Framed Minds

Consumer Health Data Privacy Policy

Last updated: October 26, 2026

Framed Minds is an educational, non-clinical platform — we never diagnose or treat anyone. But the reflections, assessment responses, and Echo conversations you share here may reveal information about your emotional life and, sometimes, your health. Some state laws treat that kind of information as “consumer health data.” This policy explains — separately and specifically — how we handle it. The plain-words version is on one page: What happens to what you tell us. This policy is the full version and controls.

1. What this policy covers

This Consumer Health Data Privacy Policy (“CHD Policy”) applies to information collected through the Framed Minds Services that identifies you and that is reasonably linkable to your past, present, or future physical or mental health status — including inferences derived from non-health information — to the extent such information is regulated as “consumer health data” or similar under applicable state law (for example, Washington’s My Health My Data Act, Nevada’s consumer health data law, or the sensitive data provisions of the Texas Data Privacy and Security Act).

If you are in the EEA, the United Kingdom, or Switzerland, this policy also serves as our notice regarding special category data under Article 9 of the GDPR and UK GDPR — data revealing health (including mental health), sex life or sexual orientation, religious or philosophical beliefs, and similar categories that may appear in what you share with Echo, in assessments, and in the Reflections you save from Echo. We process this content only on the basis of your explicit consent (Art. 9(2)(a)), collected through the mechanism described in Section 5, which also covers the transfer of that content to the United States for processing. Everything in this policy — your rights, withdrawal, and deletion — applies equally to special category data.

This CHD Policy supplements our Privacy Policy. Where the two overlap, this CHD Policy controls for consumer health data. Framed Minds is not a covered entity or business associate under HIPAA, and the information covered here is not protected health information — which is exactly why these state laws, and this policy, exist.

Plain-language note: we do not ask for your medical history, and our assessments never produce a diagnosis. This policy exists because you may choose to tell Echo about your anxiety, your medication, your therapy, or your trauma — and if you do, we want you to know exactly what happens to those words.

2. Categories of consumer health data we may collect

Depending on what you choose to share, this may include:

Emotional and behavioral pattern information — your assessment responses, Frame activation scores, Frame Stack, Archetype, and AI-generated summaries describing your current emotional and behavioral patterns;
Health-related information you volunteer — statements in Echo conversations, reflections, assessments, or community posts that mention a mental or physical health condition, diagnosis, symptoms, medication, treatment, therapy, substance use, disability, or similar topics;
Health-related inferences — insights our features derive from the above (for example, a Frame Insight noting a pattern of overwhelm);
Related usage information — for example, your use of Stillness meditation sessions or crisis-resource content, to the extent it could indicate a health-related interest;
A Frame Glimpse you choose to save: the Frame your glimpse leaned toward and a record of your yes, kept with your email address for 12 months if you ask us to email it to you (your guess and answers stay on your device). If you later create an account and agree to the consent in Section 5, the Frame your glimpse leaned toward and your guess are saved to your account.

We do not collect biometric identifiers, genetic data, precise geolocation, or bodily-function measurements, and we do not record your voice (voice input is converted to text by your own device; we receive only the text).

3. Where this data comes from

Directly from you — assessments, Echo conversations, reflections, community posts, and messages to support;
From people you invite — answers to your Frame Mirror links from people who know you;
From the Frame Glimpse — only what you choose to save: the Frame your glimpse leaned toward;
From Frame name feedback — nothing that identifies you. Answers about a Frame’s name are stored without your account, name or IP address, and typed words are filtered and deleted after 180 days (Privacy Policy, Section 2d). Please don’t type anything about your health;
Generated by our features — assessment results, summaries, and insights produced by the AI processing described in our Privacy Policy (Section 5).

We do not purchase consumer health data, and apart from the Frame Mirror answers you ask for, we do not acquire it from third parties.

4. Why we collect and use it

We collect and use consumer health data only to:

Provide the products and services you request — generate your assessment results, power Echo’s personalized responses, deliver features like Daily Compass, Frame Insights, Bridges (when you choose to participate), and your progress history;
Maintain safety and integrity — automated screening for abuse and safety, and human review by authorized personnel for support, safety, and quality (see Section 11);
Comply with legal obligations and respond to valid legal process; and
With your separate consent only — any optional research or product-development use of identifiable data. Absent that separate consent, improvement work uses aggregated or de-identified data.

