Consumer Health Data Privacy Policy

This is the Consumer Health Data Privacy Policy for DeeplyHeard. It is a separate document from our Privacy Policy, required by Washington State's My Health My Data Act (MHMDA, RCW 19.373.020). We apply the protections in this document to all users, not only Washington residents.

DeeplyHeard is a peer support platform for people navigating major life transitions. Because the platform involves information about your health-related life experiences, some of the data we collect qualifies as consumer health data under the MHMDA and similar laws.

Under Washington's My Health My Data Act, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies a consumer's past, present, or future physical or mental health status.

On DeeplyHeard, data that qualifies as consumer health data includes: the life event you select during onboarding (such as grief, divorce, illness, or job loss); your current stage within that journey; your program enrollment and progress; your mood logs; and your milestones. These categories are described in more detail below.

Life event and stage: the specific life transition you identified during onboarding (for example, grief and loss, divorce and separation, or serious illness) and your current stage within that journey (numbered 1 through 6). This is used to place you in the right peer support community.

Program enrollment and progress: whether you have enrolled in any structured journey program on the platform and how far you have progressed through it.

Mood logs: a numeric mood score (1 through 5) and an optional short note that you enter when you log a mood check-in, along with your stage at the time of the log.

Milestones: a title, optional note, mood score, and date that you record to mark moments in your journey.

Wellbeing events: aggregated behavioral signals stored in our first-party database, such as completing your first journal entry, clicking a crisis resource, or activating go-dark mode. No personally identifiable information is included in these records beyond a user ID and timestamp.

We collect consumer health data only to operate the service for you. Specifically:

Community placement: your life event and stage are used to place you in a peer support community with others at the same point in the same transition.

Personalized content: your life event and stage determine which journey programs, guided content, and resources are shown to you.

Your personal records: mood logs and milestones are stored for your own reference and are not shared with other users or used for any other purpose.

Platform improvement: wellbeing events (aggregated, no PII) are used to understand how the platform is working and how to improve it. They are not used to profile individual users.

We do not use consumer health data for advertising, behavioral targeting, insurance underwriting, employment decisions, or any purpose other than those listed above.

We share consumer health data with a small number of third parties, only as necessary to operate the platform:

Supabase, Inc. (United States): Supabase stores and processes all consumer health data as our primary database and infrastructure provider. Data is stored in Supabase's US-based infrastructure. See supabase.com/privacy.

Vercel, Inc. (United States): Vercel hosts the platform and handles HTTP requests. Vercel's infrastructure transiently processes data as part of serving web requests. Vercel does not store or have access to consumer health data in any meaningful sense beyond request routing. See vercel.com/legal/privacy-policy.

The following parties do not receive consumer health data: Google LLC (Google Analytics only loads on public marketing pages before a user logs in, and is never loaded inside the authenticated app where health data exists); Resend, Inc. (receives email addresses only for transactional email delivery); Meta, TikTok, Snap, Pinterest, or any advertising or data broker (we have no data-sharing relationship with any of these parties).

We never sell consumer health data. We never share it with advertisers, data brokers, insurance companies, employers, or any party not named in the section above. We never use it for targeted advertising. We never use it to train AI or machine learning models. We never share it with Meta, Google Ads, TikTok, Snap, Pinterest, or any advertising network.

DeeplyHeard does not use consumer health data to implement geofencing around any location. We do not use health data to target, restrict, or monitor users based on their physical proximity to any facility, including health care facilities, mental health providers, pharmacies, or any other location.

You have the following rights with respect to your consumer health data:

Access: you may request a copy of the consumer health data we hold about you. You can download your full data at any time from your profile settings using the "Download my data" option.

Correction: you may correct inaccurate consumer health data. Life event and stage can be updated from your profile. Mood logs and milestones can be edited or deleted from within the app.

Deletion: you may delete your account and all associated consumer health data at any time from your profile settings. Deletion is permanent and takes effect within 24 hours.

Portability: you may export your consumer health data in machine-readable JSON format at any time from your profile settings.

Opt-out of sale: we do not sell consumer health data. If you wish to confirm this in writing, contact us at the email below.

Appeal: if we deny a request related to your consumer health data, you may appeal by replying to the denial notice or contacting us at the email below. We will respond to appeals within 45 days.

To exercise any of these rights, visit your profile settings or contact us at support@deeplyheard.org.

By creating an account and completing the onboarding process, you provide affirmative consent to the collection and use of consumer health data as described in this policy. The collection of your life event and stage is a core part of how the platform works — it is what allows us to place you in a community with others navigating the same transition.

You may withdraw consent at any time by deleting your account. Account deletion removes all consumer health data from our systems within 24 hours and is not reversible.

If we make material changes to how we collect or use consumer health data, we will notify registered users by email at least 14 days before those changes take effect.

For questions about this policy or your consumer health data: support@deeplyheard.org