Consumer Health Data Privacy Notice
Effective: October 19, 2026
This notice supplements the Privacy Policy. It describes information that can identify a person's health status when you choose to supply it to Power, including rights under Washington and Nevada consumer-health laws where they apply. It is not permission to submit every kind of sensitive information. Power is for adults and is not a medical service.
Power is operated by Azamat Smailov, a sole proprietor carrying on business as GENZAI in Toronto, Ontario, Canada. Our Privacy Officer is the same person. Contact privacy@power-extension.com; our postal and telephone contact details are in Privacy Policy, section 13.
Information and sources
Power does not ask for a health profile. Information you supply can nevertheless include:
- health conditions, symptoms, treatment, medication, mental health, reproductive or sexual health, disability, or attempts to obtain health services, in a request, attached material, approved page excerpt or support message;
- visual information in a reference picture or approved screenshot that reveals health information, and pictures of identifiable people where applicable law treats processing as biometric or consumer health data;
- local records of a health-related app, and personal information you deliberately include in a private diagnostic file you choose to share with support;
- request and service records linked to the use of a feature, such as time, outcome and identifiers. A health-related website address or context can itself reveal health information.
Sources are you, material you deliberately attach, pages you authorize an app or page tool to read, the local records you choose to use, and people who contact us for support or a privacy request. We do not buy consumer health data or collect past browser history for this purpose. Keeping records inside a local app is different from asking its AI feature to process them. We do not claim that every picture is health data or that not identifying a face eliminates all biometric rules at an AI provider.
Purposes, processing and recipients
We handle supplied information to carry out the specific tool, AI or support task you request, review permitted image/video requests for safety, secure the service and respond to rights requests. Power does not use consumer health data for advertising or sell it. It does not create health profiles for advertising or use geofences around health facilities.
| Operation you choose | Information involved | Recipients |
|---|---|---|
| Build, Plan or an app's text AI | The request and relevant information deliberately supplied for that task | Power's managed service, OpenRouter and an eligible Anthropic, Google or OpenAI service |
| Image creation | Description and optional approved reference picture | Power's managed service, OpenRouter and Google for safety review and creation |
| Video, where enabled | Description, settings and up to four approved reference pictures | Power's managed service and OpenRouter; Google for safety review and ByteDance for creation |
| A support or privacy request | Information you choose to send, including an optional diagnostic file | Power's authorized support/privacy personnel; Supabase for service records and Resend for requested replies |
Power has no affiliated companies receiving consumer health data. Black Forest Labs and ByteDance are named as possible future image providers in the Privacy Policy; neither receives image-creation requests today. New categories, recipients or purposes require the notice and choices applicable to that change before the change begins.
Managed text, image and safety-review requests use a no-training routing restriction; this is not a promise of no retention. Video has no no-training option: ByteDance may retain descriptions and pictures and use them to improve its services under its own terms. Power has not verified a fixed retention period or processing country for that video service. OpenRouter retains a finished video so it can be retrieved; video is not eligible for zero-retention routing. See Privacy Policy, sections 5–7 for provider retention and transfers outside Canada. Power's servers do not keep image/video descriptions, reference pictures or finished media; usage/security records and material you separately send to support have different retention.
Optional website analytics is described in the Cookie Policy. We do not send health requests, app content, form contents or extension activity to analytics, and do not authorize an analytics provider to build a cross-site health profile. Other websites you open have their own practices; Power does not control their independent collection.
Choice and withdrawal
Where consent is required, it must be specific and obtained before the relevant collection or sharing. Sharing consent, when required, is separate from collection consent. Processing strictly necessary for a service you request is assessed separately; a provider's own further purpose is not automatically necessary to provide that service. A general acceptance of Terms or this notice does not supply those choices.
You can decline an AI request, stop future requests and revoke app permissions in Power. A video already submitted may finish remotely. To withdraw consent concerning information already sent, or to ask Power to stop collecting or sharing it, email our Privacy Officer. We will identify the relevant records and recipients, explain any limits and carry out the applicable request. Withdrawal does not automatically remove existing local records or downloaded files.
Access, deletion and appeals
Email privacy@power-extension.com with your request. Ask whether we collect or share consumer health data about you, for access and a copy, the third parties/affiliates involved and their active contact details, correction where available, withdrawal or deletion. You may also request help concerning a picture someone else supplied. Do not email a health record, government identity document or full diagnostic file just to start a request. We request only the information reasonably needed to verify identity and scope. You do not need to create a new account.
We respond without undue delay under the applicable law. Washington requests have an initial 45-day period from receipt, including verification; a necessary extension of up to 45 days is explained during that first period. Nevada ordinarily requires a response within 45 days after authentication and deletion/downstream notice within 30 days after authentication. A necessary Nevada response extension is explained within the initial response period. We provide the applicable free responses and explain any lawful refusal or exceptional fee.
For an authenticated deletion request we address our records and notify the recipients with whom we shared the relevant consumer health data. We track their responses; we do not describe a forwarded request as confirmed deletion. We explain retained records, applicable exceptions and backup delays. Washington's applicable backup delay cannot exceed six months after authentication; Nevada permits a different maximum for archived/backup systems. Local app records can be removed on your device; files saved elsewhere remain under your control.
To appeal a refusal, reply to the decision or email the same address with Privacy appeal. We provide a reasoned written appeal response within 45 days, including the applicable regulator route if we refuse. You may contact the Washington Attorney General or the Nevada Attorney General directly. Exercising a protected right does not result in discrimination.
Changes and contact
We post a dated revision and explain material changes through the Privacy Policy change summary and, where required, an account notice and fresh choice. Posting this notice does not activate a feature or authorize incompatible processing. For concerns or requests, contact privacy@power-extension.com.