6. Categories of third parties and affiliates that may receive it

We share consumer health data only as needed to provide the Services. The categories of recipients — and the specific providers currently in each category — are:

AI processing providers — OpenRouter (routing) and Anthropic (Claude models, which Amazon Bedrock or Google Vertex AI may serve for us when Anthropic is busy), which process Echo messages, assessment responses, Inner Cartography, daily check-ins, Frame Mirror and team readings (combined answers only), and our Kindness Watch review of public community posts to generate replies, results and alerts, and OpenAI, whose model answers instead only if Anthropic’s models are briefly unavailable. Under our arrangements and their API terms, they do not use this content to train general-purpose models and retain it only briefly for abuse and safety monitoring.
Text-to-speech providers — OpenAI and ElevenLabs, which receive only the text to be spoken (Echo replies, lesson narration, your summary video narration, generated meditation scripts) — never your voice.
Video rendering: JSON2Video, which receives the narration audio, on-screen words, and first name for a Reflection in Motion summary video you ask for.
Infrastructure providers — our hosting provider and Cloudflare (delivery/security), which host or transmit platform data as part of running the service.
Other members, only at your direction — a Bridges partner you choose (a Bridge is made only after they agree to it), or anyone you give a share link to.
Your team — if you join a Frames at Work team, after you say yes, your display name and your lead and second Frame.
Your table — if you take a Frame Tables seat, once the table is set, the members at it see your first name and your lead Frame.
Legal recipients — courts, regulators, or parties with valid legal process, as described in our Privacy Policy (Section 8).

Framed Minds, LLC has no affiliates that receive consumer health data. We maintain written agreements with the processors above governing confidentiality, security, and data handling.

7. No sale. No advertising use.

We do not sell consumer health data, and we will not do so without the separate, signed authorization applicable law would require.
We do not use consumer health data for advertising, targeted advertising, or marketing measurement, and we do not share it with advertising partners.
Advertising pixels and server-side advertising events never run on a page that asks you about yourself (the Frame Glimpse, the Self-Inventories, Frame Mirror answer pages, Bridges, the Daily Compass, Echo, your reflections and courses) or on Stillness pages, and purchases of Stillness sessions, Frame Table seats and Bridge Reports are never reported to advertising partners. Once you are signed in, the Meta pixel runs only on checkout. Nothing in this policy is ever sent to an advertising platform.

8. Your rights

With respect to your consumer health data, you have the right to:

Confirm whether we collect, share, or process it, and access it — including a list of the third parties with whom it has been shared;
Withdraw consent to its collection and processing (Section 9);
Delete it (Section 10); and
Appeal a decision we make on your request, using the appeal process in our Privacy Policy (Section 16).

To exercise any right, email [email protected] with “Privacy Request” in the subject line, or use your account settings. We verify requests as described in our Privacy Policy, respond within 45 days (extendable once by 45 days), and will never discriminate against you for exercising your rights.

9. Withdrawing consent — and what happens next

You can withdraw your Echo and assessment consent at any time through your account settings or by emailing us. When you withdraw:

Echo chat, assessments, and features built on assessment results (such as Daily Compass personalization, Frame Insights, Bridges, Inner Cartography, Frame Mirror, Frame Tables and Frames at Work teams) become unavailable;
Courses, community, Stillness practices, and events continue to work;
We stop sending your content to AI providers; and
You can separately request deletion of the Echo and assessment history we already hold (Section 10) — withdrawal alone does not delete it, in case you want to keep your history and return later.

10. Deletion

You can request deletion of your Echo conversation history, your assessment history, or both — without deleting your account — or request full account deletion. When we delete consumer health data:

It is removed from our active systems, and from encrypted backups as those backups roll off their cycle (up to 90 days);
We instruct our processors to delete corresponding data they hold; AI-provider copies are already limited to short abuse/safety retention windows under their API terms;
Bridges reports you shared with another member will no longer display your details;
De-identified or aggregated data derived before deletion (which no longer identifies you) may be retained; and
Deletion is subject to narrow legal exceptions (legal hold, fraud prevention, and records we are legally required to keep).

We aim to complete deletion within 45 days of a verified request.

11. Security and who can access it internally

Consumer health data is protected by the safeguards described in our Privacy Policy (Section 13). Internally, access is restricted to authorized administrators and support personnel who need it for support, safety, quality, and Terms enforcement. We are transparent about this: authorized Framed Minds personnel can view Echo conversations and assessment results, and Echo interactions are also screened automatically. Framed Minds content is not legally privileged and may be subject to legal process — see our Privacy Policy, Section 8.

12. Changes to this policy

We may update this CHD Policy from time to time. We will update the “Last updated” date and, for material changes to how we collect, use, or share consumer health data, we will provide notice and obtain fresh consent where required before the change applies to your data.

13. Contact

Email: [email protected] (subject line: “Privacy Request”)
Mailing address: 11816 Inwood Rd #1555, Dallas, TX 75244