Consumer Health Data Privacy Policy

1. What this policy covers

This Consumer Health Data Privacy Policy (“CHD Policy”) applies to information collected through the Framed Minds Services that identifies you and that is reasonably linkable to your past, present, or future physical or mental health status — including inferences derived from non-health information — to the extent such information is regulated as “consumer health data” or similar under applicable state law (for example, Washington’s My Health My Data Act, Nevada’s consumer health data law, or the sensitive data provisions of the Texas Data Privacy and Security Act).

If you are in the EEA, the United Kingdom, or Switzerland, this policy also serves as our notice regarding special category data under Article 9 of the GDPR and UK GDPR — data revealing health (including mental health), sex life or sexual orientation, religious or philosophical beliefs, and similar categories that may appear in what you share with Echo, in assessments, and in reflections. We process this content only on the basis of your explicit consent (Art. 9(2)(a)), collected through the mechanism described in Section 5, which also covers the transfer of that content to the United States for processing. Everything in this policy — your rights, withdrawal, and deletion — applies equally to special category data.

This CHD Policy supplements our Privacy Policy. Where the two overlap, this CHD Policy controls for consumer health data. Framed Minds is not a covered entity or business associate under HIPAA, and the information covered here is not protected health information — which is exactly why these state laws, and this policy, exist.

2. Categories of consumer health data we may collect

Depending on what you choose to share, this may include:

• Emotional and behavioral pattern information — your assessment responses, Frame activation scores, Frame Stack, Archetype, and AI-generated summaries describing your current emotional and behavioral patterns;
• Health-related information you volunteer — statements in Echo conversations, reflections, assessments, or community posts that mention a mental or physical health condition, diagnosis, symptoms, medication, treatment, therapy, substance use, disability, or similar topics;
• Health-related inferences — insights our features derive from the above (for example, a Frame Insight noting a pattern of overwhelm);
• Related usage information — for example, your use of Stillness meditation sessions or crisis-resource content, to the extent it could indicate a health-related interest.

We do not collect biometric identifiers, genetic data, precise geolocation, or bodily-function measurements, and we do not record your voice (voice input is converted to text by your own device; we receive only the text).

3. Where this data comes from

• Directly from you — assessments, Echo conversations, reflections, community posts, and messages to support;
• Generated by our features — assessment results, summaries, and insights produced by the AI processing described in our Privacy Policy (Section 5).

We do not purchase or otherwise acquire consumer health data from third parties.

4. Why we collect and use it

We collect and use consumer health data only to:

• Provide the products and services you request — generate your assessment results, power Echo’s personalized responses, deliver features like Daily Compass, Frame Insights, Bridges (when you choose to participate), and your progress history;
• Maintain safety and integrity — automated screening for abuse and safety, and human review by authorized personnel for support, safety, and quality (see Section 11);
• Comply with legal obligations and respond to valid legal process; and
• With your separate consent only — any optional research or product-development use of identifiable data. Absent that separate consent, improvement work uses aggregated or de-identified data.

5. Your consent

Before you first complete an assessment or interact with Echo, we present a separate, standalone consent — independent of our Terms of Use — that asks you to affirmatively agree to the collection and processing described in this policy. That consent identifies:

• The categories of potentially sensitive information involved;
• Why the information is processed;
• That Echo and assessment content is sent to our AI providers (OpenRouter and Anthropic) to generate responses and results;
• That your content is retained on our systems and may be reviewed by authorized personnel;
• How you can withdraw consent; and
• What stops working if you do (Section 9).

Your consent is recorded with a timestamp and the version of the consent text you accepted. We never obtain this consent through pre-checked boxes, continued browsing, or acceptance of general terms.

6. Categories of third parties and affiliates that may receive it

We share consumer health data only as needed to provide the Services. The categories of recipients — and the specific providers currently in each category — are:

• AI processing providers — OpenRouter (routing) and Anthropic (Claude models), which process Echo messages and assessment responses to generate replies and results. Under our arrangements and their API terms, they do not use this content to train general-purpose models and retain it only briefly for abuse and safety monitoring.
• Text-to-speech providers — OpenAI and ElevenLabs, which receive only the text to be spoken (Echo replies, lesson narration, generated meditation scripts) — never your voice.
• Infrastructure providers — our hosting provider and Cloudflare (delivery/security), which host or transmit platform data as part of running the service.
• Other members, only at your direction — a Bridges partner you choose, or anyone you give a share link to.
• Legal recipients — courts, regulators, or parties with valid legal process, as described in our Privacy Policy (Section 8).

Framed Minds, LLC has no affiliates that receive consumer health data. We maintain written agreements with the processors above governing confidentiality, security, and data handling.

7. No sale. No advertising use.

• We do not sell consumer health data, and we will not do so without the separate, signed authorization applicable law would require.
• We do not use consumer health data for advertising, targeted advertising, or marketing measurement, and we do not share it with advertising partners.
• Advertising pixels do not run on assessment or Echo pages.

8. Your rights

With respect to your consumer health data, you have the right to:

• Confirm whether we collect, share, or process it, and access it — including a list of the third parties with whom it has been shared;
• Withdraw consent to its collection and processing (Section 9);
• Delete it (Section 10); and
• Appeal a decision we make on your request, using the appeal process in our Privacy Policy (Section 16).

To exercise any right, email [email protected] with “Privacy Request” in the subject line, or use your account settings. We verify requests as described in our Privacy Policy, respond within 45 days (extendable once by 45 days), and will never discriminate against you for exercising your rights.

9. Withdrawing consent — and what happens next

You can withdraw your Echo and assessment consent at any time through your account settings or by emailing us. When you withdraw:

• Echo chat, assessments, and features built on assessment results (such as Daily Compass personalization, Frame Insights, and Bridges) become unavailable;
• Courses, community, Stillness practices, and events continue to work;
• We stop sending your content to AI providers; and
• You can separately request deletion of the Echo and assessment history we already hold (Section 10) — withdrawal alone does not delete it, in case you want to keep your history and return later.

10. Deletion

You can request deletion of your Echo conversation history, your assessment history, or both — without deleting your account — or request full account deletion. When we delete consumer health data:

• It is removed from our active systems, and from encrypted backups as those backups roll off their cycle (up to 90 days);
• We instruct our processors to delete corresponding data they hold; AI-provider copies are already limited to short abuse/safety retention windows under their API terms;
• Bridges reports you shared with another member will no longer display your details;
• De-identified or aggregated data derived before deletion (which no longer identifies you) may be retained; and
• Deletion is subject to narrow legal exceptions (legal hold, fraud prevention, and records we are legally required to keep).

We aim to complete deletion within 45 days of a verified request.

11. Security and who can access it internally

Consumer health data is protected by the safeguards described in our Privacy Policy (Section 13). Internally, access is restricted to authorized administrators and support personnel who need it for support, safety, quality, and Terms enforcement. We are transparent about this: authorized Framed Minds personnel can view Echo conversations and assessment results, and Echo interactions are also screened automatically. Framed Minds content is not legally privileged and may be subject to legal process — see our Privacy Policy, Section 8.

12. Changes to this policy

We may update this CHD Policy from time to time. We will update the “Last updated” date and, for material changes to how we collect, use, or share consumer health data, we will provide notice and obtain fresh consent where required before the change applies to your data.

13. Contact

Email: [email protected] (subject line: “Privacy Request”)
Mailing address: 11816 Inwood Rd #1555, Dallas, TX 75244