This notice is required by Washington's My Health My Data Act and describes, specifically and separately from our general Privacy Policy, how Meloa LLC ("we," "us," "our") collects, uses, and shares your consumer health data — information that identifies your past, present, or future physical or mental health status. If anything here conflicts with the general Privacy Policy on how health data specifically is handled, this notice controls.
Categories of consumer health data we collect, and why
Distress ratings (SUDS logs)
0–100 anxiety scores, and optional somatic/cognitive/anticipatory/autonomic breakdowns, tied to specific events or logged ad hoc.
Purpose: Compute your baseline anxiety trend and detect patterns like the Anticipation Gap and Recovery Velocity shown on your Profile page.
Baseline mental health assessments
GAD-7 (general anxiety), LSAS (social anxiety), and PHQ-9 (depression) self-report scores.
Purpose: Track how your baseline anxiety and mood shift over weeks or months, shown as longitudinal trend lines on your Profile page.
Daily anxiety logs
One whole-day 1–10 rating and optional notes, per day.
Purpose: Shade calendar day cells and provide a coarse day-level view distinct from individual event ratings.
Medications & adherence logs
Medication name, dosage, frequency, schedule, and whether each scheduled dose was taken, skipped, or partial.
Purpose: Power daily adherence check-ins and the medication adherence trend line on your Profile page.
Event anxiety ratings & cognitive profile
Per-event 1–10 anxiety ratings; time-blindness level, rejection sensitivity, and checking-compulsion score you provide during onboarding or intake.
Purpose: Drive pre-event lockout timing, post-event decompression buffers, and OCD-safeguard schedule locking defaults.
Breathing & guided relax session history
Session type, duration, and completion status for breathing exercises and guided relax audio.
Purpose: Show your own session history; not used for anything beyond your own account.
Intake questionnaire responses
Executive-function, schedule-preference, and baseline-anxiety answers from onboarding.
Purpose: Set your initial app defaults (spoon budget, buffer lengths, category defaults); retaken any time to re-tune them.
Who we share it with, and why
We do not share your consumer health data with anyone beyond what's listed below, and never for advertising or to build profiles about you for other companies.
Supabase
Database hosting and authentication — stores every category above.
Shared: Always, as our infrastructure provider, to operate the Service you asked for. Not optional and not a consent choice — the app cannot function without a database.
Google Gemini (Google Cloud AI)
Powers AI Task Breakdown, Voice Navigation, and Photo Add — sees task titles/descriptions, voice transcripts, or event photos you submit to those specific features, run through PII redaction before sending.
Shared: Only when you've turned on "AI-assisted features" in Profile → Privacy & Consent. Off by default. Task Breakdown still works without it via a non-AI heuristic fallback.
PostHog
Product analytics — named, deliberate events (e.g. "onboarding_completed") with your account ID, never free-text health data, never autocapture of form inputs.
Shared: Only when you've turned on "Product analytics" in Profile → Privacy & Consent. Off by default, and never sent if your browser sends a Global Privacy Control signal.
Stripe
Billing — payment and subscription-tier information only. Never receives health data.
Shared: Only if you subscribe to Premium or Pro.
Resend
Transactional email delivery (account confirmation, notifications you opt into).
Shared: Only your email address and the notification content itself — never your logged health data.
We do not sell your consumer health data
Meloa does not sell consumer health data, and has never sold it, to any third party — not to data brokers, advertisers, or anyone else. If that were ever to change, the law requires (and we would provide) a separate, signed authorization naming the buyer, the specific purpose, and an expiration date — not a routine consent pop-up. We have no plans to introduce this.
No location-based tracking near healthcare facilities
Meloa does not use device geolocation, and does not establish geofences around hospitals, clinics, reproductive health facilities, or any other healthcare facility to track your visits, collect data, or trigger notifications or advertising. The only location-related feature in the app is a text-based address autocomplete for event locations you type in yourself, and it does not read your device's GPS.
Your consent and how to withdraw it
Collecting your consumer health data requires your affirmative, opt-in consent, given at signup (or, for accounts created before this notice existed, the first time you sign back in). Sharing it with Google Gemini or PostHog requires a second, separate opt-in — both are off until you turn them on.
You can withdraw the sharing opt-ins at any time from Profile → Privacy & Consent, with immediate effect. Because the collection of this data is what the core product does, withdrawing consent to collection itself means closing your account — see Delete Account in the same section. Deletion cascades through our database, backups, and the third-party processors above within 30 days, with no retention exceptions.
You can also download a full, machine-readable copy of everything listed above at any time from the same section of your profile settings.
Contact
Questions about this notice, or requests to access, correct, or delete your consumer health data, can be sent to support@meloa.io.