Consumer Health Data Privacy Policy

KindMind Labs LLC operates KindMind and BookPath. This policy describes consumer health data processing under Washington’s My Health My Data Act and Nevada’s consumer health data law. Washington protection can cover both Washington residents and people whose consumer health data is collected in Washington. The rights that apply depend on the relevant law, not solely on where your account was created. This policy supplements our Privacy Policy and controls if the two conflict about consumer health data.

Depending on what you write and use, information may concern physical or mental health, symptoms, conditions, treatment, medication, reproductive or sexual health, substance use, or efforts to obtain health services. Encryption protects stored content; it does not by itself remove data from the scope of these laws. We process the following categories:

• Private content: journal entries, Guide and Path conversations, goals, plans, responses, and AI memories. Private account content is stored encrypted. We store and return it so you can use the Service. AI requests involve readable processing of the content and context needed for the feature, including journal text when Journal memory is enabled.
• Derived information: AI replies, summaries, and plans, plus readable automated safety categories, severity levels, confidence, and actions. These support the requested AI features and their safety controls; a classification is an automated inference and may be wrong.
• Selections and activity: program or book selections, selected approaches, progress, feature activity, timestamps, and related account or request identifiers. These let us operate the selected feature, maintain security, and diagnose service failures. They may suggest a health interest even without revealing what you wrote.
• Communications you address to us: health information you include in support messages, feedback, or a testimonial. These are readable so we can respond or process your submission. Do not include sensitive information you do not want us to receive.
• Delivery and measurement information: page paths, request metadata, and email delivery records that may reveal a health-related topic or activity when linked to you. These support delivery, reliability, security, and traffic measurement.

We do not sell consumer health data or use it for targeted advertising. We do not use it to decide eligibility for employment, housing, credit, insurance, or medical treatment. Collection and sharing require consent unless a relevant exception applies, such as processing necessary to provide a product or service you requested. This notice and acceptance of the general Terms do not replace any separately required consent.

Information comes from you, your device and interactions with the Service, and inferences generated by our software and AI provider from those inputs. It can also come from an older KindMind account you choose to import or correspondence you send us. We do not buy consumer health data from data brokers.

The following recipients process the categories identified below. Some disclosures to contracted processors are excluded from the statutory definition of “sharing”; we describe them here so you can understand where information goes.

• AI processing and routing: Anthropic PBC receives readable AI inputs and context and generates outputs and safety classifications. Cloudflare, Inc. operates the infrastructure for our AI proxy. These requests can include health-related writing and inferences. Provider retention and safety-review exceptions are described in AI Privacy.
• Hosting, database, authentication, and backups: Supabase and Vercel process stored encrypted content, readable account and operational records, and relevant request information. Vercel also hosts application routes that temporarily process selected readable AI context and measures page traffic and performance.
• Encrypted backups: Backblaze, Inc. stores encrypted copies of our database. Each copy is encrypted before upload with a key Backblaze does not hold, cannot be deleted for 90 days, and is then removed automatically.
• Email and support delivery: email delivery providers, including Resend, and the providers handling our support correspondence process recipient details and message contents. Health information you put in an email or support request is not protected from those recipients by your journal encryption.
• Recipients you direct: if you authorize publication of a testimonial, its approved text and attribution can be available to the public. Exported files can be disclosed to people you choose to give them to.
• Legally required recipients and successors: information may be disclosed to public authorities or other recipients where applicable law requires or permits it, or transferred to a successor in a qualifying business transaction subject to the continuing protections required by law. These are not permissions to disregard consumer health data restrictions.

KindMind and BookPath are products of the same LLC, not separate affiliates receiving data from one another. No separate affiliate is identified as a recipient in the processing described here. Contact us for a list of the third parties and affiliates to whom your consumer health data has actually been disclosed, as provided by applicable law.

Email hello@kindmind.com with your request. You do not have to delete your entire account to ask us to act on consumer health data. Depending on applicable law, you can:

• Confirm and access the consumer health data we process about you, and request the statutory list of third parties and affiliates that received it, including contact details where required.
• Withdraw consent or request that processing stop. Turn Journal memory off in the available AI settings to stop new journal context and memory requests. That switch does not disable all AI features or erase existing memories. Contact us for broader withdrawal requests, including requests about signup without an account or a product with no relevant control. Withdrawal does not undo past lawful processing. A feature that needs the withdrawn information may become unavailable.
• Request deletion of consumer health data, including derived records. We must communicate qualifying deletion requests to applicable processors, affiliates, and other recipients as the law requires. Account deletion alone does not immediately clear provider copies, backup archives, or separate email records. Applicable deletion deadlines still apply; under Washington law, any permitted delay for archived or backup data must not exceed six months after authentication of the request. Nevada generally requires deletion within 30 days after authentication and permits a backup or archive delay of no more than two years where necessary to restore that system. These legal limits do not mean that account deletion automatically removes every copy.
• Request review or correction of inaccurate records. We cannot decrypt private content for you; your device can access it using your key. Contact us about other records or controls that are unavailable.
• Appeal a denied request by replying to the denial or emailing the address above with “Privacy appeal” in the subject. We will explain our decision in writing within 45 days after receiving your appeal where Washington or Nevada law applies. You may complain to the Washington Attorney General or the Nevada Attorney General, as applicable.

We may request information reasonably needed to authenticate you or an authorized representative. Do not send your password, recovery key, or private writing to verify identity. We respond within applicable statutory deadlines, explain any permitted extension, and provide requests without charge except where law expressly permits a fee. We do not unlawfully discriminate for exercising privacy rights.

This policy takes effect on September 26, 2026. We process consumer health data by receiving, transmitting, storing, returning, and deriving the information described above. Third-party infrastructure, analytics, and abuse-prevention providers may collect request identifiers and online activity over time and across websites or services that use them; health-related page topics or other activity can constitute consumer health data. This is not limited to advertising. We do not use advertising pixels to target you based on your private writing. Provider processing and retention are described above and in our Privacy Policy.

We will post material changes here and notify you by email where we have your address before they take effect. Before collecting, using, or sharing additional categories, using data for additional purposes, or adding recipients when the law requires a new disclosure and consent, we must provide that disclosure and obtain the required consent.