Consumer Health Data Privacy Policy

1Applicability and Scope

This policy applies to residents of Washington State (under the Washington My Health My Data Act, or “MHMDA”), Nevada (under Nevada SB 370), Connecticut, and residents of other states with similar consumer health data privacy laws. As stated in the Privacy Policy, we are not a healthcare provider and do not provide medical services. However, because our Services provide a space to talk through and reflect on your own thoughts, the information you voluntarily share in your Conversation Data may be legally classified as “Consumer Health Data” under these state laws. Any Conversation Data that has been irreversibly de-identified and aggregated in accordance with the security and anonymization standards set forth in the Privacy Policy shall no longer be classified as Consumer Health Data.

We collect Consumer Health Data only after you provide clear, affirmative opt-in consent. We do not share or sell your Consumer Health Data except to processors acting on our behalf, and we would obtain separate authorization before any sharing or sale that requires it under applicable law.

2Categories of Consumer Health Data Collected

The categories of Consumer Health Data we may collect include:

• Information relating to your past, present, or future physical or mental health status that you voluntarily disclose within your conversational Inputs.
• Mood check-ins, mood ratings, and self-reported emotional state that you log through structured features of the Services (such as daily mood tracking), including any related notes and the history and statistics derived from them.
• App Event Data or metadata that could reasonably be used to infer your emotional or mental well-being based on your interactions with the Services.

3Sources of Consumer Health Data

We collect Consumer Health Data exclusively and directly from you, your device, and your interactions with the Services. We do not purchase or acquire Consumer Health Data from third-party data brokers or other external sources.

4Purpose of Collection and Use

We collect and use your Consumer Health Data strictly to the extent necessary to:

• Provide the conversational AI services and features that you reasonably expect and have actively requested.
• Ensure the physical safety of users in emergency situations.
• Detect, prevent, and respond to security incidents, fraud, or technical errors.

5Prohibition on Geofencing

In accordance with the laws of Maine, Nevada, Maryland, Washington, and other applicable states, we do not, and will not, implement or use “geofencing” technology (the use of GPS, Wi-Fi, or other spatial technologies to establish a virtual boundary) within 2,000 feet of any physical location that provides healthcare or mental health services for the purpose of identifying, tracking, collecting health data from, or sending notifications to consumers regarding their Consumer Health Data.

6Sharing of Consumer Health Data

We do not “share” or “sell” your Consumer Health Data as those terms are defined under the Washington My Health My Data Act and similar laws. We do not disclose Consumer Health Data to any third party for that third party's own purposes, and we never share your mood data, the contents of your conversations, or the subject matter of your sessions for cross-context behavioral advertising or any marketing purpose. Any advertising-related sharing described in the Privacy Policy is strictly limited to non-content identifiers and engagement events and never includes your Consumer Health Data.

The only parties that receive Consumer Health Data are our processors and service providers, who act solely on our behalf under written contracts and are not permitted to use it for their own purposes; transfers to such processors are not “sharing” or “selling” and do not require separate authorization. Should we ever intend to share or sell Consumer Health Data in a manner that requires valid authorization under applicable law, we will first obtain your separate, written authorization, distinct from your consent to collect, and you may decline or withdraw it at any time.

We share Consumer Health Data only in the following limited circumstances:

• With Processors / Service Providers:We transmit necessary data to our infrastructure providers (e.g., cloud hosting) and third-party API providers (e.g., our LLM provider) who act strictly as “Processors.” These Processors are contractually restricted to processing the data solely to provide the requested services and are bound by strict confidentiality and “Zero Data Retention” obligations.
• For Legal & Safety Reasons: As detailed in the Privacy Policy, to comply with valid legal processes or address imminent threats to life or safety.

7Washington Consumer Health Data Notice at Collection

This document serves as our Notice at Collection under the Washington My Health My Data Act (MHMDA). We collect Consumer Health Data directly from your inputs. The categories of data collected, the purposes of collection, and your rights to access or delete such data are detailed in this document.

8Your Consumer Health Data Rights

Under the MHMDA, Nevada SB 370, and similar laws, you have the right to:

• Confirm whether we are collecting, sharing, or selling your Consumer Health Data (we confirm that we do not sell it).
• Access a copy of your Consumer Health Data.
• Delete your Consumer Health Data.
• Withdraw your consent regarding our collection and processing of your Consumer Health Data.

When you request deletion of your Consumer Health Data, we delete or irreversibly de-identify it across our production systems, and we also remove or overwrite it in our archived and backup systems on the next scheduled backup cycle, so that it is not retained in backups beyond that cycle.

9Exercising Your Rights

To exercise any of the rights listed above concerning your Consumer Health Data, please email our privacy team at sueta.llc@gmail.com with the subject line “Consumer Health Data Request.” We will authenticate and process your request free of charge within the timeframes required by applicable law (typically 45 days). If we decline to take action on your request, you have the right to appeal our decision following the process and timeframes described in the “Right to Appeal” section of the Mentalyze Privacy Policy.

10Contact