Health data,on its own page.

Washington’s My Health My Data Act requires any business that collects “consumer health data” from a Washington resident to publish a health data privacy notice that is distinct from its general privacy policy, reachable by its own link. Nevada and Connecticut have similar rules. So this is a separate page rather than a section of the Privacy Policy, which still covers everything else.

These laws define health data very broadly — broadly enough to include an inference about someone’s health drawn from something that is not obviously health data at all. Rather than argue about where the line falls, we have written this notice as though everything below counts.

Two things, and only two.

• Your email address, if you join the waitlist. On its own it says nothing about your health. But WellPal is an app about sleep and daily habits, so joining a list for it could be read as an interest in changing something health-related. We treat it as in scope for that reason and no other. We attach no health information to it, and we infer none.
• Anything you type into Ai4RD. If you describe symptoms, a condition, or a diagnosis, that is health data by any definition. You choose whether to enter it. We never require it.

What we do not collect

No Apple Health data. No biometric data. No precise location, and we do not use geofencing of any kind — least of all around any health care facility, which these laws separately prohibit. No health data bought or received from anyone else. No inferences about your health status drawn from your browsing.

Sources

Directly from you, and nowhere else. You type your email into the waitlist form, or you type a message into Ai4RD. We collect health data from no other source — no partners, no brokers, no public records, no advertising networks.

That strip describes the iPhone app, which is not released. What this website collects today is the short list above.

Purposes

• The waitlist email is used for exactly one thing: to email you when WellPal is released.
• Ai4RD messages are used for exactly one thing: to generate the reply you asked for.

We do not use either for advertising, for profiling, for research, for training models, or for any secondary purpose whatsoever.

We do not sell consumer health data. Not for money, not for anything else of value. These laws require a separate, signed authorisation before any such sale, and we have never sought one because we have never sold and do not intend to.

We share it only with the service providers that make the service work, and only so they can do that job for us:

• Vercel Inc. — hosting, and the private store holding waitlist emails.
• OpenRouter — routes an Ai4RD conversation to a language model to generate the reply.
• Perplexity — runs the searches Ai4RD makes.

That is the entire list, and it is the same list as in the Privacy Policy. We have no affiliates. No one else receives this data unless the law compels it.

If you are a Washington, Nevada or Connecticut resident — and, because drawing the line by state seems petty, anyone else who asks — you have the right to:

• Confirm whether we hold consumer health data about you, and access it.
• See the list of third parties and affiliates we have shared it with. It is in §IV, and it is complete.
• Withdraw consent to our collection and sharing of it.
• Have it deleted — including from our service providers, whom we will instruct accordingly.

How

Email privacy@wellpal.io and say what you want. Writing from the address you signed up with is enough for us to find your record.

We respond within 45 days, and will tell you if we need the extension the statute allows. If we refuse a request we will tell you why and how to appeal; if we deny an appeal we will give you a link to submit a complaint to your state Attorney General.

For Ai4RD there is usually nothing for us to delete, but be precise about why. Your message does pass THROUGH our server on its way to the provider that generates a reply — it has to, or there would be no reply. What we do not do is keep it: nothing is written to a database or a log, and the conversation is stored only in your own browser. Clearing your browser data deletes it outright. So a deletion request will usually get an honest “we hold nothing of yours” rather than a performance of deleting something we never had.

If we change what we collect or who we share it with, we will update this page and the revision date before the change takes effect.

You can complain to us at privacy@wellpal.io, or directly to the Washington State Attorney General (opens in a new tab) — you do not have to come to us first.