Effective date: 29 July 2026 · Last updated: 29 July 2026
This policy is provided under the Washington My Health My Data Act (MHMDA). It applies to consumer health data about Washington consumers that is controlled or processed by Insparian OÜ, the Estonian company that operates Wellphases.
This is a separate health-data notice. For our handling of personal data more generally, read the Wellphases Privacy Policy.
Consumer health data we collect
Depending on how you use Wellphases, we may collect or derive:
- Menopause or perimenopause stage, age, symptoms, menstrual-cycle information, mood, sleep, exercise, diet, medication or supplement references, and other wellness information you choose to provide
- Sleep and workout information you choose to import from Apple Health or Health Connect
- Conversations, notes, reminders, summaries, letters, and reports that contain or reveal health information
- An AI reply you voluntarily report, where that reply contains or reveals health information
- Patterns, correlations, summaries, or other inferences produced from the information above
- Your use of a menopause-focused app, paid feature, or support request where that activity can itself reveal an interest in a health condition or service
- Technical data used to deliver or secure a health-related request, such as language, device region, request time, app version, and a random app, support, or AI-report identifier
We do not collect precise GPS location for health-data purposes.
Sources
We collect consumer health data from:
- You, when you converse with the app, complete onboarding, log an entry, create a note or reminder, request a report, voluntarily report an AI reply, contact support, or buy a feature
- Apple Health or Health Connect, only when you authorize the optional connection
- The Wellphases app, which organizes local entries and may create code-based summaries or patterns
- AI processors acting on our instructions, which may generate a response, summary, structured entry, report, letter, or inference
- Purchase processors, which provide subscription or entitlement status
Why we collect and use it
We collect and use consumer health data to provide the product or service you request, including:
- Holding an AI-supported wellness conversation
- Recording and organizing symptoms and wellness entries
- Personalizing responses with recent context
- Producing summaries, letters, reports, patterns, reminders, and follow-up content
- Importing optional sleep and workout data
- Unlocking and maintaining paid features
- Providing support, securing the service, preventing abuse, and meeting legal obligations
- Reviewing an AI reply for safety or quality when you voluntarily submit an in-app report
Where MHMDA requires consent, we seek consent for the specified purpose before collecting the relevant health data. If we want to collect it for a materially different purpose, we will seek new consent unless the law permits the processing without it.
Who receives it
We disclose consumer health data only as needed to provide the requested service:
- Alibaba Cloud Function Compute, which operates our request relay in Singapore
- Anthropic PBC, which processes Claude requests in the United States for the non-CN route used by current released versions
- Alibaba Cloud Model Studio / DashScope, which processes Qwen requests in mainland China for the CN route used by current released versions
- Cloudflare, which receives voluntary AI-response reports and stores the reported reply, selected reason, app version, and random report number in a D1 database restricted to the European Union for 30 days; the report is not sent to an AI model as part of reporting
- Apple and Google health-platform services, when you choose to connect or revoke Apple Health or Health Connect
- RevenueCat, Apple, Google, and Stripe, which process purchase and entitlement information; health conversations and health records are not intentionally sent to them
- Hosting, security, legal, and support providers, but only when necessary for those services or legal compliance
These providers are intended to act as contracted processors or service providers under our instructions. MHMDA excludes a processor disclosure that meets its statutory requirements from the definition of “share.”
We have no affiliates that receive consumer health data.
No sale or statutory sharing
We do not sell consumer health data.
We do not share consumer health data as “share” is defined by MHMDA. We do not disclose it for advertising or to data brokers. If a future disclosure would constitute a sale or statutory sharing, we will first obtain the separate authorization or consent required by law and update this policy.
Your Washington rights
Subject to legal exceptions, you may:
- Confirm whether we collect, share, or sell your consumer health data
- Access that data, including a list of third parties and affiliates with whom it has been shared or sold
- Withdraw consent for future collection or sharing
- Request deletion of consumer health data held by us and by the processors to whom we sent it
- Appeal a refusal to act on your request
Much of your Wellphases data exists only on your device. You can delete the local copy through Settings → Delete All My Data. Turning off health sync stops future imports but does not delete entries already imported.
To exercise a right concerning data processed off-device, email support@wellphases.com with the subject Washington Health Data Request. Include only the details needed to locate the processing, such as the approximate date, app version, provider route if known, and a request, report, or support reference if available. For an AI-response report, provide the random report number shown by the app. Because Wellphases does not require an account and does not deliberately attach your identity to AI requests, we may not be able to identify a particular provider request without those details.
We will authenticate your request using commercially reasonable methods and will not require you to create an account. We will respond without undue delay and generally within 45 days. Where the law permits an extension, we will explain why and tell you the extended deadline.
If we deny your request, reply with the subject MHMDA Appeal. We will review the appeal and explain our decision. If the appeal is denied, you may contact the Washington State Attorney General.
Deletion timing
When a verified deletion request applies to off-device data that we can identify, we will delete it from systems we control and notify relevant processors. Processor backups may be deleted according to their ordinary backup cycles where immediate deletion is not technically possible, as allowed by law. We will not use data awaiting backup deletion for another purpose.
Changes
We will not make a material retroactive change to this policy without first obtaining any consent required by MHMDA. The current version and effective date appear above.
Contact
Insparian OÜ
Estonia
support@wellphases.com