Consumer Health Data Privacy Policy

1. Scope

This policy explains how Feason LLC handles consumer health data covered by the Washington My Health My Data Act. It applies to Washington residents and people whose consumer health data is collected in Washington, when acting in an individual or household capacity. It supplements our Privacy Policy, which describes our other personal-information practices. Rights under other applicable laws are not limited by this policy.

Feason offers faith, study, and community features. We ask you not to submit medical or mental-health details, but information you choose to provide can reveal your physical or mental health. This policy covers that information when it is linked or reasonably linkable to you and falls within Washington's definition of consumer health data.

2. Categories and sources

Depending on the features you use, covered information may include:

• Health-related content you provide: information about physical or mental-health conditions, symptoms, treatment, medication, disability, or care you seek, if included in posts, messages, notes, prayer or reflection text, study work, AI prompts, photos, voice input, or support requests.
• Health-related responses and inferences: AI responses about the health information you submit and a possible-crisis classification from Feasy Evolved's check for language about self-harm, suicide, or abuse. This check is used to display safety resources and can make mistakes; it is not a diagnosis.
• Associated information: account or contact identifiers, feature and conversation records, and technical information when linked to the covered content or inference.

Sources are you and your submissions; other people who include information about you in their submissions or communications; and the processing of those submissions by the requested feature, including AI responses and the crisis-language check. Discernment journal text is encrypted on your device before storage. Journal setup and credential-based unlock send the credential to Feason for verification, as explained in Section 8 of our general Privacy Policy.

3. Why the information is used

We use the information to provide the feature you request: store and retrieve your content; deliver it to the audience you choose; return AI, search, transcription, or spoken output; carry a live voice conversation; display relevant safety resources; and respond to your support or privacy request. We may also process information as permitted by law to protect people and the Service against abuse, fraud, and security incidents, and to meet legal obligations.

Washington law requires consent for covered collection and separate consent for covered sharing unless the activity is necessary to provide a product or service you requested or another legal exception applies. Accepting our general Terms or reading this policy is not that consent. Any additional collection or sharing that requires consent must be preceded by the required specific notice and affirmative choice.

We do not sell consumer health data. Adding a new category of covered data or a new purpose requires an updated disclosure and affirmative consent before that new collection, use, or sharing begins, as required by Washington law.

4. Categories shared and recipients

The content, responses, inferences, and associated information described in Section 2 may be disclosed as needed for the feature or purpose below. A provider receives only the information involved in its part of that feature; this does not mean every provider receives every category.

• Hosting and storage providers: Vercel and Supabase process content and associated records needed to run and store the requested feature.
• AI and search providers: OpenAI, Anthropic, Voyage AI, and Vercel AI Gateway may process submitted text, conversation context, images, or audio for AI answers, content checks, image descriptions, transcription, or search, depending on the feature and configured provider.
• Voice providers: OpenAI processes web voice transcription; Apple may process iOS speech-recognition audio when recognition is not on device; ElevenLabs processes text for spoken output in features that use it; and LiveKit transports live Flock room audio and connection information.
• Communication providers: Resend, Apple, and the push service selected by your browser process the email or notification information needed for delivery, which may include health information if it appears in that communication.
• Recipients you select: message recipients, group or live-room participants, churches you contact, connected apps you authorize, people with a share link you create, or the public when you deliberately publish content. Their access depends on the feature and audience you choose.
• Legal and safety recipients: authorities, professional advisers, or other parties when disclosure is required or permitted by law to address a legal obligation, protect people or systems, or investigate unlawful conduct.

Feason LLC is the operator identified in this policy. No separate Feason affiliate is identified as a recipient in the data flows described here. We do not send the health-related content or crisis classifications described above to advertising providers.

5. Your Washington rights

For consumer health data covered by Washington law, you can request:

• Confirmation and access, including a list of third parties and affiliates with whom the data was shared or sold and a way to contact them;
• Withdrawal of consent for collection and sharing;
• Deletion, including notification to processors, contractors, affiliates, and other third parties required to act on the deletion request.

Email info@feason.com with the subject “Consumer Health Privacy Request,” use our Contact page, or write to Feason LLC, 2108 N St # 16806, Sacramento, CA 95816, USA. Tell us the action you want and enough account or feature information to locate the relevant records. Please do not include unnecessary medical details. These requests are reviewed by Feason, including recipient notifications required by applicable law. A recipient may retain information only where applicable law permits.

We may authenticate your identity but will not require a new account. Responses are free up to twice annually, subject to the law's exception for manifestly unfounded, excessive, or repetitive requests. We respond within 45 days after receipt; one additional 45-day extension is permitted with notice and reasons. Permitted delays for archived or backup deletion cannot exceed six months after authentication.

If we deny a request, reply or contact us with “Privacy Appeal.” We provide a written appeal decision and reasons within 45 days. If the appeal is denied, you can submit a complaint to the Washington Attorney General.