Consumer health data privacy notice
How FluTrack handles the anonymous symptom reports you can send from the home page — what we collect, what we never collect, why, and for how long.
Last updated: October 2026
The short version
A symptom report is anonymous. We keep the symptoms you tick, an age band, your county and the week — never your name, email, exact location, IP address or full ZIP code. Reports are only ever shown back as counts for a county, never below five reports, and never shared with or sold to anyone. Raw reports are deleted after 90 days.
This notice covers the “Report how you feel” feature on flufollower.com. Symptom reports are consumer health data under laws such as Washington's My Health My Data Act, Nevada's SB 370 and Connecticut's consumer health data provisions, so we describe them separately from our general Privacy Policy. FluTrack is not a health-care provider, and HIPAA does not apply to it. Sending a report is entirely optional: you can check your area without sending anything.
What we collect when you send a report
| Collected | Detail |
|---|---|
| How you feel | “Fine” or “sick” |
| Symptoms | Only the boxes you tick: fever of 100°F or higher, cough, sore throat, body aches, fatigue, congestion, headache, chills, nausea/vomiting/diarrhea, loss of taste or smell, shortness of breath — and roughly when they started |
| Optional answers | Age band (0–4, 5–17, 18–49, 50–64, 65+), whether you had a flu shot this season, whether you took a test and its result, and how many others at home are sick |
| Area | Your county and state. If your three-digit ZIP area has more than 20,000 people, its first three digits |
| Time | The calendar day and week of the report — no time of day |
| Abuse check | A one-way scrambled code made from your IP address and a random value that changes every day and is then deleted. It lets us limit reports to a few per day; it cannot be turned back into your IP address, and tomorrow the same connection produces a different code |
What we never collect
- Your name, email address, phone number, date of birth or any account — there are no accounts.
- Your exact location, GPS coordinates, street address or full five-digit ZIP code. If you type a ZIP code, it is used once to find your county and then discarded.
- Your IP address. It is used only to make the scrambled code above and is never stored.
- Any free text. The form has no text box for symptoms or comments.
Why we collect it
For one purpose only: to publish an aggregate community signal — how many people in a county reported this week, and what share described flu-like illness — alongside the CDC's official data. Community reports are self-reported and unverified. They never change the CDC-based level we show, and we never describe them as an outbreak.
How reports are shown
- Fewer than 5 reports in a county for the week: nothing is shown except that there are fewer than five.
- 5 to 19 reports: the number of reports, marked as too few to compare.
- 20 or more: the share of reports meeting the CDC's influenza-like-illness definition (fever plus cough or sore throat).
- “Elevated community reports” appears only with at least 30 reports and a share at least twice the area's usual level.
Counts are recalculated once a day, so no single report changes what anyone sees the moment it is sent. Reports flagged by our automated abuse checks are excluded.
Who we share it with
No one, and we never sell it. Symptom reports are not shared with, sold to, or made available to advertisers, analytics companies, data brokers or any other third party, and they are never used for advertising or to target ads. They are not sent to Google Analytics or any other analytics tool.
The only company that handles the data is our infrastructure provider, Cloudflare, Inc., as a processor acting on our instructions: it hosts the site, stores reports in its D1 database and Workers KV, and runs Cloudflare Turnstile, a privacy-preserving check that the form is being used by a person rather than a bot. Turnstile does not use cookies for advertising and runs only once you start using the report form. The full list of processors is on our vendors page.
How long we keep it
- Raw reports are deleted automatically after 90 days.
- Daily county totals (counts only, with no individual answers) are kept to compare this season with earlier weeks.
- The daily random value behind the abuse-check code is deleted once its day ends.
What stays on your device
After you send a report, your browser stores one entry, ff_last_report, holding only the time you reported. It is used to allow one report per device per week and is never sent to us. Clearing your browser's site data removes it.
Your rights and choices
Consent is required for each report — the box is never pre-ticked — and you can simply stop sending reports at any time. Because a report holds nothing that identifies you, we cannot look up or single out “your” reports later; that is by design. You can still contact us with any request about consumer health data — to ask what we hold, to ask for deletion, or to appeal a decision — at [email protected], and we will answer within 45 days. Raw reports are deleted after 90 days regardless.
Contact
Oak and Main Developers LLC, 2108 N St., Sacramento, CA 95816 · [email protected]
Not medical advice
The information on FluTrack is provided for general informational purposes only and is not a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of a qualified health provider with any questions you may have regarding a medical condition. If you have trouble breathing, chest pain, confusion or bluish lips, call 911.