Consumer Health Data Privacy Policy
Confide
Draft v0.1 — not yet published. For review by [LAW FIRM] before launch.
Effective: [DATE] · Last updated: [DATE]
This is a separate document on purpose. Washington's My Health My Data Act requires a distinct consumer health data privacy policy with its own prominent link on our homepage. It covers the same practices described in our Privacy Policy, organized the way the law asks for. Where the two differ, treat this one as controlling for consumer health data.
This policy applies to everyone. We wrote it for Washington and Nevada residents, who have specific rights under state law, but we don't think privacy should depend on where you live — so we apply it to all users.
What we mean by consumer health data
Washington and Nevada define consumer health data broadly: information linked or reasonably linkable to a person that identifies their past, present, or future physical or mental health status — including conclusions drawn by algorithms.
On Confide, that means two things:
- What you write. People come here to say what they're carrying — grief, anxiety, loneliness, a diagnosis, a hard week. That text is health data, and we treat it as such.
- What our screening concludes about it. Before any person reads your entry, wordlists on our own systems — not AI, not a third party — label its subject (up to three of: family, work, money, health, grief, love, loneliness, identity, anxiety, other) and check for crisis signals. Those conclusions are also consumer health data, and we're naming them rather than treating them as internal metadata.
The categories we collect
- The text of entries you write, and of replies you write as a listener
- Subject labels and crisis-signal checks produced by wordlists on our own systems — no AI involved
- Whether an entry was typed or spoken
- If you listen: the areas you said you were willing to sit with, and whether you replied to, skipped, or flagged each entry you saw
We collect no name, account, location, contacts, or advertising identifier, and no payment information. We do not collect biometric data. Voice recordings are transcribed and discarded — never stored. If you choose to be notified when someone replies, we hold the phone number or email you give for that purpose only, stored apart from your entry and deleted automatically once your entry has received its third reply. [CHANGED 2026-08-29 — contact notifications restored; attorney must re-review this policy's collection, consent, and sharing sections against RCW 19.373 before publication.]
Where it comes from
From you, directly. Everything above is either typed, spoken, or chosen by you inside Confide.
From our own processing. The subject labels and crisis-signal checks come from our wordlists reading what you wrote — on our systems, with no AI. We don't buy, license, or receive consumer health data from data brokers, advertisers, social platforms, or any other outside source. There is no other source.
Why we collect it, and how we use it
We collect consumer health data for exactly three purposes:
- To deliver the service you asked for — showing what you wrote to up to three listeners, and returning their replies to you at your entry link.
- To route it appropriately — subject labels let us show an entry only to listeners who said they could sit with that subject.
- To keep people safe — our screening looks for signs of immediate danger. If it finds them, your entry is withheld from listeners, you're shown crisis resources, and our team receives an alert containing the entry's ID, its labels, and the time — and no part of what you wrote.
When a listener reports an entry, a person on our team reads that entry to decide whether it keeps circulating.
We do not use consumer health data for advertising, marketing, profiling, product analytics, model training, or research. We do not use it to build a profile of you — we cannot, because we don't know who you are.
One thing outlives an entry: when an entry is deleted on the regular schedule, its subject labels are kept — detached first from the text, the entry link, and your session, so they no longer describe an identifiable person. What remains is a count of what subjects people bring to Confide. We use those counts to understand what Confide is asked to hold, and for nothing else. Deleting your entry yourself removes its labels along with it.
Who we share it with — and who we don't
We do not sell consumer health data. Ever. We have never sold it, we have no plans to sell it, and we will not sell it. Under Washington and Nevada law a sale would require your signed, specific authorization; we don't intend to ever ask for one.
We do not share consumer health data with advertisers, data brokers, social media platforms, or analytics companies. There are no advertising trackers, analytics pixels, or session-replay scripts anywhere on Confide.
Other users see what you choose to share with them. That's the service: up to three anonymous listeners read your entry and write back. They see your words and nothing else about you.
Service providers process it on our behalf, under contracts that permit them to use it only to provide their service to us:
| Category | Who | What they process |
|---|---|---|
| Hosting | Vercel | Requests to our site |
| Database | [DECIDE: Neon / Supabase / Vercel Postgres] |
Entries, replies, labels |
| Safety screening | No one — wordlists on our own systems, no AI | Nothing leaves us |
| Voice transcription | OpenAI [OPEN: conflicts with the no-AI-at-launch decision (2026-08-21) — local transcription, or voice input waits] |
Your audio, if you speak — discarded after transcription |
| Email delivery (internal alerts only) | Resend | Entry ID, labels, timestamp — never your words |
Any AI provider we use is contractually barred from using your words or your voice to train their models.
