Consumer Health Data Privacy Policy

Effective: July 15, 2026

This is a separate policy, required by Washington's My Health My Data Act, covering the health-related information the College Sleep Score collects. It sits alongside our general Privacy Policy — that one covers everything; this one covers health data specifically.

Same approach as everything else we write: plain English, no legalese. If anything here is unclear, email privacy@collegesleepscore.org and we'll answer.

This policy applies to everyone. Washington residents have the specific legal rights described below; Nevada and Connecticut residents have similar protections under their own state laws. We handle everyone's data the same way regardless of where they live.

Who we are

The College Sleep Score is operated by The College Sleep Score LLC, an Arizona limited liability company (ACC Business ID 25067659, 4539 N 22nd St, Suite N, Phoenix, AZ 85016).

We are not a doctor, a clinic, or a health plan. We don't diagnose anything or provide medical care. We're an education tool. Because the law defines “health data” broadly enough to include what a sleep assessment collects, this policy exists.

What consumer health data we collect

When you complete the College Sleep Score assessment or the Sleep Routine Builder:

Your answers — sleep timing and duration, caffeine intake, alcohol use, screen habits, stress, eating patterns, and the other topics the assessment covers.
Your results — your score (0–100), your band (Excellent, Good, Fair, Poor, Very Poor), and derived measures like estimated weekday sleep hours and social jet lag.
Context you provide — your age, gender, year in school, school, and major. On their own these aren't health data, but they're attached to your answers, so we treat the whole record as health data.
Your email address and name, if you choose to give them. Both are optional. You see your full score either way.
When you took it — a submission timestamp.

We do not collect:

Your IP address as a stored record (we use it momentarily to prevent abuse, then discard it)
Your precise location
Biometric data
Anything about you from outside the assessment itself

Where it comes from

One source: you, directly, through the assessment form. We don't buy data, receive it from data brokers, pull it from other services, or infer it from your browsing.

Why we collect it

To give you your results. Your answers produce your score and the feedback you see. This is what you asked us for, and we can't do it without your answers.
To send you your report, if you gave us your email.
To build a research dataset. We use responses to improve the assessment and to develop a clearer picture of college student sleep. We may publish summary statistics — for example, “the average social jet lag across College Sleep Score takers was 2.1 hours” — but never anything that could identify you.
To send you sleep-related content, if you separately opted in to that. You can unsubscribe from any email.

We won't use your health data for a new purpose without telling you and getting your consent first.

Who we share it with

We don't share your consumer health data with anyone. Not with advertisers, not with other companies, not with your school.

We do use service providers to run the assessment. They process data on our instructions only, under contract, and can't use it for their own purposes:

Supabase — database. Stores your responses.
Vercel — hosting. Serves the website.
Klaviyo — email. Receives your email address and a summary of your results (score, band, key demographics) if you gave us an email, so we can send your report.
ImprovMX — email forwarding. Routes mail sent to our addresses.

Under Washington law these are processors, not third parties — but we'd rather you just know who touches your data.

We do not sell it

We have never sold consumer health data and we don't intend to. Washington law requires a signed authorization from you before any sale. We've never asked for one and don't plan to.

Your rights

You can do any of these, free, at any time, by emailing privacy@collegesleepscore.org:

Confirm whether we're collecting, sharing, or selling your consumer health data.
Access your data, along with a list of every third party and affiliate we've shared or sold it to and how to contact them.
Withdraw consent to our collecting or sharing your data.
Delete your consumer health data. When you ask, we delete it from our systems — including backups — and notify our processors to do the same.

We'll respond within 30 days.

If we say no, we'll explain why and tell you how to appeal. To appeal, reply to our decision and we'll review it again. If we deny your appeal, you can file a complaint with the Washington State Attorney General at atg.wa.gov/file-complaint.

Age

The assessment and the Sleep Routine Builder are for people 18 and over. We ask your age before you begin and don't collect data from anyone under 18. Our articles and guides are open to everyone and collect nothing.

Security

Encryption in transit (HTTPS), encryption at rest, and access limited to the people operating the assessment. No system is perfectly secure. If we learn of a breach affecting your data, we'll notify you.

Changes to this policy

If we change anything material, we'll update the effective date above and, if it's significant, email people we have addresses for.

How to reach us

For any privacy questions: privacy@collegesleepscore.org

The College Sleep Score LLC
4539 N 22nd St, Suite N
Phoenix, AZ 85016