Consumer Health Data Privacy Notice

RUB is operated by Ming Liu, an individual, under the bear.ai product name. RUB is a social game, not a health service. People may nevertheless choose to mention physical or mental health, symptoms, treatment, medication, reproductive or sexual health, or similar information in a message, post, profile, report, voice note, or support request. If that information is linked or reasonably linkable to a person, we treat it as consumer health data for this notice.

RUB does not derive biometric identifiers from photos, videos, voice, typing, or movement. Device coordinates are converted to city and country on the device and discarded; we do not use precise location to infer a visit to a health facility.

The source is normally the person who submits the content, although another user may mention someone else. Automated moderation and crisis-safety systems may infer that content concerns self-harm or another safety issue. We process this information only as needed to provide the social or AI interaction the user requested, transmit and store their content, moderate abuse, show crisis resources, secure the service, respond to a request, or comply with law.

Do not put sensitive health details in RUB unless they are needed for the conversation. AI characters are not medical professionals and should not be used for diagnosis, treatment, or crisis care.

Access is limited to personnel and processors that need it for those purposes. Categories include cloud hosting and storage providers; AI routing and model providers used for the requested bot response, moderation, de-identification, and safety processing; live-audio transport when the user joins an audio room; and support or security providers when needed. The current provider list is at beardata.co/legal/subprocessors.

RUB does not sell or license consumer health data. Commercial dataset delivery is disabled. Before any delivery program is enabled, content identified as consumer health data must be excluded unless a separate, legally valid, buyer-specific authorization is obtained. The ordinary optional dataset switch is not a health-data sale authorization.

• Confirm whether we collect, share, or sell consumer health data about you; access it and receive a list of recipients and their contact mechanism.
• Withdraw consent for collection or sharing that is not necessary to provide a service you requested.
• Delete consumer health data. We will also notify applicable processors and other recipients. Live-system deletion happens through the account-deletion flow; encrypted backups normally expire within 7 days and in every case within the legal backup deadline.

Use the authenticated in-app controls or email hello@beardata.co with the subject “Health Data Request.” We may verify the request through the existing account, do not require a new account, and respond without undue delay and normally within 45 days. A reasonably necessary extension may add up to 45 days with timely notice.

If we refuse a request, email hello@beardata.co with the subject “Health Data Appeal.” We will answer the appeal in writing within 45 days and, if it remains denied, provide a route to the appropriate attorney general. Requests are free up to twice per year unless manifestly unfounded, excessive, or repetitive as law permits.

Health details in user content follow the retention periods in the Privacy Policy. We restrict access to what is necessary, encrypt data in transit and at rest, and require processors to follow our instructions and appropriate confidentiality and security protections.

Operator: Ming Liu. Questions or rights requests: hello@beardata.co. This notice supplements the RUB Privacy Policy and is intended to provide the disclosures required by the Washington My Health My Data Act and similar state laws.