Consumer Health Data Privacy Policy
Effective date: October 3, 2026
This Consumer Health Data Privacy Policy supplements our main Privacy Policy and explains how SAAI Retail OÜ handles consumer health data covered by U.S. state consumer-health or sensitive-data laws, including Washington and Nevada law and, where applicable to the processing concerned, Connecticut law.
This Policy does not mean that Sleep Anatomy is a healthcare provider or that information provided through the store becomes a medical record. Sleep Anatomy is an ecommerce retailer.
Consumer health data covered by this Policy
Depending on the interaction, consumer health data can include information that identifies or can reasonably be linked to a consumer and relates to health status, symptoms, bodily functions, health conditions or inferences concerning those subjects.
Examples relevant to our store can include information about neck pain or stiffness, shoulder or back tension, headaches, tingling or numbness, sleep-related discomfort, allergies or similar concerns when that information is actually transmitted to us.
Pillow Finder
The Pillow Finder asks questions about sleeping position, comfort preferences and health-related concerns in order to provide on-page guidance.
Your Pillow Finder answers remain in your browser. They are not transmitted to SAAI Retail OÜ, Shopify, analytics providers or advertising providers and are not used to create a consumer health profile.
Because those answers are not received by us, they are not stored in our customer, order, support, analytics or advertising systems.
Consumer health data we receive
We do not ask customers to provide medical records or diagnoses as part of an ordinary purchase.
We receive consumer health data only when a consumer voluntarily communicates health-related information directly to us in a customer-support, safety, product complaint, warranty or similar request where that information is included in the consumer's communication.
Please do not send medical records, diagnostic reports or other health information that is not necessary for us to handle your request.
Sources of consumer health data
Consumer health data that we actually receive comes directly from the consumer who chooses to include it in a communication with us.
We do not purchase consumer health data from data brokers and do not obtain consumer health profiles from advertising providers.
Why we process consumer health data
When consumer health data is included in a request you send us, we use only the amount reasonably necessary to:
- respond to the request you initiated;
- investigate a product, safety or quality concern;
- administer a return, refund or written warranty where the information is genuinely relevant;
- maintain records required for a specific legal claim or regulatory obligation; or
- comply with law or respond to a lawful governmental request.
We do not use consumer health data for targeted advertising, advertising audience creation or marketing personalization.
Sharing consumer health data
We do not sell consumer health data.
We do not disclose consumer health data to advertising or analytics providers.
Where necessary to handle the consumer's requested service or comply with law, consumer health data is disclosed only to the minimum appropriate recipient categories:
- customer-support service providers acting on our instructions where necessary to operate the support channel;
- professional advisers where necessary for a specific legal, safety or regulatory matter; and
- governmental, regulatory or law-enforcement authorities where disclosure is required by law.
We do not share consumer health data with affiliates.
Third-party collection across websites
Our advertising and analytics technologies are configured so that Pillow Finder health or symptom answers are not transmitted to those providers and are not available to them for collection over time or across websites from the Pillow Finder.
Ordinary browsing information unrelated to consumer health data is addressed in our Privacy Policy and Cookie Policy.
Consent
Where consumer health information is necessary to provide a product or service that you specifically requested, we limit processing to that purpose.
Where applicable law requires affirmative consent for another collection or use, we obtain that consent before the additional processing begins.
We do not share consumer health data in a manner that requires a separate Nevada sharing consent unless that separate affirmative and voluntary consent has first been obtained.
We do not sell consumer health data and therefore do not request authorization to sell it.
Your Washington consumer health rights
If Washington's My Health My Data Act applies to consumer health data concerning you, you can:
- confirm whether we are collecting, sharing or selling consumer health data about you;
- access consumer health data we hold about you;
- request information about third parties or affiliates with which it was shared or sold;
- withdraw consent to collection or sharing; and
- request deletion.
Submit a request to info@sleepanatomy.co with the subject line Consumer Health Data Request. We will respond with any authentication steps needed through a secure channel.
We respond without undue delay and within 45 days after receiving the request. Where reasonably necessary because of complexity or the number of requests, we can extend the response period once by an additional 45 days and will tell you within the initial period why an extension is needed.
If we refuse to act, you can appeal by replying to the decision or emailing info@sleepanatomy.co with the subject line Consumer Health Data Appeal. We respond to the appeal in writing within 45 days. If an appeal is denied, we provide the route for contacting the Washington Attorney General.
Your Nevada consumer health rights
If Nevada's consumer-health-data law applies to information concerning you, you can request that we:
- confirm whether we collect, share or sell consumer health data about you;
- provide the required information concerning third parties to which data was shared or sold;
- cease collecting, sharing or selling the consumer health data; and
- delete the consumer health data.
Submit a request to info@sleepanatomy.co with the subject line Consumer Health Data Request. We will respond with authentication steps through a secure channel.
We respond no later than 45 days after authenticating the request. Where reasonably necessary because of complexity or the number of requests, the period can be extended by up to 45 additional days, with notice during the initial period.
For an authenticated Nevada deletion request, qualifying consumer health data is deleted from our active records and network within 30 days and applicable recipients are notified of the deletion request. Data that exists only in a backup or archive is handled within Nevada's statutory backup period, which does not exceed two years.
If we refuse a Nevada consumer-health request, you can appeal by replying to the decision or emailing info@sleepanatomy.co with the subject line Consumer Health Data Appeal. We respond in writing within 45 days. If the appeal is denied, we provide contact information for the Nevada Attorney General.
Connecticut sensitive health information
Where the Connecticut Data Privacy Act applies because we process a Connecticut consumer's sensitive health information, we obtain consent when that law requires it, provide the applicable consumer rights and do not process the information for an incompatible purpose without the legally required permission.
A Connecticut privacy request can be sent to info@sleepanatomy.co. The ordinary response period is 45 days, subject to the extension allowed by law. If a request is denied, our response explains the appeal route, and a valid appeal is answered within 60 days.
Deletion and retention
Consumer health information contained in an ordinary support matter is kept for 12 months after the matter closes unless a shorter deletion requirement applies or a specific complaint, legal claim or regulatory obligation requires a different treatment.
Minimal records needed to document a consumer-health request, authentication, consent, withdrawal, deletion or appeal are kept for 3 years after the matter closes or consent is withdrawn, without retaining the underlying health details when they are no longer needed.
A valid statutory deletion request takes priority over an ordinary operational retention period except for information that a specific legal exception permits or requires us to retain.
Security
We restrict access to consumer health data to personnel and service providers for whom access is reasonably necessary for the purpose for which the information is processed.
We maintain administrative, technical and organizational safeguards appropriate to the nature and sensitivity of the information.
Changes to this Policy
If we materially change the categories of consumer health data we collect, the sources, purposes, processing or recipients, we update this Policy and obtain additional consent before the new collection, use or sharing where applicable law requires it.
The current effective date appears at the top of this page.
Contact and requests
SAAI Retail OÜ
Viru väljak 2, 10111 Tallinn, Estonia
Email: info@sleepanatomy.co
For a consumer health data request, use the subject line Consumer Health Data Request. For an appeal, use Consumer Health Data Appeal.