Consumer Health Data

Consumer Health Data Privacy Policy

Effective Date: August 19, 2026

This is a separate policy, required by Washington's My Health My Data Act (RCW 19.373) and Nevada's SB 370, covering only the data those laws call consumer health data. It supplements our Privacy Policy — it does not replace it. Where the two describe the same practice, they say the same thing; this document simply isolates the health-data part so you can read it on its own.

It is published by PSYCHE PROJECT PBC ("Psyche," "we," "us," or "our"), a Delaware Public Benefit Corporation, and it covers Peli, our mobile app for iOS and Android, and our website at psyche.you.

Peli is the app; Psyche is the company that operates it.

1. The Short Version

Two of our assessments — AQ-28 and ASRS — ask questions that these laws treat as health data, because they are adapted from research instruments used in autism and attention research.
We store your answers to them for one reason: your result is computed from them and shown back to you. That is the service you asked for.
We do not sell consumer health data. We never have. There is no advertising network, no data broker, and no cross-context behavioural advertising anywhere in Peli.
We do not share consumer health data with anyone except the service providers who run the app for us, listed in §5.
You can see it, export it, and delete it, at any time, from inside the app.

2. What We Treat as Consumer Health Data

Washington and Nevada define consumer health data broadly — as information linkable to you that identifies your past, present or future physical or mental health status, including inferences drawn from non-health data.

We apply that definition as a precaution, not as an admission. It is wider than what Peli actually does: we report these assessments as continuous traits, with no clinical cutoff, no screen result, and nothing anywhere that says you do or may have a condition — the cutoffs the source instruments carry were deliberately removed. We would rather meet the broader standard than argue about whether it reaches us. On that basis, we treat the following as consumer health data:

Category	What it is	Where it comes from
Neurodivergence-screener answers	Your item-by-item responses to AQ-28 (social preferences, routine, pattern focus) and ASRS (attention and activity)	You, directly, when you choose to take that assessment
Scores and subscores derived from them	The numeric result computed from those answers	Computed by us from the answers above
Written insights generated from them	The narrative profile text Peli writes about those results	Generated by us, and by our AI provider, from the scores above
Anything health-related you type or say to Peli	Ask Peli is a free-text conversation. If you tell it something about your health, that content is consumer health data	You, directly
Health-adjacent inferences	Any inference we draw about your mental-health status from the above	Derived by us

What is not in scope. Our other assessments measure personality, values, attachment style, humour style, chronotype and social and economic attitudes. Those are not health data under these statutes. The SECS scale asks about political views, which is sensitive under other frameworks but is not health data and is not covered by this policy — see §12 of the Privacy Policy for how we treat it.

We do not collect biometric data, precise geolocation, genetic data, reproductive-health data, gender-affirming-care data, diagnoses, prescriptions, or any information from a healthcare provider. Peli is not a medical device, does not diagnose, and has no clinical or care pathway.

3. Why We Collect It, and On What Basis

We collect consumer health data to provide the service you requested — showing you your own result for an assessment you chose to take, tracking how it changes over time if you take it again, and comparing it against population averages.

Both statutes permit collecting health data to the extent necessary to provide a product or service the consumer requested. That is the basis we rely on. We do not claim you consented to it by taking the assessment, because there is no moment in the flow where you were asked, and we will not describe a click as a consent it was not.

We also use it, in aggregate and never at the level of an identifiable person, for the internal work described in the Research Policy — validating the assessments, building population norms, and computing reliability statistics. What leaves Psyche from that work is aggregate findings, not rows.

We do not use consumer health data to advertise to you, to profile you for anyone else, or to make any decision about you with a legal or similarly significant effect.

4. What We Never Do

We do not sell consumer health data. Not to data brokers, not to advertisers, not to researchers, not to anyone. We have never received payment or other consideration for it, in any form.
We do not share individual-level consumer health data outside Psyche — not with academic partners, not under a data-use agreement, not on request. The only exception the law compels is §6.
We do not use it for targeted advertising, and Peli runs no advertising of any kind.
We do not operate a geofence around any health-care facility, provider, or any other location. Peli collects no location data at all.

