Consumer health data privacy policy
Written for the Washington My Health My Data Act (RCW 19.373) and similar laws (Nevada SB 370, Connecticut). Effective September 6, 2026.
This policy supplements the HSA Proof Privacy Policy and applies to "consumer health data" as those laws define it. It is published by Mount Si Labs LLC ("Mount Si Labs", "we").
Categories of consumer health data the app processes
Information you capture about medical expenses: provider or pharmacy names; dates of service; amounts paid; expense categories such as "prescription" or "dental"; the patient labels you enter; images or files of receipts, explanations of benefits and invoices, which may show diagnoses, prescriptions or procedures; the text the app reads from those documents; the eligibility category each expense matched and the rule version used; your HSA establishment date and custodian if you enter them; and the audit history of changes to these records.
Purpose
Solely to let you keep records of potentially HSA-qualified medical expenses and produce exports for your own use. The app uses this data for nothing else.
Sources
You. Records come from your iPhone's camera, from photos you choose in your photo library, or from files you choose to import. The app has no connection to any provider, insurer, pharmacy or other account and does not import from them.
The basis on which the app processes this data
Storing and processing records on your iPhone is necessary to provide the service you request by using the app. It happens on the device and nothing is sent to Mount Si Labs.
Syncing records to your private iCloud database is optional and off by default. It happens only when you turn on "Sync with my private iCloud", during setup or later in Settings. Turning it on is your consent to the following, which the app also states on that screen:
- What is synced: the categories listed above.
- Why: so the same records are available on your other devices signed in to your Apple Account.
- Who receives it: Apple, which stores it in your iCloud account under your iCloud terms. No one else.
- How to withdraw: turn sync off in Settings. Future records stay on this iPhone. Records already in iCloud remain there until you remove them with Delete all my data (with sync on) or in iOS Settings.
Who can read synced records depends on your Apple Account settings; the privacy policy explains standard protection and Advanced Data Protection.
Sharing
Mount Si Labs does not share, sell or disclose consumer health data to anyone, and has no agreement with any company to process it. Records you choose to sync are stored by Apple under your iCloud terms.
Records about other people
You may store a receipt that concerns a family member or dependent only if you have the authority to keep that record. A request from the person a record concerns is handled as a rights request under this policy.
Your rights and how to exercise them
In the app, immediately and without asking us:
- Access and export: the Export tab produces a complete copy of the years you select.
- Correct: edit an expense; void a mistaken reimbursement.
- Delete: delete one expense, or Settings → Delete all my data.
- Withdraw consent to sync: Settings → turn sync off.
These work because the records are on your device. Mount Si Labs cannot see, change or delete them for you.
By email. If you believe Mount Si Labs holds consumer health data about you, for example something you sent to a support address, write to privacy@hsa-proof.com. We will act on a request to access, delete or withdraw consent without undue delay and within 45 days of receiving it. If a request is complex, we may take up to 45 more days, and will tell you within the first 45 why and how long. We may need to confirm that a request comes from you by commercially reasonable means; we will never ask you to send medical documents to do so. If we decline any part of a request, we will tell you in writing why.
Appeals
If you are not satisfied with our response, reply to the same thread with "Appeal" in the subject line within a reasonable time after you receive the decision. We will respond in writing within 45 days of receiving the appeal, with the reasons for any decision. If your appeal is denied, you may submit a complaint to the Washington Attorney General, or to the attorney general of your own state.