Phea · Health Data Privacy
Effective Date: October 2026
This Health Data Privacy Policy (“Health Data Policy”) supplements the Phea Privacy Policy and describes how Phea Health LLC (“Phea,” “We,” “Us,” “Our”) collects, uses, shares, and protects sensitive health-related information, including “Consumer Health Data” as defined under Washington’s My Health My Data Act, RCW 19.373 (“MHMDA”), and “medical information” as defined under California’s Confidentiality of Medical Information Act, as extended by Assembly Bill 352 (“CMIA”), and, to the extent applicable, similar laws of other states. As a matter of company policy, We apply the protections described in this Health Data Policy to all Phea users, regardless of state of residence, rather than limiting them to Washington or California residents only.
This Health Data Policy covers the following categories of information Phea collects through the Services:
Under the MHMDA, “Consumer Health Data” broadly means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. Given the nature of Phea’s check-ins, We treat Check-In Content and Crisis-Related Messages as Consumer Health Data.
We collect and use Consumer Health Data solely to: provide and personalize the Services, including generating Phea’s responses; operate the crisis-response functionality described in Section 6; maintain and secure Your account; and comply with legal obligations. We do NOT use Consumer Health Data to serve You or anyone else targeted advertising, and We do NOT use it for any purpose beyond providing the Services without first obtaining Your separate, valid authorization.
We do not, and will not, sell Consumer Health Data. We do not share Consumer Health Data with any third party for advertising. We share it only with the processors identified herein who process it solely on Our behalf under contract.
We do not use geofencing technology to establish a virtual boundary around any healthcare facility for the purpose of identifying, tracking, collecting data from, or sending notifications to consumers regarding their Consumer Health Data or health care services.
You may submit a request by emailing Us at info@getphea.com or texting Phea. You do not need to create a new account. We will respond without undue delay, and in all cases within 45 days of receipt (extendable once, by an additional 45 days, with notice of the reason). Responses are free of charge up to twice per year; We may charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive. If We refuse to act on Your request, You may appeal by emailing Us at info@getphea.com with “Appeal” in the subject line; We will respond in writing within 45 days, and if We deny Your appeal, We will provide You a way to contact the Washington State Attorney General to submit a complaint.
We will obtain Your affirmative, opt-in consent before collecting Your Consumer Health Data for a new purpose not disclosed in this Health Data Policy, separate and distinct from Your acceptance of the Terms and Conditions. If We ever need to share Your Consumer Health Data with a third party other than a processor described in Section 7, which We do not do today, We will obtain Your affirmative, opt-in consent to that sharing separately and distinctly from any consent obtained to collect the data.
Nevada's Consumer Health Data Privacy Act, codified at NRS Chapter 603A, defines "consumer health data" in substantially the same way as the MHMDA and applies regardless of the size of the business collecting it. For the same reasons described in Section 2 above, We treat Check-In Content, Cycle Data, Health Conditions information, and Crisis-Related Messages as consumer health data under Nevada law.
As under Washington law, We collect and use this information solely to provide and personalize the Services, operate the crisis-response functionality, maintain and secure Your account, and comply with legal obligations. We do not use it to serve You targeted advertising, and We do not use it for any other purpose without Your separate, valid authorization.
We do not, and will not, sell Your consumer health data. We do not share it with any third party for advertising purposes. We share it only with the processors identified herein, who process it solely on Our behalf under contract.
We do not use geofencing technology to establish a virtual boundary around any mental health, reproductive health, or other healthcare facility for the purpose of identifying, tracking, collecting data from, or sending notifications to consumers regarding their consumer health data or health care services.
You may submit a request using the same process described in Section 2.5 above. If We decline to act on Your request, You may appeal through that same process; if We deny Your appeal, We will provide You a way to contact the Nevada Attorney General to submit a complaint.
California’s Confidentiality of Medical Information Act (“CMIA”), as extended by Assembly Bill 352, provides that a business offering a reproductive or sexual health digital service (a service that allows a consumer to manage information about the consumer’s reproductive health, menstrual cycle, fertility, pregnancy, pregnancy outcome, plans to conceive, or type of sexual activity) is deemed a “provider of health care” for purposes of the CMIA, even if the business and its personnel are not licensed healthcare providers. Phea collects and calculates menstrual cycle start date, cycle length, and period duration (Cycle Data) as a core part of the Services, and Phea treats that information, together with related check-in content and Health Conditions information, as “medical information” protected under the CMIA.
We will not disclose medical information covered by this Section 4 except: (a) with Your valid, written authorization; (b) to the processors identified in Section 7, acting on Our behalf under contract; (c) as required or permitted by the CMIA or other applicable law; or (d) as compelled by valid legal process. We do not disclose this information for marketing or advertising purposes.
As a matter of Our own policy, and consistent with the enhanced security measures the CMIA requires of certain businesses handling information about gender-affirming care, abortion, and contraception, We: limit access to reproductive or sexual-health-related medical information to personnel and processors who need it to provide the Services; segregate this information from other records where technically feasible (as We already do for Crisis-Related Messages, described herein); and do not knowingly share it with any individual or entity outside the United States.
To the extent the CMIA applies to information Phea holds about You, You have the right to access Your medical information, request correction of inaccurate information, and be free from unauthorized disclosure of that information. Unauthorized disclosure of medical information in violation of the CMIA may give rise to civil remedies under California law. You may exercise these rights by contacting Us at info@getphea.com
This Health Data Policy specifically addresses Washington, Nevada, and California law because those are the states with laws directly targeting consumer health data or reproductive/sexual health information. A number of other states including Maryland, Colorado, Connecticut, Virginia, and others have comprehensive privacy laws that classify health-related information as "sensitive data" subject to similar protections. Rather than track each state's requirements separately, it is Our policy to apply the protections described in this Health Data Policy to all Phea users, regardless of state of residence: We do not sell health-related information under any circumstances; We do not share it for advertising; We limit internal access to defined, necessary purposes; and We honor requests to access, correct, or delete it as described above. If a particular state's law provides a right broader than what is described here, it is Our policy to honor that broader right for residents of that state upon request.
When Phea detects language in a check-in that may indicate a risk of self-harm, Phea responds with crisis resources rather than ongoing conversational engagement. The triggering message and Phea’s response are stored in a database table that is separate from Your ordinary check-in data, with access restricted to personnel and processors who need it to operate, review, or improve this safety functionality. This information is not used to generate Patterns or other predictive outputs, is not used for advertising, is not sold, and is not shared with any third party except the processors identified in Section 7.
We share the information covered by this Health Data Policy only with service providers who process it on Our behalf solely to provide the Services, currently: Supabase (database and storage, including the segregated crisis-events table); Render (application hosting); Twilio (SMS delivery); and Anthropic’s Claude API (AI processing to generate Phea’s responses and support crisis detection). These providers are contractually restricted from using this information for their own independent purposes or for advertising, and We do not permit them to use it to train general-purpose models. Subscription payments are processed by Stripe; it is Our policy not to send Stripe any of the information described in Section 1 (such as check-in content, Cycle Data, or Health Conditions information), and Stripe receives only the billing and subscription information necessary to process Your payment.
We may update this Health Data Policy from time to time. Material changes will be communicated as described in Our Terms and Conditions, and, where required by law, We will obtain renewed consent before applying material changes to previously collected information covered by this policy.
If You have any questions about this Health Data Policy, please contact Us at:
Phea Health LLC