Consumer Health Data Privacy Policy

This policy supplements our Privacy Policy and provides the disclosures required by Washington’s My Health My Data Act and Nevada consumer-health-data law. Gentleward is not a health-care provider and is not generally covered by HIPAA.

Consumer health data we collect

Depending on what you choose to use, this includes self-described autonomic or emotional states; feelings, glimmers, triggers, sensory preferences, habits and practices; focus, sleep-adjacent or daily-rhythm information; journal, gratitude, reflection, forgiveness, and intention text; inferred patterns generated locally by service features; optional check-in location; and information indicating that you sought or used a wellness feature.

Sources and purposes

Data comes directly from you, from a person you expressly authorize to submit an observed check-in, and from your use of requested features. We collect it to record and display your entries, provide histories and patterns, synchronize devices, support reminders and connections you choose, secure the service, and provide support. This processing is necessary to provide the product you request. We will obtain affirmative consent before adding a materially different category or purpose not necessary to provide a requested feature.

Sharing

Categories shared may include account identifiers, content, wellness entries, location, and technical data, but only as necessary with infrastructure processors: the DigitalOcean-hosted application/database environment, Cloudflare R2, Resend, GitLab error tracking, and Apple services when you request maps or push features. Stripe processes billing information but does not receive wellness content. Configured AI processing uses a Gentleward-managed Ollama runtime with Meta Llama 3.1 8B within Gentleward-controlled infrastructure rather than sharing prompts with a hosted AI provider. A current list and contact mechanisms appears on our Subprocessors page.

We also share data with another Gentleward user only when you deliberately connect, set visibility, join a shared garden or focus session, share a habit, or otherwise direct that sharing. Gentleward does not sell consumer health data and does not use geofences around health-care facilities.

Your health-data rights

You may confirm collection, access or export data, see categories of recipients, correct data, withdraw future collection or sharing, and delete consumer health data. Use Account Settings or email hello@gentleward.com. Deleting an entry withdraws its future use; disabling location, notifications, a connection, or another optional feature withdraws future collection or sharing for that feature. Some requested service functionality cannot operate without the data it is designed to store.

We will authenticate and respond to a request as required by applicable law. If we deny a request, reply “Appeal” within 30 days. You may contact the Washington Attorney General or Nevada Attorney General if an appeal is denied. Deletion from archived backups occurs through the rotation described in the Privacy Policy.