Consumer Health Data Privacy Policy

1. About this policy

This Consumer Health Data Privacy Policy explains how Somaia, operated by Somaia, collects, uses and shares consumer health data, as defined by Washington's My Health My Data Act. It adds to our Privacy Policy, which covers all other personal information.

Somaia is a wellness education and self-care app for adults 18 and over. It is not medical care.

2. Consumer health data we collect

• Quiz answers: your answers to the Prakriti (constitution), Vikriti (current balance) and Ama (accumulated toxins) quizzes, and the results we derive from them, such as your dosha (body-mind type) mix and your Balance score
• Concerns you choose: the wellness themes you pick, such as digestion, sleep or energy
• Daily check-ins: your answers about sleep, energy, mind, body, digestion, stress, movement, meals and screens, and any short note you add
• Chat with Ask Somaia: the messages you send and the replies you receive
• Your Blueprint intake: the answers you give for your Balance Blueprint report

3. Where it comes from

We collect consumer health data directly from you, when you take a quiz, choose concerns, check in, chat with Ask Somaia or complete the Blueprint intake. We also derive some of it from what you give us, such as your Balance score and the patterns we notice across your check-ins.

4. How we use it

We collect and use consumer health data only with your consent, and only to:

• Give you personalised wellness guidance, recommendations and your daily "one thing"
• Generate your assessments, Balance score and Blueprint report
• Answer your questions in Ask Somaia
• Keep the Service secure and working

We do not sell consumer health data. We do not use it for advertising. We do not use geofencing around places where health services are provided.

5. Who we share it with

We share consumer health data only with the service providers below, and only so they can run the Service for us under contract. They may not use it for their own purposes.

Of these, Supabase stores your data. Anthropic writes personalised guidance and chat replies. Voyage matches your wellness themes to our knowledge base, using only a fixed vocabulary of wellness words and never your free text. Resend sends your emails, Upstash limits request rates, and Stripe handles payments. Google Analytics and Vercel Analytics receive no consumer health data: only coarse page names and a few counts, and only after you accept analytics cookies.

6. How we protect it

We use industry-standard measures, including HTTPS, access controls and secure authentication. Access to consumer health data is limited to what is needed to run the Service. No system is perfectly secure, but we continuously improve protections.

7. Your rights

You have the right to:

• Confirm whether we collect, share or sell your consumer health data, and see it
• Get a list of the third parties we share it with (listed above)
• Withdraw your consent at any time, in Settings → Privacy
• Delete your consumer health data, in Settings → Delete account or by asking us
• Export a copy of your data, in Settings → Export my data

To use any of these rights, email privacy@somaia.app or use our contact form. We will respond within 45 days, and tell you if we need up to 45 more days. If we decline a request, you can appeal by replying to our answer, and we will tell you the outcome in writing.

8. Contact

For questions about this policy or your consumer health data, email privacy@somaia.app.