Consumer Health Data Privacy Policy

A requested action may involve:

• Health information you submit: audio, images, video, text or attachments linked or reasonably linkable to a person's physical or mental health, including symptoms, diagnosis, treatment, medication, health-care services, reproductive or sexual health, or gender-affirming care.
• Requested task results and related inferences: results that reproduce, summarize, analyze or derive health information from submitted content.
• Health-task service records: associated account, request, delivery, support, security and rights-request records needed for the task or response.

We use this information only as necessary to perform and return your requested action, provide requested support, investigate a specific suspected security, abuse or legal incident, protect the Services and affected people, or comply with applicable law or valid legal process.

We do not collect precise location to identify or infer that someone sought or received health care. Location in submitted content that identifies or can reasonably be linked to a person's health status or health-care activity is treated as consumer health data.

We do not use consumer health data for advertising, identity or eligibility decisions, covert surveillance, unrelated profiling, general service improvement, model training or routine human quality review.

Sources are you and the device or phone you use, another user who submits information about you, results generated from that content, and processors acting for Headii when returning or supporting a result.

Terms acceptance or a device permission is not another person's consent. General transcription, translation or AI processing may incidentally include information about another person. Headii does not treat the requesting user's contract or the necessary-service exception as consent from that other person. If applicable law requires a separate basis and it is absent, we will restrict, stop or delete the affected processing as required. Headii does not promise to pre-screen every general task for health information or determine every participant's legal status.

Where collection is necessary for a service requested by the consumer to whom the data relates, we rely only on that necessary-service scope. Otherwise, we obtain any required clear, specific and voluntary consent before collection. Any required consent to share is separate from consent to collect. You may withdraw consent using Section 7.

Access is limited to authorized personnel and processors who need it for the stated task, requested support or specific incident. Online task content is temporary task data, not a general account health-record library.

For a transcription task, Headii-controlled original audio ends ordinary task use and triggers active-system deletion seven days after receipt; the transcript does so no later than 90 days after generation. Retries, late results and reopening the App do not restart either period. Infrastructure deletion may finish later, without restoring ordinary use. Other copies, including support submissions, follow the Privacy Policy's retention rules; provider, log, cache, recovery and lawfully retained copies have separate disclosed rules. Request-based deletion rights in Section 7 still apply.

Future optional processing. User-enabled repeated or ongoing insights are not activated by this policy. They require an available feature you deliberately enable, with any trend, history or profile disclosed in advance. Before an available feature begins repeated or ongoing health or emotion inference, a feature-specific notice explains the information, purpose, frequency, recipients, retention and controls. The feature is off until the consumer deliberately enables it and any required consent is obtained. A session-only result is not retained as a cross-session profile without the required notice and choice. Disabling the feature stops future inference; deleting existing history is a separate action unless the control says otherwise. Retention follows the disclosed feature period, not an assumed permanent health record. These conditions do not authorize analysis of another person.

A general AI-improvement purpose does not authorize Headii to knowingly use consumer health data for model training, evaluation or improvement. Any proposed inclusion first requires Headii to update this policy, disclose the purpose, obtain the affirmative consent required for collection and any separate consent required for sharing, and satisfy applicable law.

We disclose only the submitted health information, results or service records needed for the assigned role. The recipient categories are:

• cloud infrastructure providers for transmission, processing and temporary storage;
• AI, speech, language or visual-processing providers for your requested action; and
• support service providers under confidentiality and purpose limits for a support request you deliberately submit.

The Service Provider List identifies applicable providers and roles. A disclosure to an instructed processor for the stated purpose is not statutory “sharing” where the applicable law excludes it. Otherwise, any necessary-service exception must apply to the consumer concerned, or the required separate consent must be obtained before sharing.

No affiliate is authorized to receive consumer health data under this policy. Before any affiliate receives it, we will identify that affiliate in this policy and complete the disclosure and consent required by applicable law. No data broker or recipient for independent advertising, eligibility or unrelated profiling is authorized. A processor change does not permit a new purpose or weaken these protections.

Headii does not sell consumer health data. Headii does not use consumer health data for health-care geofencing. Any future sale route is unavailable unless and until the required valid authorization and public notice are complete. Health-care geofencing remains prohibited for every route covered by Washington law.

This policy does not authorize third-party collection of consumer health data over time across unrelated websites or online services. A route involving that practice is not available unless and until accurately disclosed and permitted by applicable law.

Subject to applicable law, you may confirm collection, sharing or sale; access your data; obtain the required list and available contacts of third parties and affiliates receiving it; withdraw consent for future collection or sharing; request deletion, including from applicable recipients; and appeal a refusal.

Use the available in-App privacy control or privacy@headii.com. Once the public privacy-request page is working and available, you may also use that page. A covered feature or market that legally requires an additional request route is not made available unless and until that route works. We authenticate requests proportionately and protect other people's information.

We respond and decide appeals within the applicable legal deadlines. A refusal explains the reason and how to appeal through the same contact. A Nevada consumer may also request review or changes to their data; where correction is unavailable, we explain applicable access or deletion options. If a Nevada appeal is denied, we provide the Nevada Attorney General's contact information as required. For a Washington appeal, we provide a way to contact the Washington Attorney General to complain if the appeal is denied.

Deletion includes notifying applicable processors and recipients. For a request governed by Washington law, deletion from archived or backup systems may be delayed only as needed to restore them and no later than six months after the request is authenticated. For a request governed by Nevada law, deletion from ordinary records and networks occurs no later than 30 days after authentication, subject to applicable exceptions; archived or backup deletion may be delayed only as needed for restoration and for no more than two years after authentication. Copies awaiting deletion are excluded from ordinary use.

If an incident involving consumer health data triggers notice under an applicable consumer-health privacy law, health breach-notification rule or other breach-notification law, Headii provides the notices required for its role and the affected data. This does not characterize every Headii service as a personal health record or every incident as a reportable breach.

For a material change, we use a conspicuous notice in the affected Service, a direct electronic notice to your account contact, or both, reasonably selected to reach you. The notice identifies the material change and when it applies, in advance where required. Updating this page alone does not supply any consent. Additional data categories, purposes or sharing require the applicable updated disclosure and affirmative consent before they begin.

Contact DOLLAR JUDGE INC dba Headii at privacy@headii.com or the postal address above. The effective date and version appear at the top of this policy.