in advance of any such disclosure, before sharing Consumer Health Data.

5. Disclosure, sale and prohibited practices

5.1 Recipients. We disclose Consumer Health Data only to our hosting and database providers, acting on our behalf under contract restricting its use to the operation of the Service. We disclose no Consumer Health Data to advertisers, data brokers or analytics providers. Our diagnostic and usage events are scrubbed and contain none of it.

5.2 No sale. We do not sell Consumer Health Data and have not done so. Any sale would require your valid authorization under RCW 19.373.110, which we do not seek.

5.3 Legal process. We require a warrant or court order before disclosing Consumer Health Data.

5.4 Inference. We do not use Consumer Health Data to infer or draw any conclusion concerning reproductive decisions.

5.5 Geofencing. We operate no geofence around any health care facility and collect no precise geolocation.

6. Your rights

6.1 You may request confirmation of whether we collect, share or sell Consumer Health Data concerning you, and a list of the third parties to whom we have disclosed it.

6.2 You may withdraw your consent to our collection or sharing of Consumer Health Data.

6.3 You may request deletion of Consumer Health Data concerning you, including from archived and backup systems. We will effect deletion within thirty (30) days of receipt, and will direct any third party holding a copy to do likewise.

6.4 Deletion of your account effects deletion of all Consumer Health Data concerning you, as does emptying your book from the You page without closing your account. You may stop the recording of any category of Consumer Health Data from the You page at any time, which applies from that moment; deletion of what is already recorded, alone, may be requested under Section 6.3.

6.5 Submitting a request. Submit a request to privacy@ledgerblackbook.com. We verify a request against the telephone number associated with the account and will respond within forty-five (45) days. An authorized agent may submit a request on your behalf upon presentation of written authorization we are able to verify.

6.6 Appeal. Where we decline a request we will state our reasons. You may appeal by replying to our determination. Where we decline the appeal, you may submit a complaint to the Washington Attorney General at https://www.atg.wa.gov/file-complaint.

7. Security

Self-assessment responses are encrypted on your device before transmission, using a key generated on your device, and we store the resulting encrypted content. That key is stored with your account only in encrypted form, under a separate key held in our server environment and not in the database, and is made available to your device when you sign in with your telephone number. When the key is stored or made available to a device, it passes in unencrypted form through the memory of our server for the duration of that request, and is not written to storage or logs. Any person able to sign in to your account is able to read those responses. We retain only the resulting guidance level, which is not associated with any individual recorded in the Service. The status and contact categories are stored within your own records in a form we are able to read, and are restricted to your account.

8. Amendment

We will publish any amendment to this Notice on this page and will notify you within the Service prior to its taking effect.

9. Contact

FoxFire Solutions LLC, 3 Germay Dr Unit 4 1430, Wilmington, DE 19804. privacy@ledgerblackbook.com.