Consumer Health Data Privacy Notice
How Suri collects, uses, discloses, and protects consumer health data.
Updated July 10, 2026
Consumer Health Data Privacy Notice
Effective date: July 10, 2026
This Notice explains how LabLeoRex, Inc., doing business as Suri, handles consumer health data. It supplements the Suri Privacy Policy. It is intended to satisfy the Washington My Health My Data Act and similar state health-data notice requirements where applicable.
1. Consumer Health Data We Collect or Process
Depending on the features you choose, Suri may collect or process:
- Medication, supplement, and food names or identifiers maintained on your device
- Interaction trigger codes derived from medications and counts of items in a local profile
- Product, drug, supplement, food, ingredient, and barcode lookup identifiers
- Account, session, IP address, device, and request metadata linked or reasonably linkable to a health-related request
The complete health profile you create is maintained on your device rather than in Suri's central database. However, limited identifiers, derived codes, and technical metadata are transmitted when you request interaction, personalization, scan, or symptom features.
2. Sources
We obtain consumer health data from:
- You and the information you enter, select, scan, or request
- Your device when it derives limited interaction codes or submits a request
- Product, drug, supplement, food, scientific, and government reference data used to return a result
We do not obtain consumer health data from a healthcare provider, insurer, data broker, advertising network, or precise-location broker.
3. Why We Collect and Use It
We process consumer health data to:
- Provide the lookup, interaction, personalization, scan, or safety feature you request
- Return informational results and warnings
- Maintain the requested feature during your session
- Protect, secure, rate-limit, debug, and troubleshoot the Service
- Respond to a support or privacy request
- Comply with applicable law and protect legal rights
We do not use consumer health data for targeted advertising, cross-context behavioral advertising, data brokerage, insurance eligibility, employment, credit, or another legally significant decision.
We will not collect a new category or use consumer health data for a materially new purpose without first updating this Notice and obtaining affirmative consent where required.
4. Disclosure and Recipients
Consumer health data may be processed by the following service-provider categories:
- Railway, our application and API hosting processor, processes health-related request content and technical metadata as necessary to return a result
- Neon, our hosted database processor, stores account-linked information and stores health-related content only if you include it in a support, report, or other feature that expressly saves the record
- Cloudflare R2 stores a submitted product image; do not include health or personal information in a product image
- Apple and Google may process account, device, authentication, and app-store information under their own services and policies
As of the effective date:
- We do not sell consumer health data
- We do not disclose consumer health data to advertising networks, data brokers, or social-media advertising platforms
- We do not share consumer health data with an affiliate
- We do not use precise-location geofencing around healthcare facilities
Processors may use consumer health data only to provide the requested Service under contractual restrictions and our instructions.
5. Consent and Withdrawal
Where applicable law requires consent, Suri will present the request before collection or sharing. The request will identify the categories, specific purposes, recipient categories, and how to withdraw. Consent to sharing will be separate from consent to collection where required.
You may withdraw consent for future collection or sharing by emailing support@lableorexinc.com. Withdrawal does not affect processing completed before withdrawal or information that must be retained by law.
If you do not allow optional personalized processing, you may continue to use features that do not require that processing, subject to feature availability.
6. Your Rights
Subject to applicable law, you may request to:
- Confirm whether Suri collects, shares, or sells consumer health data about you
- Access consumer health data about you
- Receive a list of third parties and affiliates with which such data was shared or sold and available contact information
- Withdraw consent for future collection or sharing
- Delete consumer health data from active systems
- Require applicable processors, contractors, affiliates, and other recipients to honor a deletion request
- Appeal a refusal to act on a request
Submit a request through support@lableorexinc.com. We may verify your identity and authority before completing the request.
If we deny a request, you may appeal by replying to the decision with the subject Privacy Appeal. We will respond within the time required by applicable law.
7. Deletion and Retention
Health-related request content is processed to return the requested result and is not intentionally maintained as a persistent server-side copy of your complete health profile. Limited technical request metadata may be retained for up to 90 days.
Upon a verified deletion request, we will delete applicable consumer health data from active systems and notify processors and other recipients as required. Data in an archived or backup system will be deleted when that system is restored or the data expires. Where Washington law applies, completion for archived or backup systems will not be delayed more than six months after authentication of the request.
We may retain a minimal record when required by law or reasonably necessary to document the request, prevent fraud, or establish or defend a legal claim. Retained information will not be used for an unrelated purpose.
8. Security and Incidents
We maintain safeguards designed for the sensitivity and volume of consumer health data, including transport encryption, access restrictions, authentication controls, service-provider review, logging, and incident-response procedures.
No system is completely secure. If a breach-notification law applies to an incident, including the FTC Health Breach Notification Rule where applicable, we will provide required notices.
9. Changes
We will update this Notice before collecting an additional category of consumer health data or using existing consumer health data for a materially new purpose. We will obtain affirmative consent when required rather than treating continued use alone as consent.
10. Contact
Entity: LabLeoRex, Inc., doing business as Suri
Privacy email: support@lableorexinc.com
Full Privacy Policy: https://checkable-production.up.railway.app/legal/privacy-policy