5. Who Processes It, and Why

We share consumer health data only with the service providers who operate the product for us, under contract, and only to the extent each one needs it. They may not use it for their own purposes.

Category of third party	Named provider	Why they touch it
Database and authentication	Supabase	Your answers and results are stored here
Application server hosting	Railway	Our API runs here, so it processes everything you send us
AI insight generation	Anthropic (Claude)	Receives assessment scores to write your narrative profile, and your Ask Peli messages
Product analytics and error monitoring	PostHog	Receives generated narratives, trait scores and Ask Peli content from our servers; app session replay masks all text
Real-time delivery and push	Ably, Apple (APNs), Google (FCM)	Deliver notifications; content is limited to what a notification says

There are no affiliates — Psyche Project PBC has no parent, subsidiaries or corporate affiliates with whom anything is shared.

The complete sub-processor list, including the providers that never touch health data, is in §4.1 of the Privacy Policy.

6. Legal Disclosure

We may disclose consumer health data if required by law, court order, or valid government request. Where we are permitted to tell you that it happened, we will.

We will not disclose consumer health data in response to a subpoena, warrant, or other legal process relating to seeking, obtaining or providing health care, unless the process is valid, applicable to us, and we are legally compelled to comply after challenge.

7. Your Rights

Under Washington's My Health My Data Act and Nevada's SB 370 you have the right to:

Confirm whether we are collecting, sharing or selling your consumer health data, and access it — including a list of all third parties with whom we have shared it.
Withdraw consent to our collection and sharing of it.
Delete it. When you delete, we delete it from our live systems and from our backups on their normal rotation, and we notify every provider in §5 to do the same.

You do not have to email anyone to exercise the first and third of these:

What you want	Where it is
See and export everything we hold	App: Settings → Privacy & Data → Export
Delete the consumer health data without deleting your account	App: Settings → Privacy & Data → Contribute to Science, turned off. That erases every sensitive-assessment attempt outright — not a flag, the rows — along with the four special-category demographic fields
Delete the account and everything attached to it	App: Settings → last row → Delete account, or psyche.you/data-deletion
Ask us anything else, including for the third-party list	support@psyche.you

We respond to a written request within 45 days, and may extend once by a further 45 days where the request is complex, telling you why before the first period ends. There is no charge.

If we refuse. You may appeal by replying to our decision or writing to support@psyche.you with "Appeal" in the subject. We will respond in writing within 45 days explaining the outcome. If we deny the appeal, you may complain to the Washington State Attorney General at atg.wa.gov/file-complaint or the Nevada Attorney General at ag.nv.gov.

Washington's private right of action. RCW 19.373 is enforceable by consumers under Washington's Consumer Protection Act. Nothing in this policy waives that, and nothing in it requires you to arbitrate a claim under it.

8. Employees and Contractors

Access to consumer health data inside Psyche is limited to the people who need it to run the service, is controlled by role, and is logged. Every contractor with access is under a written confidentiality obligation.

9. Retention

We keep consumer health data for as long as your account exists, because it is the substance of what the account is for — your results are the product. When you delete an assessment attempt or your account, it goes. Aggregate statistics computed before deletion do not identify you and are not recoverable to you; they remain.

10. Changes to This Policy

We will not collect, use or share consumer health data for a purpose not disclosed here without asking you first. If we materially change this policy, we will post the change with a new effective date and notify registered users by email, and — where the law requires it — obtain fresh consent before applying the change to data we already hold.

11. Contact

PSYCHE PROJECT PBC 47 Wintermist Irvine, CA 92614 United States

Email: support@psyche.you

Peli is available in the United States only. This policy addresses Washington and Nevada consumer-health-data law specifically; your rights under other US state privacy laws are described in the [Privacy Policy](/privacy).