Washington Consumer Health Data Privacy Policy

Last updated: October 7, 2026

This policy explains how Dimitri Buckner, doing business as Kimbelo, a sole proprietorship ("we," "us") collects, uses and shares consumer health data under Washington's My Health My Data Act (RCW 19.373).

What we collect

We only collect consumer health data when you choose to share it with us, mainly when you report a reaction to one of our products. This can include:

Symptoms or reactions you describe (for example redness, itching, a rash or swelling)
Whether you saw a doctor or received treatment
Health conditions, allergies or pregnancy status you choose to mention
Photos you choose to send
The product, batch or lot number, and when you used it

Where it comes from

Directly from you, through our Report a Product Reaction form, email, phone, social media messages, or product reviews and comments that describe a reaction. If you tell us about a reaction in a review, a social media message, an email or a phone call, we'll reply privately with a link to our reaction form so you can give your consent, and we won't discuss your health details in public replies.

Why we use it, and how

To respond to you and help with your report
To look into the product and batch, and keep the safety records federal law requires
To report serious reactions to the U.S. Food and Drug Administration (FDA) when federal law requires it

We do not use consumer health data for marketing or advertising. We don't sell consumer health data, and we don't use location-based geofencing.

What we share, and who we share it with

What we share: the reaction details, product and lot number, and dates. With the FDA, also a copy of the product label and, if needed, photos of the reaction. We identify you to the FDA only by a case code or your initials. We don't share photos with anyone else unless needed to investigate.

Who receives it:

The FDA, when federal law requires us to report a serious reaction (see the notice below).
The product's manufacturer, only if you tick the optional sharing box. If you don't, we send the manufacturer only the product, lot and type of reaction, without your name or contact details.
Service providers: Shopify (our online store platform, which hosts our contact form, under its data processing terms), Google (Gmail, which we use for customer email), and AI-assisted business tools that help us run the store and answer messages (they may read customer-service messages, including reaction reports, to help us respond, and we don't let them use your data to train their models). We'll move reaction reports to a business email service with a data processing agreement as soon as possible.
Others only with your separate consent.

We don't share consumer health data with any affiliate.

Your consent

Our reaction form has two separate checkboxes:

To collect (required to send the form): "I consent to Kimbelo collecting and using the health details in this report to respond to me, look into the product and batch, and keep the safety records federal law requires."
To share (optional, unticked): "Optional: I consent to Kimbelo sharing these details with the product's manufacturer so it can investigate the batch. If you leave this unticked, we'll send the manufacturer only the product, lot and type of reaction, without your name or contact details."

Prefer not to tick the first box? Email us at hello@kimbelo.com instead. We'll reply with a link to this policy and ask for your consent before we keep your health details.

Serious reactions and the FDA: if your report describes a serious reaction, federal law (21 U.S.C. 364a) requires us to report it to the U.S. FDA within 15 business days, whether or not you tick the optional sharing box. We send the FDA what its form requires and identify you only by a case code or your initials, not your name. The FDA protects these reports from public release.

You can withdraw consent anytime at hello@kimbelo.com. Withdrawing consent doesn't undo a report federal law already required us to send, or the safety record we must keep (see "How long we keep it").

Your rights

You can ask us to:

Confirm whether we collect, share or sell your consumer health data, and get a copy of it
Tell you which third parties and affiliates we've shared it with, and how to contact them
Delete it
Withdraw your consent

When we delete your data, we'll also tell every service provider and company we shared it with to delete it. We aim to finish within 30 days of verifying your request. Copies in backups are deleted as soon as the backup is restored or overwritten, and within 6 months.

How to make a request: email hello@kimbelo.com with the subject "Consumer Health Data Request." We may ask for information to confirm it's you. You don't need an account. Requests are free up to twice a year. We won't treat you differently for using these rights.

We'll respond without undue delay and within 45 days of receiving your request. If we need more time (up to 45 more days), we'll tell you why within the first 45 days.

Appeals: if we deny your request, you can appeal by replying to our decision with the subject "Appeal." We'll answer your appeal in writing within 45 days and explain our reasons. If we deny it, you can file a complaint with the Washington State Attorney General: https://www.atg.wa.gov/file-complaint.

How long we keep it

Federal cosmetics law requires the company responsible for a product to keep a record of each reaction report for 6 years (3 years for qualifying small businesses) (21 U.S.C. 364a(e)) and to report serious reactions to the FDA. If you ask us to delete your data, we'll delete everything that isn't part of that required record. We'll tell you what we kept and why, use it only for product-safety and legal purposes, and delete it when the period ends.