Consumer Health Data Privacy Policy

Last updated: 15 November 2026

This policy is a separate document from our Privacy Notice, as required by Washington’s My Health My Data Act. It describes the two narrow categories of consumer health data that Project Stardust Inc. (“we,” “us,” “our”), including through our Duet by Project Stardust brand, collects, why we collect it, who receives it, how long we keep it, and the rights you have over it.

In short: we collect consumer health data in two narrow cases: an email address and a region – a metro area or a state – that you give us to register interest in a research study; and an expected due date that you can choose to give us when you reserve Duet. We do not sell either. We delete study registrations within 90 days if you are not enrolled, and due dates within 30 days after the date or after your reservation ends. You can ask us to delete either sooner.

1. What this policy covers, and what it does not

It covers two steps on our websites: the registration step on project-stardust.org, at which you give us an email address to express interest in a research study; and the reservation step on wearduet.com, at which you can choose to give us your expected due date.

It does not cover the research study itself. Once you are enrolled, information about you is collected and held inside the study’s own systems under a protocol approved and monitored by an independent institutional review board, and under the informed consent document you sign. That research data is governed by the protocol and by federal human-subjects regulations, not by this policy. My Health My Data Act contains an exemption for information used in such research.

We have written this policy on the basis that the registration email sits outside that exemption, because at the point you give it to us you are not yet enrolled in anything. We would rather be governed by this policy than argue about whether we need to be.

2. What consumer health data we collect

For research study registration, two items, both submitted through the registration form on our study page:

Your email address.
The region you are in – one of three metro areas where the study runs, or, if you are elsewhere, your state. The study involves in-person sessions, so we ask this to tell you straight away whether it can reach you rather than after you have gone through a consent process.

The region is deliberately coarse. The most specific answer the form allows is a metro area, and it is a fixed list of choices rather than something you type. We do not ask for, and the form cannot accept, a street address, a postcode, or any location taken from your device.

Through the study registration form, we do not ask for, and you should not send us, a due date, a medical history, medications, test results, scan reports, or any other health information. Everything the study needs is collected inside the study system after you have reviewed and signed a consent form.

Why this counts as health data. On their own, an email address and a state are not health information. But the page you submit them from is about pregnancy monitoring and states that we are seeking people in the second or third trimester. Submitting them therefore supports an inference about your health. My Health My Data Act treats inferences as consumer health data, so we treat both items in this context as consumer health data, and hold them accordingly.

For Duet reservations, one optional item: your expected due date. When you reserve Duet, you can choose to give it to us so we can tell you whether your device is likely to ship in time to be useful in your pregnancy. You can reserve without it. We ask for your separate, explicit consent before collecting it. A due date is consumer health data in its own right, and we treat it as such. We do not ask for any other health information when you reserve.

Because Duet is a pregnancy product, joining the Duet mailing list or reserving a device may also suggest something about your health. We do not ask whether you are pregnant, and we do not use these sign-ups as a source of health information about you – but we give them the same core protections: we never sell them, never share them with advertisers, data brokers or social media platforms, and our websites use no advertising or analytics trackers.

3. Where it comes from

Directly from you, and only from you. We do not buy consumer health data, we do not obtain it from data brokers, marketing partners or social media platforms, and we do not infer it from your browsing. Our websites set no advertising or analytics trackers on any page.

4. Why we collect it

For study registration, one purpose: to pass your email address to the electronic data capture system used by the study, so that the study team can create your record and the system can send you the informed consent document and, after that, the eligibility questions. The region is used only to work out whether the study can reach you, and to understand where demand exists if we expand.

For a due date given with a Duet reservation, one purpose: to tell you whether your device is likely to ship in time.

We do not use either for marketing or advertising. If you also want to hear from us generally, our mailing list is a separate, optional sign-up and we do not add study registrants to it.

Google LLC, as our processor. The registration form submits to Google Workspace, which we use under a Business Associate Agreement. Google processes it on our instructions and for no other purpose.
The study team, being the named study personnel who create records in the data capture system.
The study’s electronic data capture system, which sends the consent and screening documents.
Lovable, as our processor for wearduet.com, and its sub-processors (including Supabase and Cloudflare), which host the website and the database in which a due date given with a reservation is stored. They process it on our instructions and for no other purpose.

We do not share it with anyone else. We do not disclose it to advertisers, data brokers, affiliates or social media platforms. If we were ever compelled to disclose it by law, we would do so only to the extent required.

6. We do not sell consumer health data

We have never sold consumer health data and we do not intend to. My Health My Data Act requires a separate, specific, written authorization signed by you before any sale may take place. We hold no such authorizations and we do not seek them.

7. How long we keep it

We delete the email address and region you registered with within 90 days, whether or not you go on to take part. It exists only to get you into the study system; once it has done that, it has no further purpose here.

Registration records are held in monthly batches, and each batch is destroyed in full once its oldest entry reaches 90 days. In practice most addresses are destroyed sooner than that — often after around 60 days.
Destruction is automated, and the system checks afterwards that the data has actually gone rather than assuming it. Each run is logged.
If you do go on to enrol, the information collected about you inside the study system is a separate matter, retained under the protocol approved by the institutional review board for the period that protocol specifies. Deleting your registration email does not delete that, and the consent form you sign explains what can and cannot be removed once a study is under way.
We delete a due date given with a Duet reservation within 30 days after that date, or within 30 days of your reservation being cancelled or refunded, whichever is sooner. Each deletion is logged.

8. Your rights

You have the right to:

Know whether we hold consumer health data about you, and get a list of everyone we have shared it with
Withdraw your consent to our collecting or sharing it
Have it deleted, including from our processor’s systems and from anyone we have shared it with
Appeal if we refuse a request
Not be discriminated against for exercising any of these rights. Nothing about your care, or your ability to take part in a study, or your reservation, depends on it

Deleting your registration email means we cannot contact you about the study. Deleting a due date you gave with a reservation does not affect the reservation itself. If you have already enrolled, deletion of your registration record does not remove research data already collected under the protocol — the consent document explains what can and cannot be removed once a study is underway.

9. How to exercise your rights

Email privacy@project-stardust.org. Tell us what you want us to do. We will respond within 45 days, and will tell you if we need a single 45-day extension.

We will ask you to confirm the request came from you, but only using information we already hold. We will not ask you for additional personal information in order to verify a deletion request.

If we refuse. We will explain why in writing, and tell you how to appeal. If you appeal and we still refuse, we will give you a link to submit a complaint to the Washington State Attorney General ↗.

10. Who we are and how to contact us

Project Stardust Inc. is the controller of the consumer health data described in this policy. Duet by Project Stardust is a brand of Project Stardust Inc.

For anything relating to this policy: privacy@project-stardust.org.

For general enquiries: hello@project-stardust.org.

For questions about a research study: research@project-stardust.org.

11. Changes to this policy

If we change how we handle consumer health data, we will update this policy and change the date at the top before the new practice takes effect. Where a change is material and would apply to data we already hold, we will ask for your consent again rather than rely on the original.