Privacy Policy — Open Label LLC

1. Who we are

Open Label LLC (“Open Label”, “we”, “us”) is a limited liability company formed in Delaware, USA, located in Wilmington, Delaware. We publish the website at openlabelsupply.com, the iOS application CPAP Tracker, and — in future — CPAP replacement supplies.

For the purposes of the EU and UK General Data Protection Regulation, Open Label LLC is the data controller for the personal information described in this policy. For the purposes of US state privacy laws, we are the business or controller.

This policy covers openlabelsupply.com and the CPAP Tracker app. It does not cover other companies’ websites, apps, or services, including the Apple App Store and TestFlight, which have their own privacy policies.

2. The CPAP Tracker app

2.1 No account, no server

CPAP Tracker does not ask you to create an account, does not ask for your name or email address, and does not sign you in. There is no Open Label server behind the app. Because of that, we do not receive, store, or have any means of accessing what you record in it.

2.2 What the app stores on your device

The app keeps the following in its own storage on your device, and only there:

The nightly figures captured from your machine’s display — for example the hours shown, the pressure shown, and the seal figure shown — together with the date of each entry.
Any notes you choose to type against an entry.
Your replacement schedule: which parts you track, when you marked each one replaced, and the resulting countdowns.
Your app settings, such as text size preferences and reminder times.

The app records what your machine displays. It does not measure, diagnose, treat, or assess anything, and it does not connect to your machine.

2.3 The camera

Scanning uses your device’s camera. iOS asks your permission the first time, and you can withdraw it at any time in Settings → Privacy & Security → Camera. The camera view is processed on your device, in the moment, to read the figures shown on your machine’s screen. Camera frames are not saved to your photo library, are not written to a file, and are not transmitted anywhere. Only the resulting numbers are saved to your log.

2.4 Deleting app data

You can delete a single entry, clear your entire log from within the app, or delete the app from your device. In each case the data is gone from your device, and there is no copy on our side to request the deletion of. If you use iCloud or encrypted iTunes/Finder backups, a copy may exist in your own backup under your own Apple account; that backup is controlled by you and Apple, not by us.

2.5 Diagnostics and App Store information

We do not embed analytics, advertising, attribution, or crash-reporting software development kits (SDKs) in the app. Two limited exceptions come from Apple rather than from us:

Apple diagnostics. If you have turned on Share iPhone Analytics and Share with App Developers in iOS settings, Apple may provide us with crash logs and aggregate performance statistics. These describe how the software behaved — they do not contain your log entries. You can turn this off in Settings → Privacy & Security → Analytics & Improvements.
App Store Connect. Apple gives us aggregate, anonymised statistics such as download counts by country. We cannot identify individual users from them.

2.6 TestFlight beta

If you join the beta, you install the app through TestFlight, Apple’s beta distribution service. We send an invitation to the email address you gave us; from that point Apple operates TestFlight and processes tester information under Apple’s own privacy policy, and we can see tester status and any feedback you deliberately submit through TestFlight. Your app log remains on your device, in beta as in release.

3. This website

3.1 Information you give us

Email sign-up (beta or supplies). Your email address, the list you asked for — recorded as a source tag of site-beta or site-supplies — and the date you signed up.
Contact form or email. Your name, email address, the topic you selected, and whatever you write in your message.

Please don’t send us clinical records or documents you wouldn’t normally email. We only need enough information to answer you.

3.2 Cookies, analytics, and third-party requests

This website sets no cookies. It runs no analytics product, no advertising or social media pixels, and no session-recording tools. Every file the site loads — stylesheet, script, font, icon — comes from openlabelsupply.com itself, so visiting these pages does not disclose your visit to any third party. There is no consent banner because there is nothing to consent to.

3.3 Server logs

Our hosting provider, Vercel Inc., automatically records standard technical information when a page is served: the requesting IP address, the time, the page requested, the referring page if any, and the browser’s user-agent string. These logs exist for security and for keeping the site running. They are retained for a short period in the ordinary course and are not combined with any other information to build a profile of you.

3.4 Do Not Track and Global Privacy Control

We do not sell or share personal information and do not track visitors across sites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour such signals in any event.

4. How we use personal information

To answer your message, and to follow up on it if needed.
To send the TestFlight invitation you asked for, and to tell you about beta rounds.
To email you once when the supply line launches, if you asked for that.
To keep the website secure, available, and free of abuse.
To meet our legal, tax, and record-keeping obligations, and to establish or defend legal claims.

We do not use your personal information to build advertising profiles, to train machine learning models, or for automated decision-making that produces legal or similarly significant effects.

5. Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6(1) GDPR:

Consent — for the beta and supplies mailing lists. You may withdraw consent at any time by unsubscribing or emailing us; this does not affect processing carried out before withdrawal.
Legitimate interests — for answering your enquiries, keeping the site secure, and preventing abuse. Our interest is in running a responsive, secure service, balanced against your privacy.
Legal obligation — where we must keep records or respond to lawful requests.

