Consumer Health Data Privacy Policy

Who this is for

This notice is for residents of Washington, whose My Health My Data Act applies to us, and residents of Nevada, whose consumer health data law works in a similar way. If you live elsewhere, everything here still describes how we behave. Nothing in this notice takes anything away from our Privacy Policy, which continues to apply in full.

What we collect that these laws may cover

• What you write, when you send it to an AI feature. You decide what to write and whether to use an AI feature at all. What you write may touch on health. We store it only in encrypted form and cannot read what we store. When you use an AI feature, your device unlocks what that request needs and sends it through our AI proxy to our AI provider, as described in Section 5 of the Privacy Policy.
• A risk classification derived from a message.Messages sent to certain AI features pass through an automated check that decides whether to show supportive resources. When it flags something, we store a record holding a category, a severity, and the action taken. We never store your words or the check’s reasoning. This derived classification is the clearest example of something these laws would call consumer health data.
• Which guided program you chose. Guided programs are named, and the name is stored in a form we can read, so we can tell that an account is working through a program on a topic such as grief or sobriety. We also store which general approach the AI selected for it. What you write inside the program stays encrypted.

Where it comes from

Some of it comes directly from you: what you type, and the features you choose to use. The rest we derive ourselves from those inputs, using automated systems. The safety classification and the approach chosen for a guided program are both things our software works out, not things you told us. We do not buy health information, we do not receive it from data brokers, and we do not gather it from anywhere else about you.

Why we process it

Only to provide what you asked for. That means running the AI feature you chose, deciding whether to show you supportive resources, running the guided program you started, keeping the Service secure, and meeting our legal obligations. We do not use it to build advertising profiles or to target advertising, and we do not use it to make decisions about your employment, housing, credit, insurance, medical treatment, legal rights, pricing, or any other similarly consequential opportunity or service.

Who we share it with

Content you send to an AI feature goes to Anthropic PBC, our AI provider, which processes it for us in order to generate a response, and to Cloudflare, Inc., whose edge network our AI proxy runs on. It reaches them only because you chose to use the feature.

The stored classification records and program selections sit in our database, hosted by Supabase and served through Vercel. Those providers hold the data for us; they do not use it for their own purposes.

We do not sell consumer health data, and we have never sold it. We do not share it for advertising. If that ever changed we would need your signed authorization first, and we would ask for it separately rather than folding it into anything else.

Your rights

You may:

• Confirm and access the consumer health data we hold about you.
• Get a list of the third parties and affiliates we have shared it with.
• Withdraw consent to its collection and sharing. Turn AI features off in your account settings, or write to us, and we will stop authorizing new consent-based AI requests for your account. Withdrawing does not undo processing that was already lawful, and it does not by itself delete what we already hold, so use the deletion right below if that is what you want. If you used the signup flow without creating an account, write to us and we will handle it, since there is no account setting for you to change.
• Delete it. You can delete your account yourself at any time. You can also ask us to delete just the health-related records and keep your account. When we get a valid deletion request we delete the consumer health data we can associate with you, and we tell our processors to do the same where the law requires it. Copies inside encrypted backups go when that backup expires. Information that has been reduced to aggregate counts, and no longer says anything about a person, may remain.
• Appeal if we decline a request. We will tell you why, and how to appeal, and you may also contact your state Attorney General.

To exercise any of these, email hello@kindmind.com. We will respond within the time the law allows, and we may need to verify your identity through the email address on your account. Exercising any of these rights costs you nothing and will never get you a worse version of the Service.

For Nevada residents

Nevada’s law asks for a few things in its own words, so here they are plainly.

How we process consumer health data. We transmit what a feature you asked for needs to the service providers named above, and we store the limited classifications, program selections, and records described in this notice. We do not sell it.

Review and correction. Nevada residents may ask to review the consumer health data we hold and ask us to correct anything inaccurate. Email hello@kindmind.com and we will handle it.

Changes to this notice. If we make a material change, we will email you where we have your address and post a notice on this page before it takes effect.

Third-party collection over time and across sites. We do not let any third party collect consumer health data through the Service over time or across other websites and services.

How long we keep it, and how it is protected

Retention and security are described in Sections 12 and 13 of the Privacy Policy. In short: what you write is encrypted with a key we do not hold, classification records live as long as your account does, the operational copies that carry no account identifier are kept no more than 90 days, and deleting your account removes them.

One thing worth repeating

The automated safety check is not a monitoring service and nobody at KindMind reads your writing. The check is not infallible, in either direction. If you are in crisis, please contact emergency services or a crisis line where you live. In the US you can call or text 988. KindMind cannot contact anyone for you.

Contact

KindMind Labs LLC
Email: hello@kindmind.com