Consumer Health Data Privacy Policy

Effective date: July 23, 2026 · Last updated: July 28, 2026

This document supplements the GeistHaus Privacy Policy and applies specifically to consumer health data as defined by the Washington My Health My Data Act (RCW 19.373) and the Nevada Consumer Health Data Privacy Law (SB 370).

It exists as a separate document because those laws require it to be separate.

If you are a resident of Washington or Nevada, this policy describes what health-related information we collect about you, why, who we share it with, and the rights you have. We voluntarily extend the rights described here to all GeistHaus users regardless of where they live.

GeistHaus LLC, an Illinois limited liability company, is the entity responsible for this data. Contact: wes@geist.haus

1. Why this applies to GeistHaus

GeistHaus is a journaling application, not a healthcare product. We are not a HIPAA-covered entity, and what we hold is not a medical record.

However, Washington and Nevada define consumer health data broadly. It includes information that identifies a consumer's past, present, or future physical or mental health status — and explicitly includes inferences drawn about that status, whether or not the consumer stated it directly.

People write about their emotional lives in GeistHaus, and GeistHaus analyzes that writing and forms structured inferences from it. We think that clearly falls inside the definition, so we treat it as consumer health data rather than argue the point.

2. What we treat as consumer health data

• Your journal entries and conversations, to the extent they concern your mental or emotional state, psychological wellbeing, relationships, or health.
• Inferences we generate from that writing. GeistHaus produces structured analysis of recurring themes, relational and emotional patterns, and how these change over time. These inferences are the most sensitive information we hold about you, and much of it concerns mental health status.
• Safety classifications. Each message is automatically screened for indications of crisis or risk of harm, and the result of that screening is health data about you.
• Usage patterns that reveal health status, such as the timing and frequency of your sessions.

We do not collect precise location data, biometric data, genetic data, information about medications or diagnoses from any external source, or health information from any third party.

3. Where it comes from

There is only one source: you. Everything above is derived from what you write in the app, or generated by the app from what you write and from how you use it — the session timing and frequency in Section 2 come from your use of the app, not from any outside party.

We do not purchase, license, or otherwise obtain health data about you from data brokers, advertising networks, healthcare providers, or any other outside source.

4. How we use it

We use consumer health data only to:

• Generate GeistHaus's responses to what you write
• Maintain continuity across your sessions, so the app can reflect patterns over time
• Surface crisis resources when automated screening indicates possible risk
• Diagnose technical failures and evaluate the quality and safety of the app's responses
• Comply with legal obligations

We do not use it for advertising, marketing, profiling for any purpose outside the app, or training AI models.

5. Consent

We ask for your separate, affirmative, opt-in consent before collecting consumer health data, and a second, distinct consent before sharing it with the service providers listed below. Neither consent is bundled into our Terms of Service, and neither is a condition of creating an account — though the app cannot function without them, since processing your writing is the entire service.

Consent must be freely given and specific. You may withdraw either consent at any time (Section 8). Withdrawing consent does not affect processing that already occurred, but it stops future processing — which, in practice, means the app can no longer operate.

We do not and will not sell consumer health data. Washington law permits sale only under a signed valid authorization meeting specific statutory requirements. We do not seek such authorizations and will not ask you to sign one.

6. Who we share it with

We share consumer health data only with processors who handle it on our behalf, under contract, restricted to the purposes above. We do not share it with advertisers, data brokers, employers, insurers, landlords, law enforcement absent valid legal process, or anyone making decisions about you.

Categories of third parties, and the specific entities in each:

Affiliates: GeistHaus LLC has no affiliates, subsidiaries, or parent entities. No affiliate receives your data.

Not in scope: Stripe receives payment and account information but no consumer health data. PostHog receives pseudonymous usage events containing no entry content and no health inferences.

We will update this list before adding any new processor with access to consumer health data.

7. What we do not do

• We do not sell consumer health data.
• We do not use it for advertising or marketing.
• We do not use geofencing around any healthcare facility, mental health facility, or any other location, for any purpose. The app does not collect precise location at all.
• No third party collects consumer health data about you through GeistHaus over time and across other, unaffiliated websites or services. Nevada law asks us to state this explicitly: the answer is no.
• We do not disclose it to law enforcement without valid legal process, and we will notify you of any demand for your data unless legally prohibited.

8. Your rights

You have the right to:

Confirm and access. Learn whether we are collecting, sharing, or selling your consumer health data, and obtain a copy of it, including the inferences we have generated about you.

Know who has it. Receive a list of all third parties and affiliates with whom we have shared your consumer health data, including contact information for each.

Delete. Have your consumer health data deleted from our systems. On receiving a deletion request, we will delete it from all of our records — with archived and backup copies aging out on the backup timeline described in Section 9, as Washington law permits — and notify every processor listed in Section 6, each of which is contractually required to honor the request.

Withdraw consent. Withdraw your consent to collection, to sharing, or to both, at any time.

Appeal. If we decline a request, you may appeal, and we will explain our reasoning in writing.

We will not deny you service, charge you a different price, or provide a lesser experience because you exercised any of these rights — except insofar as withdrawing consent or deleting your data makes the app unable to function.

9. How to exercise these rights

In the app: account deletion, which removes all consumer health data, is available under Settings → Delete my account on the web, or Account → Delete my account in the iOS, macOS, and Android apps.

By email: wes@geist.haus, with the request type in the subject line.

We verify your identity through your account email address before acting on any request. If we cannot verify you, we will tell you why rather than acting on an unverified request.

Timeline. We respond within 45 days. We may extend once by a further 45 days where reasonably necessary, and will tell you before doing so, with the reason.

Backups. Live systems are purged within 30 days. Encrypted database backups are retained no longer than 35 days on a rolling basis — well inside the six months Washington law allows — and no restored backup will reintroduce deleted data.

Appeals. Send to wes@geist.haus with "Appeal" in the subject line. We respond within 45 days with a written explanation.

10. If we get it wrong

Washington residents: if your appeal is denied, you may submit a complaint to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint. The My Health My Data Act is enforceable by individuals under the Washington Consumer Protection Act.

Nevada residents: you may submit a complaint to the Nevada Attorney General's Bureau of Consumer Protection.

11. Changes

We will not materially change our consumer health data practices, or share this data with a new category of third party, without notifying you and — where the law requires it — obtaining fresh consent. The "last updated" date reflects the current version.

12. Contact

GeistHaus LLC, an Illinois limited liability company
wes@geist.haus