We may disclose consumer health data if legally compelled — a valid court order, subpoena, or law enforcement demand we're required to honor — or where the law requires a report (for example, federally mandated reporting of child sexual abuse material). We'll resist overbroad demands and, where we're permitted to, we'll say publicly that they happened. Note the practical limit: what we could produce is text with no identity attached, because that's all we hold.
Your rights
Under Washington's My Health My Data Act and Nevada's consumer health data law, you have the right to:
Know what we've collected, including who we've shared it with. Your entry link shows you everything attached to that entry. For a fuller answer, email us.
Delete it. Open your entry link and choose Delete this entry. This removes the entry, every reply to it, and its screening labels from our live systems immediately. Deletion is permanent and the link stops working. [DECIDE: backup retention and processor-deletion mechanics — promise them only once they're operationally real]
Withdraw your consent to our collection and processing. Deleting an entry withdraws consent for it. To withdraw entirely, delete your entries and clear this site's cookies.
Appeal, if we decline a request. Reply to our decision and it will be reviewed again. If we deny your appeal, we'll tell you how to contact the Washington Attorney General.
How to make a request
Email privacy@confide.app, or use the delete control on your entry link. We respond within 45 days, and may extend once by another 45 days where a request is complex — we'll tell you if that happens. Requests are free.
How we verify a request when you have no account: holding your entry link is the credential. Anyone with that link can delete that entry, which is the trade-off that lets you return from any device without ever giving us an identity. Please don't share it with anyone you wouldn't want reading — or deleting — that entry. For requests not tied to a specific link, we may be unable to verify them, and we'll explain why rather than guess.
Consent
Before your first entry, we show you what happens to it — that a wordlist on our own systems checks it first, that up to three strangers will see it, and that it's never sold or used to train AI — and ask you to confirm. That's your consent to collect consumer health data for the purposes described above. We record which version of this policy you agreed to, and when.
We ask separately if we ever want to do something beyond what's necessary to provide the service you asked for. Today, we don't do anything beyond it.
Things we don't do, stated plainly
- No geofencing. We don't use location data at all, and we do not and will not operate any geofence around any healthcare facility.
- No advertising, ever, on Confide or anywhere else, using anything you wrote here.
- No research use. We don't provide entries to academic or commercial researchers.
- No model training. Not by us, not by our providers.
Employees and contractors
Access to consumer health data is limited to [DECIDE: number] people who need it to operate or secure the service, protected by two-factor authentication, and logged. Our internal tools do not display the text of entries. Everyone with access is bound in writing by the restrictions in this policy.
For Nevada residents
Nevada's consumer health data law (NRS 603A.500–.560) gives you substantially the rights described above: to know what we collect and who receives it, to delete it, and to withdraw consent. We don't sell consumer health data, so no authorization is sought. Requests go to the same address and are handled the same way.
Changes
If we change this policy, we'll update the date above. Where a change materially affects how consumer health data is handled, we'll tell you in the product before it takes effect and, where the law requires it, ask for your consent again.
Contact
privacy@confide.app · [ENTITY NAME], [ADDRESS]
Notes for review — delete before publishing
Statutory checklist (RCW 19.373.020 requires each of these; confirm with counsel that this draft satisfies them):
| Required element | Where it is above |
|---|---|
| Categories of consumer health data collected | The categories we collect |
| Categories of sources | Where it comes from |
| Purposes of collection, including how it's used | Why we collect it |
| Categories of consumer health data shared | Who we share it with |
| List of categories of third parties and affiliates it's shared with | Who we share it with (processor table) |
| How to exercise rights | Your rights → How to make a request |
Also confirm:
- The homepage carries a distinct, prominent link to this document — not only a link to the general Privacy Policy. The statute asks for the link specifically.
- Whether to name Connecticut and other states here or handle them in the general policy. This draft handles them via "we apply this to everyone."
The 45-day backup-purge commitment is operationally real before it's published.Removed 2026-08-21 (Alena) — backup/processor-deletion promises pulled until they're operationally real; inline[DECIDE]marks where they'd return.Whether the appeal process needs a named reviewer given a two-person team — "a different person" must be true.Softened to "reviewed again" 2026-08-21 for the same reason.- The employee-access sentence needs a real number or should be cut.