Consumer Health Data Privacy Policy

1. What Consumer Health Data We Collect

We do not collect precise location, biometric data, or data from health devices or wearables, and we do not use geofencing.

2. Where It Comes From

• Directly from you, when you sign up and when you chat or speak with Grace.
• Automatically from your device or browser, such as a session ID and message timestamps.
• From Grace's replies, which are generated in response to what you share.

We do not buy health data or get it from data brokers.

3. Why We Collect and Use It

• To provide Grace. Grace needs to read your messages to answer them, and it remembers past conversations so it can stay with you over time.
• To keep people safe. Grace watches for signs that someone may be in danger and shares crisis resources (like 988). We keep only the anonymous count described above, to report on and improve this safety feature. Safety alerts about possible harm to a child or other people work differently; see Section 5.
• To run your account and subscription, including support and service messages.
• To keep the service secure and prevent misuse.
• To meet legal obligations.
• To improve Grace, only if you opt in. See Section 6.

We never use your health data for advertising, and we never sell it.

4. Who We Share It With

We share consumer health data only with service providers that help us run Grace, and only as much as each one needs. They act on our behalf and may not use your data for their own purposes.

Payment providers. Stripe (web payments, through GoHighLevel), the Apple App Store (iPhone), Google Play (Android), and RevenueCat (app subscription management) handle purchases. They receive payment and subscription information, plus an account identifier. They do not receive your conversations.

Safety alerts are handled differently. See Section 5.

We may also disclose data if the law requires it (for example, a valid court order), or to protect someone's life or safety in an emergency.

We have no affiliates that receive your consumer health data.

5. Safety Alerts

Grace's safety system watches for signs that a child or other people may be at risk of harm. If it triggers a safety alert, we may keep and use any of the information we hold about that account to help protect you or others, including:

• The full conversation, including Grace's replies
• Your IP address
• Your account name and email address
• Your device and session IDs
• The dates and times of your messages
• Other account information we hold, such as your saved memories, plan and subscription status, and any profile details you gave us (like your birthday or preferences)

The alert, including the conversation and your IP address, is sent by email to our safety reviewer, and a record of it is kept in our safety records. We may share this information with law enforcement or emergency services when needed to protect someone, or when the law requires it.

6. Using Conversations to Improve Grace (Optional)

Your conversations help Grace become kinder, wiser, and more helpful, but only if you say yes.

• This is a separate, optional choice and it is off by default. If you leave it off, you still get the full Grace experience.
• If you opt in, we remove your name, email, and account and device IDs from conversations before they are used to improve Grace.
• You can turn it off at any time in the Grace menu. After you turn it off, we stop using your conversations to improve Grace.
• We do not let our AI model provider train its own general models on your conversations.

7. Your Consent

Before your first conversation with Grace, we ask you to confirm you are 18 or older and to consent to:

1. Collection of consumer health data to provide Grace, and
2. Sharing it with the service providers listed above so Grace can work.

These are separate from our Terms of Service. Improving Grace (Section 6) is a third, optional consent.

8. Your Rights

If you are a Washington resident (or your data is processed in Washington), you have the right to:

• Know and access. Confirm whether we collect, share, or sell your consumer health data, and get a copy of it.
• See who it's shared with. Get a list of every third party and affiliate we've shared it with, including how to contact them.
• Delete. Have your consumer health data deleted, including from our service providers.
• Withdraw consent. Take back your consent to collection, sharing, or training at any time.
• Be treated fairly. We won't treat you differently for using these rights.

How to Use Your Rights

• Delete your account and data: go to 1800deargod.com/delete-account.
• Turn off training: use the Grace menu.
• Everything else (access, list of third parties, withdrawing consent, questions): email support@1800deargod.com with the subject "Health Data Request."

We may need to confirm it's really you, usually by checking the email address on your account. We'll respond within 45 days. If we need more time, we may extend that once by another 45 days and will tell you why. There's no charge for up to two requests a year.

When you ask us to delete, we delete the data from our systems and tell our service providers to do the same. Withdrawing consent to collection or sharing means Grace can no longer chat with you, because Grace needs to read your messages to reply.

If We Say No

If we deny your request, we'll explain why. You can appeal by replying to our decision or emailing support@1800deargod.com with the subject "Health Data Appeal." We'll respond to an appeal within 45 days and explain what we decided and why. If you're still not satisfied, you can contact the Washington State Attorney General at atg.wa.gov/file-complaint.

9. We Do Not Sell Your Health Data

We do not sell consumer health data, and we never have. We don't exchange it for money or anything else of value.

10. How We Protect and Keep It

Data is encrypted in transit (HTTPS/TLS), and access to our database is limited to your own account and to authorized backend systems. Conversations are kept while your account is active. If you cancel, they're kept for up to 90 days and then deleted, unless you ask us to delete them sooner. Like most websites, our servers also keep standard access logs that include IP addresses; these are kept for about two months.

11. Age

Grace is for adults 18 and older. We don't knowingly collect data from anyone under 18.

12. Changes

If we change this policy, we'll update the effective date. If we want to collect, use, or share health data in a new way, we'll ask for your consent first.