How we handle health information

Effective September 20, 2026

Some of that is about your health, including your mental health. This page explains what happens to it. It sits alongside our main Privacy Policy and adds detail specific to health information.

We are not a doctor, a clinic, an insurer or a health plan, and we are not part of anyone’s medical record. rippedoffworker is a record you keep for yourself.

What health information can end up here

Only what you choose to write or upload. We never collect it from anywhere else, and we never buy it, receive it from another company, or infer it about you.

In practice it might include:

• Something you write in How you’re treated — how a shift affected you, being made to work while unwell, the effect of being kept back or sent home
• A note about stress, exhaustion, sleep, or the toll a job has taken
• A photograph or document you upload that happens to show or mention health information
• Anything health-related you write in a note or an entry

We do not tag any of this as “health information” behind the scenes, and we do not sort or classify your record by it. Your entries are your entries.

We ask before we store it

When you create your account we ask, in a separate tick box, whether you agree to us storing health-related details you write in your record. That box is never ticked for you, and it is never bundled into accepting our Terms.

If you say yes, we record the date and the version of this page you agreed to, so we can both tell later exactly what was agreed and when.

If you say no, the app works normally and nothing you have already written is affected. We simply stop asking you for health details.

You can change your answer at any time in Settings. Changing it adds a new entry to your consent history rather than replacing the old one — nothing in that history can be edited or removed from inside the app, by you or by us, so what you agreed to and when stays provable. Deleting your account removes the history along with everything else.

Who can see it

Only you.

Your record is protected at the database level, not just in the app — the rules are enforced by the database itself, so one account cannot read another account’s rows even if the app were asked to. Photographs and files are stored privately and can only be opened through short-lived links generated for your account.

Your employer is never notified. Nothing leaves your account unless you send it. We do not contact anyone on your behalf, ever.

Our staff do not browse customer records. Access to production systems is limited to what is needed to run the service.

Two companies hold your health information for us, and only because the service cannot run without them. Supabase holds the database and the files, in the United States. Cloudflare holds the daily backup, also in the United States, and that copy is encrypted before it leaves us, so Cloudflare cannot read it. Neither is allowed to use it for anything but running the service. Nobody else has it, and we never sell it and never share it for advertising.

Before you create an account

What you enter before you have an account is different, and it matters most on a shared or work computer.

Those answers are saved in your own browser, on the device you are using, so you can come back to them. They never reach us. That means we cannot encrypt what we never receive, and we do not claim to — but it also means anyone else who uses that computer could open them.

There is a Clear what I’ve entered link on those screens. Use it if you are on a work or shared computer. When you create an account, the browser copy is deleted automatically once your answers are safely saved.

How it is protected

Information stored on your account is encrypted in transit and at rest by our hosting providers.

We say this only about information that has reached our servers. See the section above for what stays on your own device.

Please don’t use a work computer for this

If your employer provides or manages the computer or phone you are using, they may be able to see what you do on it — the sites you visit, and in some setups far more than that. That is true of any website, not just this one, and there is nothing we can do about it from our side.

Use your own phone or your own computer. It is the single most useful thing you can do to keep this private.

If you are on a shared computer — at home, at a library, anywhere someone else uses — sign out when you finish. Staying signed in leaves your record reachable by the next person to use that machine.

What we never do

• We never sell your information. Not health information, not anything else.
• We never share it for advertising. There are no advertising or tracking pixels anywhere in rippedoffworker — no Meta, Google Ads, TikTok, LinkedIn, Snap or Pinterest tags. This is not a policy we intend to follow; it is a fact about the code.
• We do not run analytics that can see your health information. We count page views on our public pages with Vercel Web Analytics, and it is switched off entirely inside the app — so no analytics event is sent from any screen where your health information lives.
• We never use your information to train AI models.
• We never contact your employer, or anyone else, on your behalf.

How long we keep it

We keep your record for as long as your account exists, because that is the point of it — documenting how you are paid can run for a year or more, and a record you cannot go back to is no record at all.

If you have not paid

We delete an unpaid saved record after 180 days without using it. The clock runs from the last time you used it — signing in, or adding or changing anything in your record — not from the day you signed up. Anything you do resets it, and we do not send a warning before it happens.

If you have unlocked your record

You can delete your whole account at any time from Settings. That removes your record, your logged shifts, your pay packets, your uploaded files, your reports, your notes and your consent history, permanently. We will offer you a download of your own record first, because it is yours. Deletion cannot be undone.

One copy outlives it for up to seven days: the encrypted daily backup. Anything you delete — including a photograph or a note about your health — can still be in that copy for a week, and then it is gone. Backups older than seven days are deleted on every run, so there is no copy of your record anywhere older than a week. The company that stores it cannot read it.

Your record of agreeing

The record of you agreeing to this page is kept differently from everything else, and it is the one thing that outlives your saved record. It cannot be edited or deleted — not by you, and not by us — because an agreement that could be altered afterwards would not be worth anything to you. If your unpaid record is deleted after 180 days, the note that you once agreed stays; if you delete your whole account, it goes with everything else.

It records the date, and which version of this page you were shown. Nothing about your health is in it.

Where your information is stored

Our databases and file storage are hosted in the United States, and the encrypted daily backup is kept in the United States too.

Changes to this page

If we change how we handle health information, we will change the effective date at the top and ask for your agreement again where that is appropriate. Your previous agreements stay on record with the version they applied to.

Contact

Questions about anything on this page: privacy@rippedoffworker.com

rippedoffworker is operated by Highfield Digital, Inc.
3801 N Capital of Texas Hwy, Ste E240-4005, Austin, TX 78746