Loading…
WLFL-SC is an independent tool used by participants of a weight-management program to place and track meal-replacement orders. It is not affiliated with or endorsed by PeaceHealth or HMR, and it is not a healthcare provider. We choose to treat the data described below with the same seriousness we would if we were, because some of it — specifically, starting body weight — falls within Washington's broad legal definition of consumer health data even though we are not a HIPAA-covered entity.
You can only see your own data when signed in — this is enforced by the database itself, not just by which screens the app happens to show you, so one participant's data is never reachable through another participant's account. Beyond that, one person — the site administrator who runs this program — can see participant data as needed to fulfill orders and help with account questions. PeaceHealth does not have access to this app or to any data in it. No one else does either.
| Field | Purpose |
|---|---|
| Name, email | Sign-in, order identification, receipts and other order emails |
| Cell phone (optional) | Contact from the site administrator about a pick-up only. We never send text messages. |
| Program start date, class day, phase, coach | Program context for the site administrator; phase controls which items you can order |
| Starting weight (optional, consumer health data) | Visible only to the site administrator. Stored encrypted, separately from your other profile fields, and is never displayed on your order form, receipts, or history reports. Collected only with your explicit, separate consent at the point you enter it. |
| Orders and order history | The actual purpose of the app — placing and fulfilling orders |
Your starting weight is only collected if you type a value into your profile and check the consent checkbox next to it, which links to this page. We do not require it to use the app — it currently has no effect on your order form, and is stored purely so the site administrator has context if you choose to share it. You can decline to provide it.
| Data | Retention |
|---|---|
| Active account | Life of the account |
| Orders (anonymized after deletion) | 3 years |
| Admin activity log | 2 years |
| Email delivery log | 90 days |
| Database backups | 30 days, encrypted |
Deleting your account erases your data from the live database as described above. Database backups age out on their own 30-day schedule and are not individually edited when an account is deleted — so a trace of your data may exist in a backup for up to 30 days after deletion, accessible only in the event of a disaster-recovery restore. We think it's more honest to say this plainly than to imply instant erasure everywhere.
Contact the site administrator directly with any questions about this policy or your data.