Consumer Health Data Privacy

How we handle what you share

This notice is separate from our general Privacy Policy and speaks specifically to reflections, check-ins, and messages you save with FindOkay — the categories some state laws (Washington MHMDA, Nevada SB370, and similar) call "consumer health data."

What FindOkay is (and isn't)

FindOkay is a reflective wellness tool. It is not therapy, not medical or psychiatric care, and does not diagnose conditions. The responses you receive are generated by AI models in the voice of historical thinkers — you are not talking to a person or a clinician.

What we collect from you

  • Account identity — email, display name, optional gender and age bracket.
  • Consent records — when you confirmed your age, accepted health-data consent, and accepted the Terms.
  • Reflections and content you save — chat messages, check-ins, unwind entries, evening notes, values selections, journey progress, meditation progress.
  • Subscription and billing records if you subscribe.

Browsing the site, using the picker, using the matcher, and previewing voices does not save any of that content to your account. Only anonymized session-scoped event counts are logged.

What we do with it

  • Show you your own reflections when you come back.
  • Send the message you are currently writing to an AI model (via the Lovable AI Gateway → Google Gemini) to generate a response.
  • Enforce the free-question limit and, if you subscribe, your subscription.

We do not sell your data. We do not share your reflections with advertisers.

Who we share it with

  • Our infrastructure providers (Lovable Cloud / Supabase) for hosting and storage.
  • The Lovable AI Gateway (routing to Google Gemini) for generating chat responses.
  • Our payments provider if you subscribe.
  • Google Analytics, for page-traffic measurement only. It receives the page address (query text stripped), approximate location, and device type — never your reflections, chat messages, letters, check-ins, or email address. IP anonymization is on and ad personalization is off.
  • Google Analytics also receives the campaign or link that referred your visit, taken from a fixed list of standard marketing tags in the web address (utm_ tags and ad-platform click IDs). Nothing you typed into the site is included.
  • Google Analytics also receives basic interaction events — a button press, which step of sign-up you reached, an upgrade or support click — labelled with fixed values we define in advance. No reflection text, message content, voice choice tied to you, email address, or account ID is sent.
  • Law enforcement only when we are legally compelled or a life is at risk.

How long we keep it

Your content stays until you delete your account. When you request deletion we remove your live rows immediately and our database backups age out within about 30 days.

Your rights

  • Access — view what you've saved from your account pages.
  • Withdraw consent — stop new content writes without deleting past content.
  • Delete — remove your account and content from Account → Delete account.
  • Correct or export — email us; we respond within 30 days.

Age

FindOkay is only for adults age 18 and over.

Crisis and safety

FindOkay is not a crisis service. If you are in crisis, please visit /crisis or call or text 988 in the US.

Changes

If we materially change how we handle consumer health data we will notify you and ask you to re-consent the next time you sign in.

This page describes our current practices as of the deployment date. It is not legal advice.