Consumer Health Data Privacy Policy

Last Updated: February 19, 2026
Effective Date: January 18, 2026

This Consumer Health Data Privacy Policy applies to residents of Washington State under the My Health My Data Act (RCW 19.373) and to all POMWELL users who want to understand how we handle health-related information.

POMWELL collects the following categories of consumer health data:

1.1 Mental and Emotional Health Data

• Mood Logs: Daily mood ratings and emotional state records
• Journal Entries: Written reflections containing mental health content
• Anxiety & Stress Indicators: Self-reported stress levels and anxiety patterns
• Assessment Responses: Answers to wellness questionnaires (PHQ-9, GAD-7, etc.)
• AI-Generated Insights: Patterns and observations derived from your entries

1.2 Physical Health Data

• Sleep Tracking: Sleep duration, quality ratings, and sleep patterns
• Energy Levels: Daily energy ratings and fatigue patterns
• Exercise Logs: Activity tracking and workout records
• Nutrition Data: Food logs and dietary patterns (if entered)
• Substance Use: Optional tracking of nicotine, alcohol, cannabis, or caffeine
• HealthKit Data: If authorized, data synced from Apple Health

1.3 Behavioral Health Data

• Meditation Minutes: Mindfulness and meditation tracking
• Breathwork Sessions: Breathing exercise completions
• Coping Mechanism Usage: Which wellness tools you use
• Voice Interaction Data: Transcripts from voice coaching sessions

We collect consumer health data for the following purposes:

• Provide Wellness Services: Display your tracked data and generate personalized insights
• Pattern Recognition: Identify trends in your mood, sleep, and wellness over time
• AI-Powered Recommendations: Suggest wellness tools and activities based on your patterns
• Progress Tracking: Show your improvement over days, weeks, and months
• Correlations: Connect physical health data with mental wellness patterns

We do NOT use your health data for:

• Advertising or marketing to third parties
• Selling to data brokers or other companies
• Employment decisions
• Insurance eligibility or pricing
• Any purpose you have not consented to

Your consumer health data may be shared with:

3.1 Service Providers (Required for App Function)

• Google Firebase (Firestore): Secure data storage
  Privacy: firebase.google.com/support/privacy
• Google Vertex AI (Gemini): AI analysis of your entries
  Privacy: cloud.google.com/terms/cloud-privacy-notice
• OpenAI: Voice coaching features (ephemeral processing)
  Privacy: openai.com/policies/privacy-policy

3.2 With Your Explicit Consent

• Connected Therapist: If you choose to connect with a therapist through POMWELL, they can view your wellness data to support your care (requires your explicit authorization)

3.3 We Do NOT Share With

• Advertisers or ad networks
• Data brokers
• Social media platforms
• Employers or insurance companies
• Any third party for marketing purposes

Under the Washington My Health My Data Act and our commitment to privacy, you have the right to:

4.1 Right to Access

You can request a copy of all consumer health data we hold about you. This includes:

• All mood, sleep, energy, and wellness logs
• Journal entries and AI-generated insights
• Assessment scores and history
• List of all third parties who have received your data

4.2 Right to Delete

You can request deletion of your consumer health data at any time. You can:

• Delete your entire account (Settings → Danger Zone → Delete Account)
• Request deletion by email (see contact information below)

Upon deletion request, we delete user-controlled app data and disable ordinary account access. Clinician-authored records may be retained only when applicable recordkeeping law requires it.

4.3 Right to Withdraw Consent

You can withdraw consent for data sharing at any time:

• Disable AI features in Settings → Privacy → AI Features
• Disconnect from a connected therapist in Settings
• Revoke HealthKit access through iOS Settings
• Contact us to withdraw consent for any specific processing

4.4 Right to Know About Sales

We do NOT sell your consumer health data. We have never sold consumer health data and have no plans to do so.

• Active Account: Data retained while your account is active
• Deleted Account: User-controlled app data is deleted; encrypted backup copies may age out on the schedule below
• Clinician-Authored Records: May be retained for up to 7 years, or longer when applicable law requires it, and are not used for ordinary app features after deletion
• Voice Recordings: Processed immediately and deleted after transcription
• Backup Data: May persist in encrypted backups for up to 90 days

6. How We Protect Your Data

• Encryption at Rest: All data encrypted at rest using the default encryption provided by Google Cloud
• Encryption in Transit: All data encrypted in transit using HTTPS/TLS
• PII Redaction: Personally identifiable information (emails, phone numbers, etc.) is automatically redacted from text before it is sent to AI services
• Access Controls: Your data is only accessible to your authenticated account
• Firestore Security Rules: Database-level protections prevent unauthorized access
• Audit Logging: All transmissions of data to external AI services are logged
• No AI Training: Your data is not used to train AI models by any of our service providers

For questions or to exercise your rights under this policy:

8. Changes to This Policy

We may update this Consumer Health Data Privacy Policy from time to time. Significant changes will be communicated through the app and/or via email. Your continued use of POMWELL after changes take effect constitutes acceptance of the updated policy.