Consumer Health Data Privacy Notice (draft)

Draft status and contact

DRAFT: NOT EFFECTIVE. For internal and counsel review only. This text is not an offer, not accepted terms, and not evidence of prior consent. Do not record draft acceptance.

This Notice is provided by Evexia. Privacy and consumer-health requests, withdrawals, deletion requests, and appeals: admin@evexia.living.

No LLC, incorporation designation, or postal address is stated here.

Primary sources for this draft: RCW 19.373.010 (definitions, including inferred/derived health data); RCW 19.373.020 (consumer health data privacy policy and homepage link); RCW 19.373.030 (separate collection and sharing consent when required, with requested-service exceptions); RCW 19.373.040 (rights, requests, refusal, appeal). Chapter index: https://app.leg.wa.gov/RCW/default.aspx?cite=19.373

What “consumer health data” means here (RCW 19.373.010)

Under RCW 19.373.010, “consumer health data” means personal information linked or reasonably linkable to a consumer that identifies the consumer’s past, present, or future physical or mental health status.

That definition expressly includes information a regulated entity or processor associates with such health status when the information is derived or extrapolated from nonhealth information (proxy, derivative, inferred, or emergent data, including by algorithms or machine learning).

“Collect” under RCW 19.373.010 includes buying, renting, accessing, retaining, receiving, acquiring, inferring, deriving, or otherwise processing consumer health data in any manner.

Evexia product inventory that may fall in scope (classification not finally determined): wellbeing assessment answers and scores; optional notes and check-ins about mood, capacity, or how a practice landed; living-profile / personalization evidence derived from those inputs; confirmed signals derived from public links you explicitly ask Evexia to use; Connect message content when it includes health or wellbeing information you choose to share; and derived Connect “pattern” signals if you keep a pattern without retaining a transcript.

Whether Evexia is a “regulated entity” or “small business,” and whether any RCW 19.373.100 exemption applies, is staged for counsel. This Notice does not assert a final status.

Categories collected and purposes (RCW 19.373.020)

Categories we may collect (product inventory): assessment and wellbeing answers; optional reflections and feedback; personalization/derived pattern signals; Connect session wellbeing content you send; account contact needed to respond to your requests.

Purposes: provide the assessment, practice plan, and personalization you request; operate Connect when you use it; security and abuse prevention; respond to privacy requests; improve reliability; comply with law.

RCW 19.373.020 also requires disclosure of categories shared, categories of third parties/affiliates, sources, and how to exercise RCW 19.373.040 rights. Those are addressed in the sections below.

RCW 19.373.020 requires a prominent homepage link to this consumer health data privacy policy. While this Notice remains a draft, it must not be treated as an effective policy.

Sources

Directly from you (assessment, notes, feedback, Connect messages, optional profile details).

From your device as needed to run the app (local session/resume state).

From sign-in providers (Apple, Google, email link) for account email and optional name/photo linked to your account.

From Evexia’s own derived processing (scoring, living-profile evidence, Connect signal heuristics), which may produce inferred associations of the kind described in RCW 19.373.010.

Sharing and recipient categories

Categories that may be shared to operate the service: account identifiers and the wellbeing/Connect content needed for the feature you use.

Recipient categories: Evexia personnel/contractors who need access to operate or secure the service; processors/service providers (Supabase, Vercel, Resend when used); Apple/Google for sign-in; a Connect peer for messages you send; authorities when required by law or to protect safety.

We do not sell consumer health data. No third-party generative AI recipient is listed because none is integrated in shipping code. Adding one requires updating this Notice and obtaining purpose-specific permission consistent with Apple Guideline 5.1.2 before enablement.

RCW 19.373.010’s definition of “share” excludes certain processor disclosures and certain requested-service disclosures to a third party under stated conditions. Whether a particular Evexia disclosure is “sharing” vs an excluded disclosure is staged for counsel.

Collection and sharing consent (RCW 19.373.030)

RCW 19.373.030 generally prohibits collecting consumer health data except (i) with consumer consent for a specified purpose, or (ii) to the extent necessary to provide a product or service the consumer requested.

Sharing consumer health data generally requires (i) separate and distinct consent from collection consent, or (ii) the same requested-product/service necessity exception.

Where consent is required, the request must clearly disclose categories collected or shared, purpose and specific uses, categories of entities with whom data is shared, and how to withdraw consent.

Separate collection and sharing consent prompts are prepared for a future release. This draft does not record or imply acceptance. Whether a given feature is covered by the requested-service exception (for example core assessment delivery you asked to start) is not finally determined in this draft.

This Notice does not invent a geofenced consent requirement. RCW 19.373.080 addresses geofencing around health-care facilities; Evexia does not implement facility geofences.

Your rights: confirm/access, withdraw, delete, appeal (RCW 19.373.040)

Confirm and access: email admin@evexia.living to ask whether we collect, share, or sell consumer health data about you and to request access, including (where applicable) third parties/affiliates with whom such data was shared and a way to contact them.

Withdraw consent: email admin@evexia.living to withdraw consent to future collection and/or sharing of consumer health data. Withdrawal does not automatically undo prior lawful processing; counsel will map how requested-service processing interacts with withdrawal before release.

Deletion: use in-app Delete account where available, or email admin@evexia.living. RCW 19.373.040 describes deletion from records including network copies, notice to affiliates/processors/third parties, and limited delay for archived/backup systems (not more than six months after authentication). Today’s in-app delete removes account, enrollments, day logs, and Connect data we can find; assessment sessions/results/answers may remain after the account link is cleared, and clearing that link is not a verified anonymization. Avatar removal can fail. Do not treat the delete button alone as complete erasure or as full statutory CHD deletion compliance.

Appeal: if we refuse a request in whole or in part, email admin@evexia.living with “Privacy appeal” in the subject line within a reasonable time after you receive our decision. We will respond in writing. RCW 19.373.040 provides for appeal timing (generally within 45 days of appeal receipt) and, if an appeal is denied, a method to contact the Washington Attorney General.

We may need information reasonably necessary to authenticate your request. RCW 19.373.040 also addresses free annual request limits and extensions.