6. When we share information

We share personal information only with service providers who process it on our instructions, under contract, and only for the purposes above. As of the effective date these are:

Vercel Inc. — website hosting and delivery (server logs, as described in 3.3).
Our email service provider — delivery and storage of mailing list addresses and support correspondence. We will name the current provider on request.
Apple Inc. — App Store and TestFlight distribution, as described in 2.5 and 2.6.

We may also disclose information where we are legally required to do so, where it is necessary to protect the rights or safety of a person, or to a successor entity in connection with a merger, acquisition, or sale of assets — in which case this policy continues to apply to the information transferred, and we will say so on this page before the transfer takes effect.

7. What we never do

We do not sell personal information, and never have.
We do not share personal information for cross-context behavioural advertising.
We do not rent, trade, or hand over mailing list addresses to other companies.
We do not receive your app entries, so we cannot disclose them — to advertisers, to insurers, to employers, to data brokers, or to anyone else.

8. How long we keep information

Mailing list addresses: until you unsubscribe or ask us to delete them, and then removed within 30 days apart from a suppression record that exists solely to make sure we don’t email you again.
Support correspondence: up to 24 months after the matter is closed, so we can pick up a thread you return to, then deleted.
Server logs: retained briefly by our hosting provider for security and reliability.
App entries: kept on your device for as long as you keep them. We hold no copy and set no retention period, because we never receive them.

9. Security

The site is served over HTTPS and sends strict transport security headers. Access to the mailing list and support inbox is limited to people who need it and protected by strong authentication. Because the app keeps your record on your own device, it is protected by your device passcode, Face ID or Touch ID, and iOS file protection — we strongly recommend you use a passcode.

No method of transmission or storage is completely secure, and we do not claim otherwise. If a breach affects your personal information, we will notify you and any relevant regulator as required by law.

10. Your rights and choices

Wherever you live, you may ask us to:

Access the personal information we hold about you, and get a copy of it.
Correct information that is wrong or out of date.
Delete your information.
Port your information to another service in a portable format.
Restrict or object to processing based on legitimate interests, and withdraw consent for the mailing lists.

Email support@openlabelsupply.com and say what you want done. We acknowledge requests within one business day and complete them within 30 days — extendable once, with notice, where a request is complex. We will not discriminate against you for exercising any of these rights, and there is no charge unless a request is manifestly unfounded or excessive.

Verification is usually simple: we respond to the email address the information is held under. You may use an authorised agent, in which case we will ask for written proof of authority. If you are in the EEA or UK you also have the right to lodge a complaint with your local supervisory authority.

11. US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights listed in section 10, and we extend those rights to every US resident regardless of state.

11.1 Categories of information

Under the California Consumer Privacy Act as amended, in the 12 months before the effective date of this policy we collected one category of personal information: identifiers — specifically an email address, and a name if you typed one into the contact form — collected directly from you, used for the purposes in section 4, and disclosed only to the service providers in section 6. We collect no commercial, biometric, geolocation, employment, education, or inference data through this site or the app.

11.2 Sale, sharing, and sensitive information

We have not sold personal information and have not shared it for cross-context behavioural advertising in the preceding 12 months, and we do not do so now. We do not collect sensitive personal information through this site or the app, and therefore do not use or disclose it for purposes requiring a right to limit. Because we do not sell or share, there is no “Do Not Sell or Share My Personal Information” mechanism to operate — the answer is already no.

11.3 California “Shine the Light”

We do not disclose personal information to third parties for their own direct marketing purposes, so there is nothing to report under California Civil Code §1798.83.

12. Health-related information and HIPAA

Entries in CPAP Tracker describe your use of a piece of equipment and can reasonably be considered health-related. That is precisely why the app keeps them on your device and sends them nowhere. We hold no health-related information about you.

Open Label is not a healthcare provider, health plan, or healthcare clearinghouse, and is not a business associate of one. We are therefore not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), and CPAP Tracker is not a HIPAA-regulated service. The app does not use Apple HealthKit and does not read from or write to your Health app.

CPAP Tracker is a logbook and reminder tool. It is not a medical device, and it does not diagnose, treat, or replace your care team or your machine’s own reports.

13. Children

The website and the app are intended for adults. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA and UK). If you believe a child has given us personal information, email us and we will delete it promptly.

14. International transfers

Open Label is based in the United States, and the service providers in section 6 process information in the United States. If you contact us from outside the US, the information in your message is transferred to and stored in the US, where privacy laws differ from those in your country.

Where we transfer personal information out of the EEA or UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) in our agreements with those providers, together with appropriate technical safeguards. You can request details of these arrangements by email.

15. Changes to this policy

If we change this policy we will update the “last updated” date above. For changes that materially affect how we handle your information, we will post a clear notice on this page for at least 30 days beforehand, and email anyone on our mailing list. We will not apply a materially different use to information already collected without asking you first.

16. How to reach us

Privacy questions and requests: support@openlabelsupply.com.

Open Label LLC, Wilmington, Delaware, USA. If you need our postal address for a legal or regulatory matter, email us and we will provide it the same business day.

Read our Terms of Service →